Difficulty: Beginner to Intermediate | Prerequisites: Basic networking knowledge (TCP/IP, ports), familiarity with Linux command line, understanding of what Active Directory is at a high level.
Active Directory (AD) is the backbone of identity and access management in most enterprise Windows environments. Penetration testers targeting AD need to know how to find users, discover weak credentials, and gain an initial foothold on the domain. This set of notes covers the reconnaissance and initial access phases: scanning the network to identify AD services, pulling user lists and metadata out of LDAP without credentials, and leveraging poor password hygiene to get a remote shell. If you have not yet studied how Windows networking and Kerberos authentication work at a basic level, review those topics first.
You scan the target with Nmap to confirm it is an AD domain controller, then use anonymous LDAP queries to pull a full list of domain users and find a default password left in an account description field. You spray that password across every user, find one account that still has it (with a forced password change), reset it with smbpasswd, and log in remotely via Evil-WinRM.
LDAP (Lightweight Directory Access Protocol)
A protocol used to query and modify directory services such as Active Directory. It runs on TCP port 389 (or 636 for LDAPS).
Think of it as the phone book for a Windows domain: it stores every user, group, and computer object, and anyone who can talk to it can look things up.
Nmap
A network scanning tool that discovers open ports and identifies services running on a target host.
In simple terms, this is the first tool you run against a target to find out what is listening and what software is behind each port.
sAMAccountName
The legacy logon name for a user or group object in Active Directory (e.g. Caroline.Robinson).
This is the username people type when logging in to a Windows domain.
Kerberos
The default authentication protocol in Active Directory, running on TCP/UDP port 88. It uses tickets rather than sending passwords over the network.
In simple terms, Kerberos is how Windows proves you are who you say you are, without ever sending your actual password across the wire.
Password spraying
An attack that tries one password (or a small set) against many accounts, rather than many passwords against one account. This avoids account lockout policies.
Think of it as the opposite of brute-forcing: instead of hammering one door with a thousand keys, you try the same key on every door in the building.
crackmapexec (CME)
A post-exploitation tool for Active Directory environments that can spray credentials across SMB, WinRM, LDAP, and other services.
In simple terms, it automates the tedious work of trying a username and password combination against many machines or users at once.
kerbrute
A tool that validates whether usernames exist in a domain by sending Kerberos pre-authentication requests. It does not require credentials.
Think of it as a way to confirm which users on your list are real accounts before you try any passwords.
Evil-WinRM
A penetration testing shell that connects to Windows machines via the WinRM (Windows Remote Management) service on port 5985/5986.
In simple terms, it gives you a PowerShell prompt on the target machine, as if you were sitting at its keyboard.
WinRM (Windows Remote Management)
A Microsoft service that allows remote command execution via HTTP/HTTPS, typically on port 5985 (HTTP) or 5986 (HTTPS).
Think of it as Windows' built-in way to let administrators run commands on machines across the network.
ldapsearch
A command-line utility for querying LDAP directories. It can perform anonymous binds (no credentials) if the server allows it.
In simple terms, it is the tool you use to ask the domain controller for its directory listing, often without needing a password at all.
smbpasswd
A command-line utility that changes a user's SMB/CIFS password on a remote server.
Think of it as the tool you reach for when a domain account's password has expired or must be changed before you can use it.
Run a service-version scan to identify what the target is running:
nmap
The -sC flag runs default scripts; -sV probes for service versions.
Key ports that confirm an Active Directory domain controller:
53 (DNS), 88 (Kerberos), 135 (RPC), 139/445 (SMB), 389/3268 (LDAP/Global Catalog), 636/3269 (LDAPS), 5985 (WinRM).
The Nmap output will often reveal the domain name (e.g. baby.vl), the computer name (e.g. BabyDC), and the OS version.
SMB signing status matters: if signing is "enabled and required," relay attacks are off the table.
Port 5985 open means WinRM is available, which is your remote shell path once you have credentials.
Many AD domain controllers allow anonymous LDAP binds by default, which means you can query the directory without any credentials at all.
Basic command to dump everything:
ldapsearch -v -x -b "DC=baby,DC=vl" -H "ldap://
-v verbose, -x simple authentication (anonymous), -b sets the search base (the domain's distinguished name), -H is the LDAP URI.
To extract just the usernames, pipe the output through grep:
ldapsearch ... | grep -i sAMAccountName:
This returns both built-in groups (Domain Users, Domain Guests, Cert Publishers) and actual user accounts (e.g. Caroline.Robinson, Teresa.Bell).
Critical step: grep for the description field as well:
ldapsearch ... | grep -i desc
Administrators sometimes store initial passwords or notes in description fields. In this case, the output revealed: "Set initial password to BabyStart123!"
This is a common real-world misconfiguration, not just a lab artefact.
Before spraying passwords, confirm which usernames from the LDAP dump are actually valid, enabled accounts.
kerbrute -domain baby.vl -users user.txt -dc-ip
kerbrute sends Kerberos AS-REQ packets. If the KDC responds with a pre-authentication error rather than "user not found," the account exists.
This step filters out service accounts, disabled accounts, and group names from your target list.
Once you have a validated user list and a candidate password, spray it:
crackmapexec smb
The --continue-on-success flag keeps spraying even after a successful login, so you catch every account that uses the password.
Interpreting the results:
STATUS_LOGON_FAILURE means wrong credentials.
STATUS_PASSWORD_MUST_CHANGE means the password is correct, but the account's password has expired and must be changed before you can authenticate fully. This is your way in.
Use smbpasswd to change the password remotely:
smbpasswd -U caroline.robinson -r
Enter the old password (BabyStart123!) and set a new one.
After the change, you now have valid, working credentials for that account.
With valid credentials and port 5985 open, connect:
evil-winrm -i
The -s flag sets a local script directory for uploading PowerShell scripts later.
You now have a PowerShell session on the domain controller as the compromised user.
First things to run: whoami, whoami /all (to see group memberships and privileges), and cat user.txt to grab any flags.
Students often think anonymous LDAP binds are a rare misconfiguration. They are not. Many production domain controllers allow them by default, and even hardened environments sometimes leave them open on internal networks.
Students sometimes assume that a STATUS_LOGON_FAILURE and a STATUS_PASSWORD_MUST_CHANGE are both "failed logins." They are fundamentally different. The second means the password is correct and the account is yours to use once you reset it.
It is a common mistake to skip the kerbrute validation step and spray passwords against every name pulled from LDAP, including group names and disabled accounts. This wastes time and can trigger alerts or lockouts unnecessarily.
Students often confuse the search base (-b "DC=baby,DC=vl") with a filter. The base sets where in the directory tree the search starts; the filter ((objectclass=*)) decides what objects match. Getting the base wrong returns zero results, not an error.
LDAP enumeration is typically the first step in any AD pentest and appears heavily in practical certifications (OSCP, PNPT, HTB CPTS).
Know the exact ldapsearch syntax cold: the -x -b -H flags and how to construct the base DN from a domain name.
Password spraying is tested in nearly every AD lab scenario. Remember the difference between STATUS_LOGON_FAILURE, STATUS_PASSWORD_MUST_CHANGE, and STATUS_ACCOUNT_LOCKED.
The description-field credential leak is a classic CTF and exam pattern. Always grep for description, info, and comment fields during LDAP enumeration.
Evil-WinRM is the go-to remote shell tool for AD boxes with port 5985 open. Know its flags, especially -i, -u, -p, -H (for pass-the-hash), and -s.
True or False: LDAP anonymous binds require at least a guest-level password to work.
False. An anonymous bind uses no credentials at all.
Fill in the blank: The ldapsearch flag ____ specifies simple (anonymous) authentication.
-x
True or False: A crackmapexec result of STATUS_PASSWORD_MUST_CHANGE means the password you tried is wrong.
False. It means the password is correct, but the account requires a password reset before it can be used.
Fill in the blank: The tool ____ validates whether usernames exist in a domain by sending Kerberos pre-authentication requests.
kerbrute
True or False: If SMB signing is "enabled and required," you can still perform SMB relay attacks.
False. Required signing prevents relay attacks.
Q: You have the IP address of a suspected Windows domain controller. What Nmap command would you run first, and which ports in the output confirm it is a DC?
A: nmap . Ports 88 (Kerberos), 389 (LDAP), 445 (SMB), and 53 (DNS) together strongly indicate a domain controller. The LDAP banner will usually include the domain name.
Q: Write the ldapsearch command to perform an anonymous bind and extract all objects from a domain called corp.local.
A: ldapsearch -v -x -b "DC=corp,DC=local" -H "ldap://
Q: During LDAP enumeration you find the description field reads "Temp password is Welcome2024!". What is your next step?
A: Save all enumerated usernames to a file, validate them with kerbrute, then use crackmapexec to spray "Welcome2024!" across every valid account.
Q: crackmapexec returns STATUS_PASSWORD_MUST_CHANGE for the user j.smith. How do you proceed?
A: Run smbpasswd -U j.smith -r , enter the old password (Welcome2024!), set a new password, and then authenticate with the new credentials.
Q: You have valid credentials for a domain user and port 5985 is open. What tool do you use to get a shell, and what command do you run?
A: Evil-WinRM. Command: evil-winrm -i . Once connected, run whoami /all to check group memberships and privileges.
This material connects directly to privilege escalation in Active Directory. Once you have an initial foothold via LDAP enumeration and password spraying, the next phase is checking what privileges your compromised account holds (SeBackupPrivilege, SeRestorePrivilege) and escalating to domain admin. See the companion notes on SeBackupPrivilege exploitation and NTDS.dit dumping.
Kerberos authentication underpins several related attack techniques: AS-REP Roasting (targeting accounts with pre-authentication disabled), Kerberoasting (requesting service tickets to crack offline), and Pass-the-Ticket. Understanding the enumeration phase here is prerequisite to all of them.
LDAP enumeration, ldapsearch, anonymous bind, Active Directory reconnaissance, Nmap AD scan, sAMAccountName, password spraying, crackmapexec, kerbrute, Evil-WinRM, WinRM port 5985, STATUS_PASSWORD_MUST_CHANGE, smbpasswd, domain controller enumeration, AD pentest initial access, LDAP description field credentials, Kerberos pre-authentication, SMB signing, Vulnlab Baby, OSCP AD, HTB Active Directory