Overview
Module 9 covers Active Directory attacks. It covers AD architecture and reconnaissance, enumerating users, groups, computers and trusts, abusing Kerberos through Kerberoasting and AS-REP roasting, pass-the-hash and pass-the-ticket, attacking delegation, mapping attack paths with tools such as BloodHound, and escalating to Domain Admin or domain dominance.
Active Directory is the center of most enterprise networks and of the CPENT range's inner segments. The module rewards systematic reconnaissance, recognizing attack paths that chain small misconfigurations into domain compromise, and reusing the credentials harvested in earlier modules. Reaching Domain Admin is often the decisive objective of the internal engagement. Reaching domain-wide control is often the decisive objective of the internal engagement, and it is documented in detail in the final report.
How it's tested
CPENT is performance-based, so this module shows up as systematic AD reconnaissance, Kerberos and credential attacks, and chaining misconfigurations to domain dominance, all documented. Because the exam is scored on what you achieve and document on live ranges, read each scenario for what it actually permits and reward methodical, evidence-backed work over guesswork.
-
Map the domain
You enumerate users, groups, computers, trusts and sessions to understand the domain.
-
Find the path
You use attack-path analysis to find the chain from a foothold to Domain Admin.
-
Abuse Kerberos
You use Kerberoasting, AS-REP roasting and pass-the-ticket to gain and reuse credentials.
With a low-privileged domain account, attacking the domain controller directly fails. Systematic enumeration and a path-mapping tool reveal that a reachable service account is Kerberoastable and that its group has rights leading toward Domain Admin. Kerberoasting that account, cracking or reusing its ticket, and following the mapped path to domain dominance is far more effective than brute force against the controller.
Modules 1
Official modules from the EC-Council outline, in outline order.
9.1 Active Directory Penetration TestingThis module covers attacking Active Directory: reconnaissance of the domain, abusing authentication such as Kerberos, es
- What it means
- Active Directory testing covers AD architecture and reconnaissance, enumeration of users, groups, computers and trusts, Kerberos attacks such as Kerberoasting and AS-REP roasting, pass-the-hash and pass-the-ticket, delegation abuse, attack-path mapping with tools such as BloodHound, and escalation to Domain Admin.
- What to understand
- Domain compromise usually comes from chaining small misconfigurations, not one exploit. Reconnaissance and path mapping find the chain. Kerberoasting extracts service-account hashes for offline cracking, and pass-the-ticket reuses Kerberos tickets. Credentials harvested in earlier modules accelerate the path.
- How it shows up
- Applied hands-on to enumerate AD, abuse Kerberos and chain misconfigurations to domain dominance on the range.
- Common confusion
- Confusing Kerberoasting with pass-the-ticket; Kerberoasting extracts crackable service-account hashes, while pass-the-ticket reuses an existing ticket.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
AD reconnaissance
Enumerating users, groups, computers, trusts and sessions.
- Remember
- It maps the domain before attack.
- Tested as
- Enumeration.
- Trap
- Attacking the controller before enumerating.
-
BloodHound attack paths
Graphing AD relationships to find routes to Domain Admin.
- Remember
- It reveals the shortest privilege path.
- Tested as
- Path analysis.
- Trap
- Hunting manually and missing paths.
-
Kerberoasting
Requesting service tickets to extract crackable service-account hashes.
- Remember
- Service accounts often have weak passwords.
- Tested as
- Kerberos attacks.
- Trap
- Confusing it with pass-the-ticket.
-
AS-REP roasting
Extracting crackable material from accounts without pre-authentication.
- Remember
- It needs accounts with pre-auth disabled.
- Tested as
- Kerberos attacks.
- Trap
- Expecting it to work on all accounts.
-
Pass-the-ticket
Reusing a captured Kerberos ticket to authenticate.
- Remember
- No password or cracking needed.
- Tested as
- Lateral movement.
- Trap
- Confusing it with Kerberoasting.
-
Pass-the-hash
Authenticating with a captured NTLM hash.
- Remember
- It enables movement without cracking.
- Tested as
- Lateral movement.
- Trap
- Assuming plaintext is required.
-
Delegation abuse
Exploiting unconstrained or constrained delegation.
- Remember
- It can impersonate users to services.
- Tested as
- Privilege escalation.
- Trap
- Overlooking delegation settings.
-
Trusts
Relationships between domains or forests.
- Remember
- They can extend access across boundaries.
- Tested as
- Lateral movement.
- Trap
- Ignoring cross-domain trust paths.
-
Domain dominance
Achieving Domain Admin or equivalent control.
- Remember
- It usually means owning the network.
- Tested as
- Objective.
- Trap
- Treating one host as the goal instead of the domain.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Kerberoasting vs. AS-REP roasting vs. pass-the-ticket
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Kerberoasting | Extract service-account hashes via service tickets | Crack offline for the password | Confusing it with pass-the-ticket |
| AS-REP roasting | Extract material from accounts without pre-auth | Needs pre-auth disabled | Expecting it on all accounts |
| Pass-the-ticket | Reuse an existing Kerberos ticket | No cracking needed | Confusing it with Kerberoasting |
Manual enumeration vs. attack-path mapping
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Manual enumeration | Querying AD objects by hand | Thorough but slow | Missing non-obvious paths |
| Attack-path mapping | Graphing relationships with a tool | Finds the shortest route to Domain Admin | Ignoring the tool and hunting blindly |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Hit the DC directly
- What candidates pick
- Attack the domain controller directly with a low-privileged account.
- Why it looks right
- The controller is the goal.
- Why it's wrong
- Domain compromise comes from chaining misconfigurations found through enumeration and path mapping.
Clue to watch for Only a low-privileged foothold is available.
-
Kerberoast is pass-the-ticket
- What candidates pick
- Call extracting a service-account hash pass-the-ticket.
- Why it looks right
- Both involve Kerberos.
- Why it's wrong
- Kerberoasting yields a crackable hash; pass-the-ticket reuses an existing ticket.
Clue to watch for The step extracts a hash to crack versus reusing a ticket.
-
One host is the goal
- What candidates pick
- Stop after compromising a single internal host.
- Why it looks right
- A foothold feels like success.
- Why it's wrong
- The objective is usually domain dominance, which unlocks the rest of the range.
Clue to watch for The domain controller and Domain Admin remain uncompromised.
-
Skip path mapping
- What candidates pick
- Hunt for privilege paths manually.
- Why it looks right
- Manual work feels precise.
- Why it's wrong
- Attack-path tools reveal non-obvious chains to Domain Admin that manual hunting misses.
Clue to watch for The privilege path is not obvious from direct enumeration.
-
Ignore delegation
- What candidates pick
- Overlook delegation settings during enumeration.
- Why it looks right
- Delegation seems like a normal feature.
- Why it's wrong
- Unconstrained or constrained delegation is a powerful escalation route.
Clue to watch for A host or account has delegation configured.
Answer framework
For any CPENT Active Directory Penetration Testing scenario, use these steps.
- Enumerate the domain systematically: users, groups, computers, trusts, sessions and delegation, working methodically and documenting the outcome before moving on.
- Map attack paths with a tool to find the shortest route from the foothold to Domain Admin.
- Abuse Kerberos through Kerberoasting or AS-REP roasting to obtain crackable or reusable credentials.
- Reuse credentials with pass-the-hash and pass-the-ticket, and exploit delegation where present, working methodically and documenting the outcome before moving on.
- Follow the mapped path to domain dominance, documenting each step and the credentials used, and record evidence and the reasoning for each decision as you go, since the engagement is judged partly on the professional report you submit at the end.
Practice question
Want more like this? The CPENT practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Active Directory is where the CPENT internal engagement is usually won, so invest heavily here. Build a small AD lab and practice systematic enumeration, then learn to read attack-path graphs so you can find the shortest route to Domain Admin rather than hunting blindly.
Master the Kerberos attacks and keep them distinct: Kerberoasting yields crackable service-account hashes, AS-REP roasting needs pre-authentication disabled, and pass-the-ticket reuses existing tickets. Practice chaining a small misconfiguration into domain compromise, and reuse the credentials you dumped in the Windows module. Keep documenting the path, because reaching Domain Admin is a headline result in the report. Afterwards, move to Module 10, wireless penetration testing. Throughout, keep a disciplined note-taking and evidence workflow, because the CPENT report and its evidence carry much of the score, and details are easily lost across a long, intense exam. Rehearse this in a lab until it is routine, and capture evidence as you work so the final report is complete and defensible.
FAQ
Why is Active Directory so important on CPENT?
AD manages enterprise identity, so compromising it usually means owning the network, and the range's deepest segments typically center on a domain.
What is Kerberoasting?
Requesting Kerberos service tickets to extract service-account hashes, which are then cracked offline, exploiting weak service-account passwords.
What is the difference between Kerberoasting and pass-the-ticket?
Kerberoasting extracts a crackable hash to recover a password. Pass-the-ticket reuses an existing Kerberos ticket without cracking anything.
Why use an attack-path tool?
Tools such as BloodHound graph AD relationships and reveal non-obvious chains to Domain Admin that manual enumeration can miss.
What is delegation abuse?
Exploiting unconstrained or constrained Kerberos delegation to impersonate users to services, a powerful escalation route.
Is a single host compromise enough?
Usually not. The objective is domain dominance, which unlocks the broader range and is the decisive internal result.
How does this module connect to the rest of CPENT?
It uses the footholds and credentials from the network and Windows modules and turns them into domain-wide control.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Practice Module 9 skills
You have covered AD reconnaissance, Kerberos attacks and chaining to Domain Admin. Practice path mapping and credential reuse in an AD lab.