OSCP Notes: Active Directory & Pivoting Cheat Sheet

OSCP Notes, Active Directory, and Pivoting Cheat Sheet

Active Directory. Not only the hardest thing to defend, but it is also the backbone of your business. It was designed for accessibility and interoperability back in the late 90's/early 2000’s. It’s the company’s phone book, data access, and user access. It’s the keys to the kingdom. It’s hard to defend against the inherent “Open by Default” architecture, the massive attack surface, and “Living off the Land” attacks. LDAP maps the network structure; built-in trust assumes everything inside the network is secure; insecure protocols like NTLM and LLMNR are easily abused for credential harvesting; misconfigured users can become “shadow admins”; Kerberoasting; misconfigured GPOs; DCShadow, etc. I could go on for days. However, this can be overwhelming for others starting.

Before the OSCP, I took the PJPT by TCM Security. To get a real feel for AD. That test wasn’t as bad as I thought, but for the OSCP, learning those concepts will help here. However, note that there is no LLMNR Posing. But you can still use responder. As long as you use this:

sudo responder -I tun0 -A -v 

As long as you use -A, all posing features will be turned off. Or you can nano into it. I know you need to know how to use it to pass the PJPT. For this exam, it's an enumeration test so that you can use it, but you may not need it. Have it in your back pocket.

Now, what makes this test so hard is that it brings together multiple skills at once. You aren’t just exploiting one thing—you’re navigating an entire ecosystem: OU abuse, mismanaged users, etc.

Host → User → Group → Domain → Policies → Protocols → Trusts

In OSCP labs, the AD chain is difficult because you must:

Enumerate users
Enumerate permissions
Understand group memberships
Notice subtle privilege assignment
Identify misconfigurations across multiple machines

You have a set to do. You may or may not get a user's credentials. Depending on the situation, follow these rules:

Rule one: 
assume you have anonymous/guest access. Until you after you run nxc
and don't have a user, assume, that is a misconfigure, until otherwise. 

Rule two: 
if you have a user, test everything, record it in blood hound, 
enumerate that user. That is your very strong clue. 

Rule three: 
the chain follows Microsoft PC's, if you get a user, and get access
review windows privesc. You may need to gain local access first. 

Rule four:
LOW PRIV USER
      ↓
Find unusual privilege or misconfiguration
      ↓
Abuse that privilege to escalate to a higher-priv account
      ↓
Gain access to a more sensitive machine or service
      ↓
Enumerate again (permissions change!)
      ↓
Find next misconfiguration
      ↓
Repeat until Domain Admin

Rule five:
Ask, why do you have this? Re-enumerate and review notes on user.
“Who do I control?”  “What can that object do that I couldn’t do before?”
“Who does THAT affect?”


Rule six: 
Treat this like another HTB or Proving Grounds box. It's not real
world. Think of the different quick methods on enumeration. You may not even
need to use minikatz (I would still use it). 

Rule seven:
If a new account gives you:

A new permission
A new SPN
A new group membership
A new GPO
Access to a new machine

Rule eight:
Kerberos Misconfigurations

Misconfigured SPNs
Weak or unexpected delegation
Accounts allowed to impersonate others
Users with SPNs who shouldn’t have them

Rule nine:
OSCP isn’t trying to trick you — they want to see if you can filter 
signal from noise.

Which AD objects matter
Which permissions actually mean escalation
What can be ignored


Rule ten:
the exam is testing your ability to chain multiple small wins, not find one 
big vulnerability.

Rule elven:
Active Directory privesc:

“This user can reset that user’s password”
“This group has GenericWrite on that object”
“This machine account can add a new SPN”
“This GPO applies somewhere unexpected”

Rule twelve:
It's ok to get hashes, pass the hash is quicker, just test it first.

Use the attack patterns to your advantage:

Low-Priv User
    ↓
Find: User has GenericWrite on another user
    ↓
That user has SPN / special rights
    ↓
That account can manage a service or machine
    ↓
Machine permission leads to DC access
    ↓
Domain Admin


GPO risk:
Low-Priv User
    ↓
User can modify a GPO
    ↓
GPO applies to a server or privileged user
    ↓
Privileges escalate when that user logs in
    ↓
Server access eventually leads to DC
    ↓
Domain Admin

Machine account:
Low-Priv User
    ↓
Compromise a machine account
    ↓
Machine has unexpected rights on DC object
    ↓
Privilege escalates through ACL chain
    ↓
Domain Admin

Enumeration checklist:

☐ Scan all TCP ports
☐ Scan UDP ports (Kerberos = UDP/88, DNS = UDP/53, etc.)
☐ Identify domain via SMB, LDAP banners, or RPC metadata
☐ Check for anonymous access on:

SMB
LDAP
RPC
WinRM error messages
MSSQL null connect

☐ Enumerate public SMB shares

☐ Gather usernames via:

RID brute forcing
rpcclient enumdomusers
SMB NULL sessions
Enumerating AD objects via LDAP anonymous (if allowed)

☐ Validate usernames (safe):

kerbrute userenum (conceptual understanding only)

☐ Check for users with descriptive attributes (descriptions, initials, notes)

☐ Try AS-REP vulnerability (ASREProasting) using collected usernames
☐ Try Kerberos service ticket analysis (Kerberoasting conceptually) once you have valid creds
☐ Test creds across protocols:

SMB
LDAP
RDP
WinRM
MSSQL
RPC

☐ Note protocols that return “access denied” vs “invalid credentials” 
(very important signal)

☐ For EVERY new credential, re‑enumerate:

SMB shares
Symlinks
GPO scripts
Config files
Password files
Installation leftovers
Backups
LAPS data exposure

☐ Look for:

Credentials in files
Interesting scripts
Scheduled tasks
Accessible SYSVOL scripts and GPO files

☐ Check for misconfigurations using AD enumeration tools (conceptual focus):

GenericWrite / GenericAll
WriteOwner
WriteDACL
ResetPassword rights
LAPS permission exposure
GPO modification rights

☐ Check delegation (concept):

Unconstrained
Constrained
Resource-based constrained delegation

☐ Check if any users have:

SPNs they shouldn’t
Machine account privileges
Password reset rights over higher‑priv users

☐ Upload data (safe conceptual step)
☐ Look for:

DCsync rights
GPO misconfigurations
ACL privilege paths
WriteDACL / GenericWrite relationships
Long chain attack paths (multi-step escalation)
☐ Validate that your current user belongs in BloodHound’s graph properly

Lateral Movement Logic
☐ Try each set of creds on all machines and all protocols
☐ Re-run enumeration once inside a machine:

Local admins
Cached creds
Token privileges
Logon sessions

☐ Look for multi-network setups:

Additional NICs
VLANs
Pivoting paths

☐ If pivoting required:

Treat new network as brand new recon target
Re-scan, re-enumerate, re-check AD access

☐ Collect ALL discovered credentials
☐ Test creds on:

MSSQL
WinRM
RDP
SMB
RPC
☐ Test NTLM authentication
☐ Track which creds work where

☐ Organize ALL creds in a file for cross-checking
☐ Rescan ports
☐ Re-check usernames
☐ Re-check BloodHound graph
☐ Re-enumerate SMB shares
☐ Re-validate discovered credentials
☐ Perform slow, careful LDAP object reviews
☐ Test every protocol again with known creds
☐ Check for forgotten GPOs or hidden OUs

Windows PrivEsc check as well:
☐ Run PowerUp conceptually
☐ Run WinPEAS conceptually
☐ Save all output
☐ Slowly review each category:

Services
Registry
Scheduled Tasks
Installed software
DLL search paths
File system permissions
Token privileges
Environment variables

☐ Who am I?
☐ What groups am I in?
☐ Do I have token privileges?

SeImpersonate
SeBackup
SeRestore
SeDebug
SeLoadDriver
☐ Writable service binaries
☐ Writable service directories
☐ Writable service registry keys
☐ Missing service binaries
☐ Unquoted service paths
☐ Tasks owned by SYSTEM
☐ Writable paths
☐ Broken/missing executables
☐ Tasks running scripts from user-writable locations
☐ Weak permissions on:

Services
Run keys
Startup keys
AlwaysInstallElevated (concept only)
☐ Writable directories in PATH
☐ Writable files owned by privileged users
☐ Program Files subdirectories with incorrect ACLs
☐ Outdated software
☐ Backup installers lying around
☐ Applications running with elevated privileges
☐ PATH injection
☐ Writable temp paths
☐ Writable referenced directories
☐ Credentials in:

Config files
Web.config
.ini files
Scripts
Backups
IIS configs

☐ Search recent files, logs
☐ Open ports internally
☐ Services running as SYSTEM
☐ Misconfigured internal web apps
☐ Re-enumerate EVERYTHING
☐ New permissions mean new attack surface
☐ Re-scan internal ports
☐ Re-check local groups
☐ Re-check registry permissions
☐ Re-check services

Combined AD + Windows PrivEsc Logic (OSCP Winning Formula):

Gain initial foothold (web, SMB, RDP, WinRM).
Enumerate creds + AD data.
Try creds across protocols + machines.
Gain new user or machine account.
Repeat enumeration.
BloodHound analysis 
Identify misconfig path.
Move laterally.
Enumerate local Windows for PrivEsc.
Escalate to admin.
Dump new creds.
Repeat across domain.
Eventually escalate to Domain Admin (conceptual).

This process may not work for others, but stick to a process to help you be accountable. Make the checklist and take your time.