If your user does not have special rights from BloodHound:
- AS-REP Roasting
- Kerberoasting
- Kerbrute
2. If step 1 gives you nothing:
- Enumerate which users are interesting
- Identify any interesting groups
3. Did you root the initial MS01 machine? If so:
- Are there any Kerberoast tickets for users?
- Are there LSA, LSASS, or SAM credentials you can reuse as another user?
4. SysVol:
- There might be credentials in SysVol, such as:
- GPP (Group Policy Preferences)
- VBS scripts
- Etc.
5. Enumerate LDAP:
- There might be useful information in the descriptions of users and computers.
6. Is the domain controller vulnerable to any attacks, such as the Print Spooler service?
7. Is ADCS (Active Directory Certificate Services) in use? If so, consider abusing certificate templates.
8. Kerberos Attacks : Delegation ( 3 types), Silver ticket, Golden ticket
9. Reading LAPS and gMSA, DC sync…
10. Use multiple tools: Bloodhound, Powerview, netexec, ldapdump..