Advanced Active Directory Exploitation: Kerberos Abuse, Golden Tickets, NTLM Relays and Enterprise Lateral Movement

Advanced Red Team Operations and Active Directory Exploitation: Kerberos Abuse, NTLM Relays and Lateral Movement Tradecraft

Modern enterprise exploitation increasingly revolves around identity systems rather than traditional memory corruption alone. Once attackers achieve initial access, the real objective becomes:

• Credential theft
• Lateral movement
• Privilege escalation
• Domain persistence
• Kerberos abuse
• Enterprise dominance

Active Directory environments remain one of the most valuable targets in modern offensive security because they centralize:

• Authentication
• Authorization
• Trust relationships
• Administrative access
• Enterprise identities

Key Takeaway

Modern enterprise compromise is fundamentally an identity attack problem where authentication protocols themselves become the primary attack surface.

Table of Contents

• Active Directory Internals
• Kerberos Authentication
• Golden and Silver Tickets
• NTLM Relay Attacks
• Delegation Abuse
• Lateral Movement
• DCSync Attacks
• Graph-Based AD Mapping
• Enterprise Persistence
• Kerberos Mathematics
• Related Articles

Understanding Active Directory

Active Directory is fundamentally a distributed identity and trust management system.

Domain controllers manage:

• User accounts
• Computer accounts
• Kerberos tickets
• Group policies
• Trust relationships

AD Authentication Flow

\[ User \rightarrow DomainController \rightarrow Resource \]

Attackers target Active Directory because compromising domain trust effectively compromises the enterprise itself.

Why AD Matters

Modern enterprises often depend entirely on centralized identity systems, meaning credential compromise frequently becomes more valuable than software exploitation.

Kerberos Authentication Internals

Kerberos uses ticket-based authentication instead of transmitting passwords repeatedly.

Kerberos Components

Component	Purpose
KDC	Key Distribution Center
TGT	Ticket Granting Ticket
TGS	Service Ticket
SPN	Service Principal Name

Kerberos Authentication Formula

\[ User + SecretKey \rightarrow TGT \]

Kerberos Workflow

1. User authenticates to KDC
2. KDC issues TGT
3. User requests service ticket
4. Service validates ticket

Kerberos Request Example

klist

CLI Output Example

Expand Kerberos Ticket Cache

Cached Tickets: (2)

krbtgt/DOMAIN.LOCAL
cifs/server.domain.local

Kerberoasting

Kerberoasting abuses service accounts with SPNs registered inside Active Directory.

Attackers request:

\[ TGS_{Service} \]

then attempt offline password cracking.

Attack Logic

\[ ServiceTicket \rightarrow OfflineCracking \]

because service tickets contain encrypted data derived from service account credentials.

PowerShell Enumeration

GetUserSPNs.py domain.local/user:password

Why Kerberoasting Works

Service accounts frequently use weak or unmanaged passwords because they are rarely monitored like human user accounts.

Golden Ticket Attacks

Golden Tickets allow attackers to forge arbitrary Kerberos TGTs.

This requires:

• KRBTGT hash
• Domain SID

Golden Ticket Mathematics

\[ KRBTGT_{hash} + SID \rightarrow ForgedTGT \]

Once attackers possess the KRBTGT secret, they can generate valid tickets indefinitely.

Mimikatz Example

kerberos::golden /user:Administrator /domain:corp.local

Why Golden Tickets Are Dangerous

• Long-term persistence
• Domain-wide access
• Bypass password resets
• Stealth authentication

Silver Ticket Attacks

Silver Tickets forge service tickets rather than TGTs.

This only requires:

\[ ServiceAccountHash \]

instead of full KRBTGT compromise.

Silver Ticket Scope

Ticket Type	Scope
Golden Ticket	Entire domain
Silver Ticket	Single service

NTLM Relay Attacks

NTLM authentication remains heavily deployed despite Kerberos adoption.

NTLM relay attacks forward authentication attempts to other services.

Relay Flow

\[ Victim \rightarrow Attacker \rightarrow Target \]

without cracking passwords directly.

Common Relay Targets

• SMB
• LDAP
• HTTP
• MSSQL

Responder Example

responder -I eth0

CLI Output Example

Expand NTLM Capture Output

[SMB] NTLMv2 Hash Captured
User: administrator

Why NTLM Relays Persist

Legacy enterprise compatibility requirements keep NTLM enabled even though it introduces major authentication relay risks.

Delegation Abuse

Kerberos delegation allows services to authenticate on behalf of users.

Misconfigured delegation creates severe privilege escalation opportunities.

Delegation Types

• Unconstrained Delegation
• Constrained Delegation
• Resource-Based Constrained Delegation

Delegation Logic

\[ Service_A \rightarrow Service_B \]

using delegated credentials.

RBCD Abuse

Attackers can manipulate:

\[ msDS-AllowedToActOnBehalfOfOtherIdentity \]

to impersonate privileged users.

Lateral Movement Tradecraft

After initial compromise, attackers move laterally through enterprise systems.

Common Lateral Movement Methods

Method	Description
PsExec	Remote service execution
WMI	Remote management execution
WinRM	PowerShell remoting
RDP	Interactive sessions

Pass-the-Hash

Pass-the-Hash uses NTLM hashes directly:

\[ NTLMHash \rightarrow Authentication \]

without requiring plaintext passwords.

Example PsExec

psexec.py administrator@target

DCSync Attacks

DCSync abuses Active Directory replication privileges.

Attackers impersonate domain controllers and request password hashes.

DCSync Formula

\[ ReplicationRights \rightarrow DomainHashes \]

Mimikatz DCSync

lsadump::dcsync /user:krbtgt

This often becomes the precursor to:

• Golden Tickets
• Enterprise persistence
• Domain dominance

Enterprise Reality

Compromising replication privileges effectively means compromising the entire domain infrastructure.

Graph-Based AD Enumeration

Modern red teams increasingly use graph theory to map attack paths.

BloodHound visualizes:

• User privileges
• Group relationships
• Session data
• Delegation rights

Graph Relationship Logic

\[ User_A \rightarrow Group_B \rightarrow Admin_C \]

Attackers search for shortest privilege escalation paths.

BloodHound Collection

SharpHound.exe -c All

Enterprise Persistence

Advanced attackers frequently establish long-term persistence after domain compromise.

Common Persistence Mechanisms

• Golden Tickets
• Skeleton Keys
• AdminSDHolder abuse
• SID History injection
• Backdoored GPOs

Persistence Equation

\[ Persistence + Stealth = LongTermAccess \]

Credential Dumping

Credential dumping targets:

• LSASS memory
• SAM databases
• DPAPI secrets
• Cached credentials

LSASS Memory Formula

\[ LSASS \rightarrow Credentials \]

Modern EDR products heavily monitor LSASS access because credential theft frequently begins there.

AD CS Abuse

Active Directory Certificate Services introduced new enterprise attack paths.

Misconfigured certificate templates enable:

• Privilege escalation
• Authentication impersonation
• Long-term persistence

Certificate Authentication Logic

\[ Certificate \rightarrow KerberosAuthentication \]

Why AD CS Became Critical

Certificate-based authentication frequently bypasses traditional password monitoring and introduces stealth persistence mechanisms.

Kerberos and Detection Mathematics

Ticket Lifetime Logic

\[ T_{expiration} = T_{issue} + Lifetime \]

Privilege Graph Theory

\[ ShortestPath(User, DomainAdmin) \]

Authentication Correlation

\[ SuspicionScore = FailedAuth + TicketAnomalies + LateralMovement \]

Hash Cracking Probability

\[ P(success) \propto WeakPasswordComplexity \]

Machine Learning and Enterprise Detection

Modern enterprise security increasingly relies on machine learning to detect:

• Lateral movement
• Ticket anomalies
• Impossible travel
• Credential abuse
• Privilege escalation

Important machine learning concepts:

• Entropy in Machine Learning
• Information Gain
• Precision vs Recall
• Bias Variance Tradeoff

Previous Parts of This Series

• Part 1 — Weaponizing Connect-Back Shellcode
• Part 2 — Advanced Shellcode and ROP Exploitation
• Part 3 — Modern Binary Exploitation
• Part 4 — Kernel Exploitation and Privilege Escalation
• Part 5 — Advanced Malware Tradecraft and EDR Evasion
• Part 7 - Advanced Web Application Exploitation: SQL Injection, SSRF, Session Hijacking and Modern Offensive Security Tradecraft

Related Security Articles

• Evolution of IDS and IPS
• Deep Packet Inspection Internals
• HTTP Tunneling Detection
• Modern Security Architectures
• Advanced Packet Inspection

Final Thoughts

Modern enterprise exploitation increasingly revolves around identity manipulation rather than only software vulnerabilities.

Advanced operators must understand:

• Kerberos internals
• Trust relationships
• Authentication protocols
• Enterprise privilege graphs
• Credential flows
• Delegation mechanisms

As enterprise defenses continue evolving, offensive operations increasingly depend on:

• Stealth authentication
• Ticket forgery
• Identity abuse
• Credential replay
• Graph-based privilege escalation
• Enterprise persistence engineering

Understanding these techniques provides critical insight into how modern red teams operate inside large enterprise Active Directory environments.