Active Directory remains one of the most targeted systems in enterprise intrusions — not because it's inherently vulnerable, but because its default configurations leave open doors that attackers know all too well. This retrospective on three classic attack vectors from a lab illustrates concretely what "hardening a domain" actually means.
Simulation environment: Kali Linux clients, Windows servers, and domain controllers in GNS3.
1. LLMNR/NBT-NS poisoning and NTLM relay attack
The vulnerability
By default, when Windows fails to resolve a machine name via DNS, it falls back to legacy protocols: LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service). These protocols broadcast the request across the local network. A malicious machine can then respond in place of the legitimate server and trigger a fraudulent authentication.
Offensive exploitation
Using Responder on Kali Linux, I intercepted requests coming from Windows machines on the domain. Then, instead of cracking a hash offline, I relayed the NTLM authentication in real time to another target on the network (SRV2) to execute remote commands without ever knowing the password.
Hardening
- Global disabling: apply a GPO to disable LLMNR and NetBIOS across the entire fleet.
- SMB signing: enable and require SMB signing via GPO to prevent session replay and relay.
2. Secret extraction and Pass-the-Hash (PtH) attack
The vulnerability
On Windows, passwords never travel in the clear: they're represented by NTLM hashes.
The lsass.exe process keeps these in memory for SSO. The risk is major:
possessing a hash can be enough to authenticate to a remote service (SMB, WinRM), as
if it were the password itself.
Offensive exploitation
In an audit context with elevated privileges, a tool like Mimikatz can extract NTLM hashes from memory. Then, with evil-winrm or impacket-psexec, it's possible to open a remote session by injecting the hash directly.
# Example Pass-the-Hash command structure
evil-winrm -i 192.168.1.101 -u Administrator -H <32-character_ntlm_hash>Hardening
- LAPS deployment: a unique, randomized local administrator password per machine.
- Credential Guard and Protected Users: LSASS isolation and reduced exposure surface for sensitive accounts.
3. Abusing Kerberos: Kerberoasting
The vulnerability
Even in a Kerberos environment, an authenticated user can request TGS tickets for domain services. These tickets are encrypted with the service account's secret. If that account's password is weak, an offline dictionary attack can reveal the plaintext credential.
Offensive exploitation
I enumerated SPNs to identify a vulnerable service account (sqlsvc),
then extracted a TGS ticket with Rubeus. The resulting hash was then
submitted to an offline crack (John the Ripper / Hashcat), with no detectable network
noise.
Hardening
- Managed accounts (gMSA): long, complex service passwords that rotate automatically.
- Strong Kerberos encryption: enforce AES128/AES256 and disable RC4.
Conclusion
These three cases illustrate a central truth: attackers frequently exploit default configurations and legitimate usage rather than 0-day vulnerabilities. The administrator's and auditor's job is to systematically harden what already exists to drastically reduce the attack surface.