- Operation
- Active Directory Security Resources
- Labs
- Resources
- Tools
- AD Documentation
- Tools, Scripts
- Enumeration, Tools & Commands
- GPO Enumeration:
- AD RSAT PS Module
- RUNAS(.exe) (Command Injection)
- Install RSAT && MMC for AD Activities
- CMD.exe && Powershell Commands
- DEFENSIVE & HARDENING, BEST PRACTICES, ETC
- Pentesting & Security Assessments
- Tools
- Example Reports
- Guides, reads,
- Recon
- About Bloodhound, Sharphound, Bluehound, Plumhound:
- Kerberoasting
Operation
Example VPN connection to an AD environment + LDAP connection to the DC:
Active Directory Security Resources
Run also PingCastle (GOOD):
[Attack]tive Directory: Compromising a Network in 20 Minutes Through Active Directory
www.youtube.com
Labs
Resources
Tools
AD Documentation
AD Enumeration PS Cheatsheet
Tools, Scripts
My Script for generating an inventory of machine objects in AD
Check out:
Asset inventory AD + Powershell
AD Vuln Scanning (No la he checado)
Enumeration, Tools & Commands
GPO Enumeration:
# THIS SCRIPT REQUIRES GPO Management module (Installation below)
$AllGPOs = Get-GPO -All
foreach ($GPO in $AllGPOs) {
$GPOGUID = $GPO.Id
$ReportPath = "C:\PATH\GPO-REPORTS\" + $GPO.DisplayName + ".html"
Get-GPOReport -Guid $GPOGUID -ReportType html -Path $ReportPath
}
AD RSAT PS Module
MODULE: Microsoft Management Console (MMC) + RSAT - Remote Server Administration Tools
Installation:
- Press Start
- Search "Apps & Features" and press enter
- Click Manage Optional Features
- Click Add a feature
- Search for "RSAT"
- Select "RSAT: Active Directory Domain Services and Lightweight Directory Tools" and click Install
RUNAS(.exe) (Command Injection)
Having credentials, and using a non-joined computer in the same network, we can “impersonate” a legitimate user, opening cmd/ps. This can assist in evading detection (AV), since we can deactivate AMSI and/or Antimalware to execute any task.
# Run command prompt as as administrator and execute:
runas.exe /netonly /user:<domain.com>\<username> cmd.exe
Install RSAT && MMC for AD Activities
# IMPORTANT: To list the installed RSAT Capabilities:
Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property DisplayName, State
- INSTALL RSAT:
Press Start → Search "Apps & Features" → Click Manage Optional Features → Click Add a feature → Search for "RSAT" → Select "RSAT: Active Directory Domain Services and Lightweight Directory Tools" → click Install
- Install GPO Management in Windows 10:
DISM.exe /Online /add-capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0
- START MMC and attach AD RSAT Snap-In:
If the computer is joined to the domain:
Start → Run → Type “mmc” → In MMC, Click File -> Add/Remove Snap-in → Select and Add all three Active Directory Snap-ins → Click through any errors and warnings → Right-click on Active Directory Domains and Trusts and select Change Forest → Enter tk.domain.com as the Root domain and Click OK
Right-click on Active Directory Sites and Services and select Change Forest → Enter tk.domain.com as the Root domain and Click OK
Right-click on Active Directory Users and Computers and select Change Domain → Enter tk.domain.com as the Domain and Click OK
Right-click on Active Directory Users and Computers in the left-hand pane → Click on View -> Advanced Features
If it is not joined:
Use runas.exe to authenticate → In the cmd prompt type mmc
Navigating the MMC console:
CMD.exe && Powershell Commands
CMD.exe ENUMERATION
# VERIFICAR autenticación al dominio:
net view \\contoso\
net user # Local users
# hello
net user /domain # Domain users
net group /domain # Domain groups
net group "Domain Admins" /domain # Users of group Domain Admins
net user will.payne /domain # Domain user info
net account # Password policy locally (Account Lockout, etc.)
net account /domain # Password policy for Domain
POWERSHELL.exe ENUMERATION
# -Server seems to be optional unless the machine is not AD-Joined
Get-AdUser alan.watts -Server ad.domain.com -Properties * | format-table Name,Title -A
Get-ADUser -Identity alan.watts -Server ad.domain.com -Properties *
# Format-table & Filtering results (Like Grep with wildcards)
Get-ADUser -Filter 'Name -like "*stevens"' -Server ad.domain.com | Format-Table Name,SamAccountName -A
Get-ADGroup -Identity "Admins"
Get-AdGroupMember -Identity Administrators
# get "clark"'s Group membership (List only group names Clark is member of)
(Get-ADPrincipalGroupMembership -Identity "clark").name
# List all groups by name & Group Category
Get-ADGroup -Filter '*' | Format-table Name,GroupCategory
Get-ADObject -Filter 'badPwdCount -gt 0' -Server ad.domain.com
PS C:\> $ChangeDate = New-Object DateTime(2022, 02, 28, 12, 00, 00)
PS C:\> Get-ADObject -Filter 'whenChanged -gt $ChangeDate' -includeDeletedObjects -Server ad.domain.com
DEFENSIVE & HARDENING, BEST PRACTICES, ETC
Lifecycle: Harden, Audit/Assess, Harden, SIEM
SIEM + AD logs
Pentesting & Security Assessments
“Modern Active Directory Attacks, Detection, and Protection Whitepaper” (Very Good)
Credit: https://github.com/Orange-Cyberdefense
Tools
adPEAS
Use ldapdomaindump.py + pretty . pretty.py loads already generated results with ldapdomaindump & display them at stdout:
(For this scenario I used “Badblood” for populating a dummy AD environment)
Check Pingcastle:
Example Reports
Guides, reads,
Recon
Having:
- An IP with open 3389, grab the screenshot of RDP session (If it’s not using NTLM) with
# If -u is not provided, the current user (Kali, Root, Parrot, My_Name) will be used to authenticate. With an empty -u we can see all the users that have logged in (ADministrator, etc.).
rdesktop -u '' <IP>
About Bloodhound, Sharphound, Bluehound, Plumhound:
Microsoft Active Directory Houndsquad
Kerberoasting
Find Service Accounts with Bloodhound, Plumhound, get-spn.py, simply enumerating with PS, etc. that have the SPN (Service Principal Name) enabled. Examples:
# 1.- Request Kerberos ticket auth:
add-type -assemblyName system.identitymodel
new-object system.identityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "<SPN of Target Service Account>"
# 2.- Mimikatz For offloading Ticket + Hash
# 3.- Offline Cracking Krbtgt hash