ad ntds escalation

The problem

Active Directory engagements often stall due to Kerberos time skew or over-complicating the escalation path. Security professionals waste hours debugging authentication failures when a simple NTLM hash reuse or clock sync would have secured a domain foothold.

What it does

• Performs initial triage including clock synchronization and FQDN mapping to prevent Kerberos auth blockers.
• Systematically tests recovered credentials across SMB, WinRM, MSSQL, and LDAP services using pass-the-hash (PTH).
• Executes an escalation ladder from anonymous LDAP enumeration to service account exploitation and NTDS.dit dumping.
• Automates domain controller secret extraction using secretsdump.py with background execution to avoid session timeouts.

Frameworks & tools

NetExec (nxc), Impacket (secretsdump, getTGT), bloodyAD, and LDAP3.

Why this beats prompting it yourself

It enforces a "cheapest-first" methodology that prioritizes hash reuse over noisy exploits. It includes specific tool workarounds, such as forcing NetExec for WinRM hash auth where standard libraries fail, and mandates backgrounding long-running NTDS dumps to prevent data loss.

Use cases

• Escalating from a single workstation foothold to Domain Admin in a CTF or lab environment.
• Auditing Domain Controller security by attempting to dump the SAM, LSA, and NTDS databases.
• Identifying misconfigured service accounts with WinRM access or Reanimate rights.

Known limitations

Requires an existing foothold or credential set to begin the ladder. NTDS dumping requires local administrative privileges on the Domain Controller.