Kirito Active Directory Documentation

Microsoft SQL Server (MSSQL) is a relational database management system (RDBMS) commonly used in corporate environments due to its scalability and integration with Windows Server, Azure, and Active Directory. Because of its widespread use, it presents several critical security attack vectors, including data theft, remote command execution, privilege escalation, lateral movement, and the establishment of persistence within a network.

PowerShell Remoting (PSRemoting) allows users to execute commands, run scripts, and modify configurations on remote Windows machines from a single workstation. It operates via the WS-Management protocol using TCP port 5985 for unencrypted (HTTP) connections and TCP port 5986 for encrypted (HTTPS) connections. To use PSRemoting, the user must have local administrator privileges on the remote system. It is enabled by default on Windows Server 2012R2 and later, but disabled by default on Windows 10 and Windows 11.

BloodHound is a tool used to automate the reconnaissance of Active Directory (AD) environments, especially in large-scale networks where manual enumeration is impractical. It uses graph theory to map the environment: nodes represent AD objects, edges denote directional relationships between those objects, and paths indicate potential attack vectors. This allows security professionals to identify efficient routes to high-value targets, such as Domain Administrator accounts. BloodHound is used by both offensive teams (to find vulnerabilities) and defensive teams (to mitigate them) and supports cloud environments like Azure.

PowerShell is a task automation and configuration management framework consisting of a shell and a scripting language developed by Microsoft. Unlike the traditional command prompt (cmd), PowerShell uses a verb-noun syntax and allows for the manipulation of .NET objects and access to Windows APIs. It is native to Windows starting from Windows 7 and Windows Server 2008 R2. Since 2016, it has become open-source and cross-platform, supporting Linux, macOS, and Docker images.

Constrained Delegation is a security configuration that limits a service account's ability to delegate credentials to only specific services on specific servers. Because the standard Kerberos protocol cannot filter access during delegation, it uses two extensions: Service for User to Self (S4U2self) and Service for User to Proxy (S4U2proxy).

Kerberos is the primary authentication protocol for Active Directory (AD), providing strong encryption and Single Sign-On (SSO) capabilities. It allows users to access network services using a single set of credentials (User ID and password) without needing to re-authenticate for every service. In a Windows environment, Active Directory Domain Services are a prerequisite for standard Kerberos implementations.

Command and Control (C2 or C&C) infrastructure consists of tools and techniques that allow an attacker to maintain communication with compromised devices on a network after the initial exploitation phase. C2 is essential for maintaining persistence, communicating with compromised hosts, and exfiltrating sensitive data. Common strategies to avoid detection include blending attacker traffic with legitimate organizational traffic using protocols like HTTP, HTTPS, and DNS, as well as employing encryption and encoding.

When a user with local administrator privileges is identified on a system, several strategies can be used to interact directly with the computer to gather essential information for network movement. Key techniques for achieving this include PSRemoting, PSexec, Invoke-Command, and Remote Desktop Protocol (RDP).

During the post-exploitation phase, transferring files between an attacker's machine and a compromised machine is a critical step. This process involves uploading or downloading files, which may be hindered by security systems, firewalls, or AppLocker. On Windows systems, this can be achieved using native binaries and functionalities. For a comprehensive list of native Windows binaries that can be used for downloading files (Living Off The Land Binaries and Scripts), refer to the LOLBAS project.

BITSAdmin is a command-line tool used to manage the Background Intelligent Transfer Service (BITS). It allows for precise control over the scheduling and progress of background file transfers, supporting pausing, resuming, and canceling tasks. Because it is the native tool used by Windows for system updates, it is frequently used in red team operations to download files while optimizing bandwidth and avoiding system performance degradation.