AD Network Simulation - Red Team Training
Simulation Control
Manual Step Mode
Next
Reset Simulation
Scenarios
Legitimate Actions
Standard User Logon
Admin: Add User to Group
Host: GPO Update Check
User: Request Certificate
User: Access File Share
Enumeration & Discovery
SharpHound/BloodHound Enum
Requires domain user account
LDAP Recon
Requires domain user account
SAMR User Enum (Remote)
Requires user account (non-admin)
SMB Share Enum
Often anonymous or user context
DNS Recon (Zone Transfer/Enum)
Often anonymous or user context
Initial Access & Credential Attacks
Password Spray
Direct attack - No user required
LLMNR/NBT-NS Poisoning
Requires network position
NTLM Relay (via Poisoning/PetitPotam)
Requires network position/coercion
Kerberoasting (Service Acct Hashes)
Requires domain user account
AS-REP Roasting (User Acct Hashes)
Requires user with preauth disabled
PetitPotam (NTLM Coercion)
Direct attack to coerce auth
Exploitation of Known Vulnerabilities
ZeroLogon (Netlogon Vuln - CVE-2020-1472)
Direct attack - DC PrivEsc
PrintNightmare (Spooler Vuln - CVE-2021-34527)
User to System PrivEsc/RCE
Privilege Escalation
LAPS Password Retrieval
Requires read rights on ms-Mcs-AdmPwd
gMSA Password Retrieval
Requires rights to read gMSA password
Unconstrained Delegation Abuse
Requires server account compromise
Constrained Delegation (KCD) Abuse
Requires KCD service compromise
RBCD Abuse
Requires principal write access
GPO Modification Abuse
Requires GPO edit rights
MS14-068 (PAC Forgery - CVE-2014-6324)
Requires domain user account creds
Shadow Credentials
Requires write access to target object
Lateral Movement
Pass-the-Ticket (PtT)
Requires user's Kerberos tickets
Pass-the-Hash (PtH)
Requires user's NTLM hash
Remote Service/Command Exec (WMI/PSExec/WinRM)
Requires admin credentials on target
Scheduled Task Abuse (Remote)
Requires credentials on target
Certificate & PKI Attacks (AD CS)
ESC1 (Template SAN Abuse)
Enroll + Manager Approval + SAN flag
ESC2 (Template Any Purpose EKU)
Enroll + Dangerous EKU
ESC3 (Template Enrollment Agent EKU)
Enroll + Enrollment Agent EKU
ESC4 (Template ACL Abuse)
Write rights on template
ESC6 (CA NTLM Auth Abuse - EDITF_ATTRIBUTESUBJECTALTNAME2)
Requires ADCS NTLM Auth Enabled
ESC8 (Relay to Web Enrollment / RPC)
Requires ADCS Web Enrollment/RPC Auth
Domain Compromise & Persistence
DCSync (Replication Rights Abuse)
Requires replication privileges
NTDS.dit Extraction (Offline Cred Access)
Requires DA or backup rights
Golden Ticket (KRBTGT Hash Abuse)
Requires krbtgt hash
Silver Ticket (Service Hash Abuse)
Requires service account hash
Skeleton Key (LSASS Patching)
Requires Domain Admin (to patch LSASS)
DSRM Abuse (Admin Sync/Offline Logon)
Requires DSRM hash/sync control
AdminSDHolder Backdoor (ACL Abuse)
Requires DA (initially)
Legend
💾
DC
📜
CA
👤
User
👑
Admin
⚙️
Service Acct
💻
Workstation
🏢
Server
💀
Attacker
—→
Kerberos
––→
LDAP
···→
DRSUAPI
···→
RPC
––→
SMB
––→
NTLM
···→
DNS
—→
HTTP(S)
—→
Attack Flow
Simulation Log