Active Directory Is a Graph, Not a Checklist
Most AD compromises are not zero-days — they are predictable paths through misconfigured trust. A mental model for thinking about Active Directory the way an attacker actually does.
After enough engagements you stop seeing Active Directory as a list of servers and start seeing it as a directed graph. Nodes are principals — users, computers, groups. Edges are rights — member of, can reset password, admin to. Domain compromise is just finding a path from the node you control to the node you want.
This reframing matters because defenders patch nodes and attackers traverse edges. You can have every CVE closed and still fall to a path made entirely of legitimate permissions.
Start by mapping, not exploiting
The first move on internal access is never an exploit. It is enumeration. With any authenticated context — even a low-privilege user — you can read most of the directory.
# Collect the graph from a domain-joined or credentialed position
bloodhound-python -u 'svc-low' -p '<password>' \
-d corp.local -c All -ns 10.10.10.10BloodHound turns that collection into the graph. The query that matters is almost always “shortest path to Domain Admins” from whatever you hold. Nine times out of ten the answer is three or four hops, and not one of them is a vulnerability — they are all features.
The recurring edges
A handful of misconfigurations show up on nearly every estate:
- Kerberoasting — any user can request a service ticket for any account with an SPN. Accounts with weak passwords and an SPN are offline-crackable. Service accounts are the usual victims because nobody rotates their 2014 password.
- AS-REP roasting — accounts with pre-authentication disabled hand you a crackable hash with no credentials at all.
- Unconstrained / constrained delegation — a computer trusted for delegation is a computer that can impersonate you to other services. Find one, and a printer bug or a coerced authentication turns it into a credential vault.
- ACL abuse —
GenericAll,WriteDacl,ForceChangePasswordon the wrong object lets you rewrite the graph in your favour.
svc-low ──MemberOf──▶ Helpdesk ──ForceChangePassword──▶ jsmith
jsmith ──AdminTo──▶ FILE01 ──HasSession──▶ DA_adminFour edges. Zero exploits. Game over.
Kerberos in one paragraph
You do not need to memorise the RFC, but you need the shape. A TGT proves who you are; a TGS proves you may use a specific service. Roasting attacks abuse the fact that service tickets are encrypted with the service account’s password hash, so anyone who can request one can crack it offline. Delegation attacks abuse the fact that tickets can be forwarded. Almost every “advanced” Kerberos attack is a variation on those two facts.
If you understand why a ticket is crackable and why a ticket is forwardable, you understand most of Active Directory tradecraft.
What this means for defenders
The graph view is also the fix. Do not ask “are we patched?” Ask “what is the shortest path to our crown jewels, and which edge is cheapest to remove?”
- Run BloodHound yourselves, on a schedule, and treat new short paths as findings.
- Kill the easy edges: tiered admin, no SPNs on user accounts, pre-auth enforced, delegation audited.
- Rotate service account passwords and the
krbtgtkey like you mean it.
Attackers win by traversal. Defenders win by cutting edges. Same graph, opposite directions.