In mature enterprise environments, 90 percent of breaches do not originate from an external zero-day flaw. They unfold internally: an adversary or malicious insider gains low-privilege access and traverses misconfigured Active Directory (AD) access control lists (ACLs) and Kerberos delegation trusts until reaching Domain Admin dominance.
Historically, auditing these internal lateral movement paths required deploying manual penetration testing consultants on site for weeks. Today, Lorikeet Security's autonomous engine Lory executes comprehensive internal Active Directory assessments over encrypted Lory Mesh connections. Here is how Lory safely models Kerberos attack paths, enumerates directory misconfigurations, and highlights critical escalation risks.
Secure Internal Ingress via Lory Mesh
Conducting an internal directory assessment without exposing internal ports to the internet requires dedicated tunneling. Lory operates over Lory Mesh:
- Zero Inbound Firewall Ports: The enterprise deploys a lightweight connector (`lory-meshd.py`) on a designated Linux or Windows jump machine inside the corporate RFC 1918 network.
- Mutual TLS & WireGuard: The daemon initiates an outbound-only connection over TCP/UDP 51820 to Lorikeet Security's dedicated relay infrastructure.
- Tenant Isolation: Our orchestrator attaches execution workers to a private TUN interface (100.100.0.0/16) scoped exclusively to that client's directory controllers.
Automated Kerberos Vector Analysis
Once inside the network segment, Lory initiates non-destructive enumeration against Domain Controllers and Kerberos Key Distribution Centers (KDCs):
1. AS-REP Roasting Identification
Lory queries Active Directory for user accounts configured with the `DONT_REQ_PREAUTH` (Do not require Kerberos pre-authentication) flag. For these accounts, any domain user can request an AS-REP ticket without knowing the target account's password. Lory extracts the cryptographic hash safely, validating whether the account can be cracked offline without generating multiple failed logon events on the domain controller.
2. Kerberoasting and SPN Analysis
Any authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any Service Principal Name (SPN) registered within the forest. Lory's Active Directory subagent queries LDAP to catalogue all user accounts with registered SPNs (such as SQL Server or IIS service accounts), checks whether weak RC4 encryption (Ticket Type 23) is enabled, and evaluates the risk of offline password cracking.
3. Delegation & Constrained Protocol Transitions
Kerberos delegation allows services to impersonate users when accessing back-end resources. Lory audits:
- Unconstrained Delegation: Servers that store user TGT tickets in LSASS memory upon logon, allowing an attacker with local administrative control to impersonate domain administrators.
- Constrained Delegation with S4U2self: Services permitted to impersonate any user across the domain without protocol verification.
Lory Enumeration Toolsuite
Lory executes targeted, non-disruptive internal auditing tools wrapped in automated telemetry:
| Internal Tool | Target Protocol | Audit Function | Safety Guardrails |
|---|---|---|---|
smb_enum |
SMB (Port 445) | Checks SMB signing requirements, anonymous share access, and SMBv1 exposure. | Read-only metadata inspection, zero file modifications. |
ldap_search |
LDAP / LDAPS (389/636) | Maps domain trusts, ACL permissions, nested groups, and DCSync replication rights. | Strict pagination and rate limiting to prevent DC CPU spikes. |
snmp_enum |
SNMP (Port 161) | Sweeps for default public/private community strings revealing network topologies. | Single UDP query per community string. |
bloodhound_parser |
Graph ACLs | Computes transitive object relationships (GenericAll, WriteDacl, ForceChangePassword). | Analyzes graph representations in memory without DC interaction. |
Lory is engineered specifically to prevent service interruptions. Lory never executes high-volume password spray attacks that could exceed your organization's Account Lockout Threshold. All Kerberos and LDAP evaluations rely exclusively on legitimate single-query ticket acquisitions and directory lookups.
Human-in-the-Loop Attack Path Verification
When Lory identifies a complete escalation path from an entry-level workstation to Domain Admin privileges, the finding is routed to Lorikeet Security's credentialed offensive engineers (OSCP/CISSP). Our human experts inspect the graph edges, confirm the technical exploitability, and draft precise remediation guidance-such as disabling RC4, enforcing AES-256 for Kerberos, and removing dangerous `GenericAll` rights from non-admin security groups.
Audit Your Active Directory Environment Today
Eliminate hidden Kerberos escalation paths and Active Directory misconfigurations before malicious actors discover them.
