Active Directory for Red Teamers

Course Synopsis

An intensive that takes you from AD fundamentals to full domain compromise, with the protocol and API layer treated as a first-class subject rather than something hidden behind a tool. Seven modules cover how Active Directory is built, how its authentication protocols work on the wire, how to talk to a domain through every available interface, how to map a target systematically, and how to execute the attacks that matter.

The course is hands-on throughout. Every concept is demonstrated with working C# and Python tooling, raw packet construction, and lab exercises that each close with a full solution walkthrough.

Coming Soon →
Module 01

Introduction to Active Directory

Directory Architecture

  • Forest, tree, and domain: namespace and trust hierarchy, and what each boundary means to an attacker
  • Domain controllers and FSMO roles
  • The AD object model: classes, attributes, and the schema
  • Distinguished names and the AD namespace

Identity and Privilege

  • Security identifiers: structure, RID allocation, and well-known SIDs
  • Access tokens: logon sessions and how group membership lands in a token
  • Group types and security group scope, and how nesting hides escalation paths
  • Privileged groups and the built-in security boundaries
  • Group Policy Objects: architecture and red team impact

Authentication Protocols

  • Kerberos v5: the full AS and TGS exchange, end to end
  • NTLM: the challenge-response protocol and its structural weaknesses
  • Kerberos RFC 4120 on the wire: application tags and the KDC-REQ structure
  • AP-REQ internals: EncryptedData, the ticket, and the authenticator
  • NTLM wire format: the byte layout of NEGOTIATE, CHALLENGE, and AUTHENTICATE
  • LDAP BER encoding and the tag-length-value wire format
  • DC Locator: DsGetDcName, SRV records, and the CLDAP ping

Orientation

  • Common attack paths from a standard user to Domain Admin
  • Red team toolkit overview: BloodHound, Rubeus, Impacket, PowerView, Mimikatz
Module 02

Interacting with AD: APIs and Protocols

The Directory APIs

  • The AD interaction API landscape and how to choose between the options
  • The Windows LDAP API (wldap32.dll): connection, search, paging, and value retrieval
  • ADSI: the IDirectorySearch and IADs COM interfaces
  • System.DirectoryServices.Protocols: raw LDAPv3 from C#
  • WMI architecture, the AD-relevant namespaces, and domain enumeration queries
  • NetAPI32: NetUserEnum, NetGroupEnum, NetShareEnum

RPC Interfaces

  • DCE/RPC: the endpoint mapper, transports, and the PDU format with auth verifier and NDR encoding
  • SAMR: account database access over RPC, user enumeration, and forced password reset
  • LSA and LSARPC: policy handles, account rights, named pipe transport, and the Netlogon secure channel
  • DRSR: DsGetNCChanges, the API that DCSync is built on
  • MS-NRPC: the Netlogon credential computation and the Zerologon bypass

Tokens, Secrets, and Security Contexts

  • Token manipulation: OpenProcessToken, DuplicateTokenEx, and impersonation
  • Named pipe impersonation for token capture, in C
  • Token binary layout: TOKEN_PRIVILEGES and NtQueryInformationToken
  • LSA secrets storage and syskey decryption
  • SSPI and the Kerberos API: AcquireCredentialsHandle and InitializeSecurityContext

Protocol Details That Matter

  • LDAP bind over SASL/SPNEGO and NegTokenInit token wrapping
  • LDAP filter OIDs, bitwise matching rules, and transitive membership queries
  • PAC buffer types: KERB_VALIDATION_INFO and the PAC signatures
  • DRSR attribute types and the supplementalCredentials format
  • MS-KILE extensions: PKINIT, S4U2Self, and S4U2Proxy
Module 03

LDAP Query Syntax, Operators, and Obfuscation

Filter Grammar from the Specification Up

  • The RFC 4515 filter grammar in full
  • Every filter type and its BER tag and wire encoding
  • Equality, presence, and approximate match at the byte level
  • Substring filters and their initial, any, and final components
  • extensibleMatch: matching rules, the dn: component, and OID operators
  • Microsoft extensions: bitwise OIDs and range retrieval

Obfuscating a Query Without Changing Its Meaning

  • Hex escape sequences: encoding filter values byte by byte
  • Attribute descriptor obfuscation: OIDs, options, and case folding
  • Boolean operator obfuscation, deep nesting, and RFC 4526 edge cases
  • Wildcard decomposition and range comparison rewrites
  • Parser stress testing: long values, malformed OIDs, and deep nesting

Defeating Query Monitoring

  • How LDAP query logging works and what diagnostic levels expose
  • Differential parsing: what the directory accepts versus what a monitor actually sees
  • Building obfuscated queries programmatically in C#

Exercises

  • Build an obfuscated Kerberoast enumeration filter
  • Bypass a SIEM wildcard detection rule using substring decomposition and logic inversion
Module 04

LDAP and CLDAP Network Protocol Internals

The Wire

  • LDAP TCP framing: a self-delimiting BER stream, and parsing message boundaries from raw bytes
  • The full TCP session lifecycle from SYN through bind, search, unbind, and FIN
  • CLDAP: connectionless LDAP over UDP, the Netlogon ping, and the response structure
  • The CLDAP attack surface: spoofing, amplification, and denial of service
  • Constructing raw BindRequest and SearchRequest BER by hand
  • LDAP result codes and reading target state out of the code and diagnostic message

LDAP Inside LSASS

  • ntdsa.dll and the ATQ thread pool that services directory requests
  • Reading an LSASS thread stack during LDAP request processing
  • What it means for a red team that the directory service lives inside LSASS

Structure-Aware Protocol Fuzzing

  • What fuzzing is and which LDAP fields and mutation surfaces are worth targeting
  • Architecture of a BER-aware fuzzer: field enumeration by walking the message body
  • Mutation classes: tag, length, value, memory, struct, permutation, and constructed encodings
  • Smuggling, NTLM, indefinite-length, and envelope mutations
  • Semantic boundary probes for string and integer fields
  • Fuzzing encapsulated tokens: SASL, Kerberos, and SPNEGO
  • Stateful and feedback-driven modes, safety gating, and the crash oracle output format
  • Case study: a stack-based buffer overflow in CLDAP Netlogon handling

Exercises

  • Read a raw LDAP PDU and decode the response by hand
  • Run a dry-run and an authorized live fuzzing session, then interpret the output
Module 05

Protocol Reference, Enumeration, and Recon

The AD Protocol Surface Map

  • Every protocol by port, authentication mechanism, and attack relevance
  • LDAP and CLDAP: operations, auth mechanisms, signing, and paging
  • Kerberos: AS-REQ and TGS-REQ, plus the MS-KILE extensions
  • NTLM/NTLMSSP: challenge-response, NTLMv2, and pass-the-hash
  • MSRPC: the framework, named pipes, and the endpoint mapper
  • SAMR, LSARPC, DRSUAPI, and NETLOGON, one at a time
  • SMB as the transport under most of the above
  • AD-integrated DNS zones, ADWS, WinRM/WS-MAN, and WMI/DCOM
  • A selection matrix for choosing the right protocol per task, and a working C# client for each

Enumeration Methodology

  • Ordering enumeration by noise level against data value
  • userAccountControl: the account state bitmask and what each flag means
  • Finding Kerberoastable and AS-REP roastable accounts
  • Delegation targets and msDS-AllowedToDelegateTo
  • ACL enumeration and identifying dangerous rights
  • ADCS template enumeration for certificate escalation paths
  • GPO and trust object enumeration
  • Domain password policy over SAMR and local admin discovery over NetAPI

Graphing and Correlating

  • BloodHound: SharpHound collection methods and Cypher queries for attack path discovery
  • ADPathAnalyzer: turning BloodHound JSON into a ranked attack path
  • Credential material: where hashes, tickets, and keys actually live
  • OPSEC: which enumeration steps are logged, and by what
Module 06

Active Directory Red Team Operations

Credential Attacks

  • Kerberoasting: SPN ticket extraction and offline cracking
  • AS-REP roasting against pre-authentication-disabled accounts
  • DCSync: replicating secrets through DRSUAPI
  • Credential hunting in SYSVOL, object descriptions, and LAPS

Permission and Delegation Abuse

  • The AD security descriptor structure and the high-value ACE permissions
  • GenericAll, WriteDACL, ForceChangePassword, and AddMember abuse
  • Unconstrained delegation and TGT harvesting
  • Constrained and resource-based constrained delegation
  • GPO attacks: object abuse and rogue linking

Certificate Services and Ticket Forgery

  • ADCS architecture and the enrollee-supplied subject attack
  • NTLM relay to the certificate authority web enrollment endpoint
  • Golden tickets: forging TGTs with the krbtgt hash
  • Silver tickets, overpass-the-hash, and pass-the-ticket

Persistence and Trust

  • AdminSDHolder and the SDProp propagation mechanism
  • DCShadow: pushing changes through a rogue replication partner
  • Skeleton Key: an LSASS patch for universal authentication
  • Trust attacks: SID filtering and the inter-forest pivot
  • Domain and forest trust enumeration, and LDAP signing and channel binding bypass

Building the Tooling Yourself

  • A modular C# LDAP client: connection, user enumeration, SPN queries, and ACL retrieval
  • Parsing nTSecurityDescriptor binary blobs by hand, and reading SDDL
  • An ACE analyzer with a dangerous-rights detection matrix
  • ADPathAnalyzer internals: the object graph model, a BFS path finder, edge classification, and difficulty scoring
  • A vulnerability scanner across three scan planes, and a self-contained HTML report
  • SharpHound internals: session, local admin, and ACL collection with LDAP paging
  • PingCastle-style checks: privileged accounts, domain configuration, trusts, stale objects, and password policy

Detection and Evasion

  • SACL configuration and object-level auditing
  • What DCSync looks like in the security event log
  • LDAP query logging and how it is tuned
  • Low-and-slow recon and other evasion considerations
Module 07

Practical Exercises

Ten Labs, Each With a Full Solution Walkthrough

  • LDAP enumeration with System.DirectoryServices.Protocols
  • Kerberoasting: service ticket request and hash cracking
  • AS-REP roasting against a pre-authentication-disabled account
  • ACL abuse: ForceChangePassword chained to Domain Admin
  • DCSync: credential extraction over the replication protocol
  • Golden ticket: forging a TGT with the krbtgt hash
  • Certificate template abuse for a Domain Admin certificate
  • Constrained delegation abuse via S4U2Self and S4U2Proxy
  • ADPathAnalyzer deep dive: path finding and vulnerability scanning
  • Trust pivot: SID history injection across a forest trust
Coming Soon → Buy the All Training Bundle →