AD Attack Path Index

Companion note to pentesting_active_directory.svg (Orange Cyberdefense AD mind map). The SVG stays local for reference; this note mirrors its state-based structure with plain markdown so it can publish through Digital Garden. Each line links to the cheatsheet with the actual commands, where one exists.

1. No Credentials

• Host/DC discovery, null and guest SMB, LDAP enum -> Domain & Host Enumeration, Manual LDAP Enumeration
• Poisoning and coercion (LLMNR/NBT-NS/mDNS, ARP, mitm6, PetitPotam-style coercion) -> no dedicated cheatsheet yet
• OSINT username enumeration -> no dedicated cheatsheet yet

2. Got Username, No Password

• Password spraying (check lockout policy first)
• AS-REP Roasting
• Blind Kerberoasting
• No dedicated cheatsheet yet for this state; hash handling once you get a result is in Kerberos & Clock Skew

3. Valid Credentials

• BloodHound collection and edge triage -> BloodHound Collection, BloodHound Edge Risk
• ACL/ACE abuse (GenericAll, WriteOwner, WriteDACL, ForceChangePassword, Shadow Credentials, RBCD, LAPS read) -> ACL & Edge Abuse
• Kerberoasting and delegation abuse (unconstrained, constrained, RBCD) -> Kerberos & Clock Skew
• GPO abuse, DNSAdmins abuse -> no dedicated cheatsheet yet
• ADCS misconfiguration (ESC1-ESC10) -> no dedicated cheatsheet yet
• MSSQL trusted link abuse -> no dedicated cheatsheet yet
• Known pre-auth CVEs (EternalBlue, Zerologon, SMBGhost, SYSVOL/GPP) -> no dedicated cheatsheet yet
• Tool execution across most of the above -> Impacket

4. Local Admin on One Machine

• Credential extraction (LSASS, SAM, LSA secrets, DPAPI, cached domain creds, browser) -> Grabbing Creds
• Lateral movement (PTH, PTK, PTT, RDP, WinRM, certificate auth) -> Lateral Movement
• Local privesc chains (UAC bypass, AMSI/AppLocker bypass, Potato family, PrintNightmare, Certifried, noPac) -> no dedicated cheatsheet yet

5. Domain Admin

• DCSync, ntds.dit dump -> DCSync & DC Takeover
• Persistence (Golden/Silver/Diamond/Sapphire tickets, Skeleton Key, Custom SSP, DSRM, DC Shadow, golden certificate) -> check coverage in the same file, may need its own section

6. Enterprise Admin / Trust Abuse

• Forest-to-forest trust abuse, SID history, trust tickets, cross-forest MSSQL links -> no dedicated cheatsheet yet

Reference

• Hash cracking modes by type (hashcat) -> no dedicated cheatsheet yet, candidate to fold into Kerberos & Clock Skew
• Full assumed-breach flow through these states -> OSCP AD Set - Assumed Breach Methodology
• Source: Orange Cyberdefense AD pentest mind map