|
Independent Active Directory & Internal Infrastructure Penetration Tester
Real adversaries rarely rely on zero-days once inside an enterprise network. Instead, they chain misconfigured Active Directory DACLs, AD CS certificate templates, Kerberos delegations, and authentication coercion paths. I identify and validate realistic attack paths from initial internal foothold to Tier-0 domain dominance, delivering clear findings and production-safe remediation guidance.
Available for direct enterprise Active Directory assessments and specialized white-label subcontracting for offensive security consultancies worldwide.
Assessment Capabilities
01 // Active Directory & AD CS Auditing
In-depth offensive auditing of Enterprise PKI (ESC1–ESC17, orphaned certificate templates, enrollment relays), Kerberos delegations (Unconstrained, KCD, RBCD, Shadow Credentials), dangerous DACL edges, GPO abuse, and cross-forest trust boundaries.
02 // Internal Network & Assumed Breach
Full lateral movement validation across 100–500+ endpoint environments. Authentication coercion & NTLM relaying, SMB/LDAP signing enforcement checks, LAPS/gMSA credential exposure, network segmentation verification, and infrastructure service pivoting.
03 // Subcontracting for Consultancies
Reliable, senior Active Directory & internal testing capacity for pentest firms and MSSPs. Seamless white-label execution aligned with your rules of engagement, testing infrastructure, and client reporting standards.
04 // Actionable Remediation & Debriefs
Zero automated scanner dumps. Every engagement delivers validated attack-path narratives, executive risk summaries, and live technical debriefs to help infrastructure teams fix root-cause identity flaws without disrupting production.
Example Finding: Validated Attack Path & Production-Safe Remediation
[AD-01] Misconfigured Printer & Group Permissions Allow Full Domain Takeover
Technical Title: Inherited WriteDacl on Tier-0 PKI Group Enables Domain
Compromise via AD CS ESC4 & PKINIT
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMFP-02, OU=Tier0, CA01, DC01 CN=PKI-Admins,OU=Tier0,DC=corp,DC=internalDuring the internal assessment, an unauthenticated multifunction printer
(MFP-FLOOR2 / 10.20.4.18) was found configured with an
Active Directory LDAP address-book bind account (CORP\svc_scan)
without administrative web interface protection. By triggering an LDAP pass-back connection,
cleartext domain credentials for svc_scan were recovered.
Because svc_scan is a member of the default Domain Users group, and a legacy Access Control Entry (ACE)
on OU=Tier0 granted Domain Users inherited WriteDacl permissions over the PKI-Admins security group, any authenticated domain user
could add themselves to PKI-Admins, modify Enterprise CA
certificate templates (ESC4), and request a Domain Admins certificate to compromise the entire corp.internal forest.
- 1. Remove Over-Privileged DACL Edge (Immediate): Remove the
WriteDaclACE granted toDomain UsersonCN=PKI-Admins,OU=Tier0,DC=corp,DC=internaland enable AdminSDHolder/Tier-0 ACL inheritance protection. - 2. Harden Network Appliance Bind Account: Rotate the
svc_scanpassword, set an admin webpage password on10.20.4.18, enforce LDAPS (TCP 636) with certificate validation, and restrictuserWorkstationsto the printer IP. - 3. Post-Fix Verification Check: Re-collect the directory ACL graph and confirm
zero outbound write edges exist from
Domain UsersorAuthenticated UserstoOU=Tier0andCN=Public Key Services.
Featured Research & Case Studies
nxc-adcs-orphans: NetExec AD CS Hygiene Detector
Open-Source Tool & ResearchEnterprise CAs can continue publishing certificate-template references in Active Directory
even after the underlying pKICertificateTemplate object
is deleted. When combined with delegated PKI write permissions, attackers can recreate
missing template objects that an Enterprise CA is already configured to issue.
nxc ldap <DC_IP> -u <USER> -p '<PASS>' -M adcs_orphansFrom Office Printer to Domain Admin
Internal Pentest Case StudyWhy hardened Windows workstations and disabled LLMNR aren’t enough: how multifunction
printers (LDAP pass-back), network switches, and over-privileged default group DACLs (Domain Users, Everyone, Pre-Windows 2000) turn an unauthenticated network drop
into full Tier-0 domain dominance.
(svc_printer) ─[MemberOf]─> (Domain Users) ─[GenericAll]─> (Tier-0)Certifications & Credentials
HTB CAPE
2026Certified Active Directory Pentesting Expert (HackTheBox)
Advanced enterprise Active Directory exploitation, AD CS abuse, Kerberos delegations, trust boundaries, and defense evasion.
Verify credential (opens in a new tab)OSCP
2024Offensive Security Certified Professional (OffSec)
Hands-on network penetration testing, internal pivoting, privilege escalation, and Active Directory domain compromise.
Verify credential (opens in a new tab)Completed Enterprise Pro Labs
- Alchemy(opens in a new tab) · Hack The Box · 2025
- Dante(opens in a new tab) · Hack The Box · 2024
Engagement Track Record & Experience
>Freelance Internal Penetration Tester @ Independent Security Consultant
January 2026 – PresentDelivering Active Directory and internal network penetration tests for enterprise environments comprising approximately 200–300 endpoints and 400–500 users, both directly and as a specialized subcontractor for cybersecurity consultancies. Worldwide, remote engagements.
Key Responsibilities & Achievements:
- Privilege Escalation & Lateral Movement: Identified and validated complex attack paths from initial internal access to Domain & Enterprise Administrator privileges.
- Internal Infrastructure Assessment: Assessed network segmentation, trust boundaries, AD CS configurations, exposed services, insecure protocols, and authentication weaknesses across authorized environments.
- Network & Device Exploitation: Leveraged misconfigured printers, switches, and network appliances to harvest credentials, bypass segmentation, and establish internal footholds.
- Reporting & Remediation: Produced executive summaries and detailed technical reports with validated findings and attack-path evidence, business impact, and prioritized remediation recommendations.
- Stakeholder Debriefing: Delivered remote and onsite technical debriefs to security and infrastructure teams, supporting remediation planning and risk reduction.
>Cybersecurity Engineer @ Osmium Solutions
August 2024 – January 2026Secured aerospace and automotive systems through Linux hardening, threat modeling, and offensive assessments within a five-person team supporting EU and ESA-related projects. Remote role across Spain and Italy.
Key Technical Achievements:
- System Hardening: Mitigated boot-level attack paths through kernel hardening and SELinux restrictions.
- Security-Control Coverage: Improved coverage to 80% against ANSSI and 86% against NIST across the assessed core controls.
- Offensive Assessments: Conducted security assessments of aerospace embedded systems, identifying exploitable attack paths.
- Technical Reporting: Documented findings and remediation recommendations for security and engineering stakeholders.
>Cybersecurity Researcher @ Instituto de Telecomunicações
October 2021 – December 2023Analyzed decentralized P2P energy-trading platforms and gRPC-based IoT infrastructure for consensus, cryptographic, and network-layer weaknesses. Based in Aveiro, Portugal.
Key Technical Achievements:
- Threat Modeling: Assessed distributed systems to identify critical attack paths, exploitation scenarios, and asynchronous abuse cases.
- Protocol & Smart Contract Auditing: Audited distributed ledger protocols for transaction-manipulation risks and contributed upstream security fixes to the Hedera JavaScript SDK.
Education
University of Aveiro
University of Aveiro
Ready to audit your Active Directory attack paths?
Whether you need a standalone internal network pentest or a specialized AD contractor for an upcoming client engagement, let’s scope your requirements.