Forest

$ tldr AS-REP Roast → BloodHound → DCSync → DA

·	·
Operating system	Windows
Difficulty	Easy
Vector	Active Directory
IP	`10.10.10.161`
Retirement date	2019-10-12
Skills	AXFR - Domain Zone Transfer Attack (Failed) RPC Enumeration - Getting valid domain users Performing an AS-RepRoast attack with the obtained users Cracking Hashes Abusing WinRM - EvilWinRM Ldap Enumeration - ldapdomaindump BloodHound Enumeration Gathering system information with SharpHound.ps1 - PuckieStyle Representing and visualizing data in BloodHound Finding an attack vector in BloodHound Abusing Account Operators Group - Creating a new user Abusing Account Operators Group - Assigning a group to the newly created user Abusing WriteDacl in the domain - Granting DCSync Privileges DCSync Exploitation - Secretsdump.py

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Cracking Hashes (hashcat / John)	HackTricks	Open
DNS zone transfer	HackTricks	Open
BloodHound	HackTricks	Open
BloodHound	BloodHound docs	Open
DCSync	HackTricks	Open

Active Directory · Kerberoasting · Brute Force / Rate-Limit Bypass

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07