Active Directory Post-Compromise Lab – Using CrackMapExec, Hash Dumping, and Pass-the-Hash Authentication

Objective

Today’s goal was to perform local enumeration and hash dumping on compromised hosts, then validate admin privileges using CrackMapExec (CME) with dumped credentials.

so i simulate a post-compromise scenario in an Active Directory (AD) environment using tools like CrackMapExec, secretsdump.py, and Impacket suite to:

• Enumerate network systems via SMB

• Identify valid credentials across multiple hosts

• Dump local SAM hashes

• Attempt pass-the-hash authentication and remote command execution

 Lab Setup

I continued using the same lab environment from the beginning of my Active Directory (AD) journey:

• 🖥️ Attack Machine – Kali Linux

• 💻 Windows 10 Workstation (Victim 1)

• 💻 Windows 10 Workstation (Victim 2)

• 🖲️ Windows Server (Domain Controller)

All machines are part of the same AD lab network.

 Step 1: Network Enumeration and Credential Validation

After obtaining valid domain credentials, I scanned the subnet using CrackMapExec to identify accessible hosts and test authentication as seen below.

Successfully authenticated to multiple hosts using valid domain credentials.
Pwn3d! indicates administrative access.

Step 2: Dumping Local SAM Hashes

I attempted to dump local account hashes from discovered hosts using --sam:

Outcome:

Retrieved local SAM hashes from accessible Windows 10 machines.

Step 3: Offline Hash Extraction with secretsdump.py

Used secretsdump.py to perform offline hash extraction from saved registry hives:

Extracted local user hashes.

Step 4: Pass-the-Hash Authentication (Local)

Tried authenticating using baska2’s NTLM hash across network:

✅ Valid hash on SULTANHASSAN
❌ Invalid elsewhere

---

 Step 5: Share Enumeration

Using the authenticated session, I enumerated available shares

shares directory is writable  potential upload point for tools or payloads.

Key Takeaways

Step	Outcome	Insight
Network Enumeration	✅	Discovered 3 AD hosts
Password Spray	✅	Valid creds for multiple machines
SAM Dump	✅	Extracted local user hashes
Pass-the-Hash	✅	Valid authentication on one host
Privilege Escalation	❌	No admin rights
Remote Shell	❌	RPC access denied

Mitigation

To prevent similar attacks in a real-world Active Directory (AD) environment, the following defensive measures are recommended:

1. Enforce Strong Password Policies

   • Require a minimum length of 14 characters.

   • Enforce complexity requirements (uppercase, lowercase, numbers, symbols).

   • Implement password expiration and history policies.

2. Implement Local Administrator Password Solution (LAPS)

   • Randomizes local admin passwords per machine.

   • Prevents attackers from reusing hashes across multiple hosts (mitigates Pass-the-Hash).

3. Restrict Lateral Movement

   • Disable SMBv1 and ensure SMB Signing = True.

   • Use firewall rules to limit SMB and RPC access only to necessary hosts.

4. Monitor for Suspicious Authentication

   • Log and monitor failed login attempts and NTLM authentications.

   • Use SIEM solutions (e.g., Splunk, Microsoft Sentinel) to detect Pass-the-Hash activity.

5. Apply the Principle of Least Privilege (PoLP)

   • Remove users from the local Administrators group unless absolutely required.

   • Avoid using domain admin accounts for daily operations.

6. Regularly Patch and Update Systems

   • Ensure all Windows hosts are updated with the latest security patches to prevent exploitation via known vulnerabilities.