- Operation
- Active Directory Security Resources
- Labs
- Resources
- Tools
- AD Documentation
- Tools, Scripts
- Enumeration, Tools & Commands
- GPO Enumeration:
- AD RSAT PS Module
- RUNAS(.exe) (Command Injection)
- Install RSAT && MMC for AD Activities
- CMD.exe && Powershell Commands
- DEFENSIVE & HARDENING, BEST PRACTICES, ETC
- Pentesting & Security Assessments
- Tools
- Example Reports
- Guides, reads,
- Recon
- About Bloodhound, Sharphound, Bluehound, Plumhound:
- Kerberoasting
Operation
Example VPN connection to an AD environment + LDAP connection to the DC:
Active Directory Security Resources
Run also PingCastle (GOOD):
[Attack]tive Directory: Compromising a Network in 20 Minutes Through Active Directory
www.youtube.com
![[Attack]tive Directory: Compromising a Network in 20 Minutes Through Active Directory](https://images.spr.so/cdn-cgi/imagedelivery/j42No7y-dcokJuNgXeA0ig/5fa6ee8c-ecc5-4673-9aee-9aed521b9458/maxresdefault/w=640,quality=90,fit=scale-down)
Labs
Resources
Tools
AD Documentation
AD Enumeration PS Cheatsheet
Tools, Scripts
My Script for generating an inventory of machine objects in AD
Check out:
Asset inventory AD + Powershell
AD Vuln Scanning (No la he checado)
Enumeration, Tools & Commands
GPO Enumeration:
# THIS SCRIPT REQUIRES GPO Management module (Installation below)
$AllGPOs = Get-GPO -All
foreach ($GPO in $AllGPOs) {
$GPOGUID = $GPO.Id
$ReportPath = "C:\PATH\GPO-REPORTS\" + $GPO.DisplayName + ".html"
Get-GPOReport -Guid $GPOGUID -ReportType html -Path $ReportPath
}AD RSAT PS Module
MODULE: Microsoft Management Console (MMC) + RSAT - Remote Server Administration Tools
Installation:
- Press Start
- Search "Apps & Features" and press enter
- Click Manage Optional Features
- Click Add a feature
- Search for "RSAT"
- Select "RSAT: Active Directory Domain Services and Lightweight Directory Tools" and click Install
RUNAS(.exe) (Command Injection)
Having credentials, and using a non-joined computer in the same network, we can “impersonate” a legitimate user, opening cmd/ps. This can assist in evading detection (AV), since we can deactivate AMSI and/or Antimalware to execute any task.
# Run command prompt as as administrator and execute:
runas.exe /netonly /user:<domain.com>\<username> cmd.exeInstall RSAT && MMC for AD Activities
# IMPORTANT: To list the installed RSAT Capabilities:
Get-WindowsCapability -Name RSAT* -Online | Select-Object -Property DisplayName, State- INSTALL RSAT:
Press Start → Search "Apps & Features" → Click Manage Optional Features → Click Add a feature → Search for "RSAT" → Select "RSAT: Active Directory Domain Services and Lightweight Directory Tools" → click Install
- Install GPO Management in Windows 10:
DISM.exe /Online /add-capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0- START MMC and attach AD RSAT Snap-In:
If the computer is joined to the domain:
Start → Run → Type “mmc” → In MMC, Click File -> Add/Remove Snap-in → Select and Add all three Active Directory Snap-ins → Click through any errors and warnings → Right-click on Active Directory Domains and Trusts and select Change Forest → Enter tk.domain.com as the Root domain and Click OK
Right-click on Active Directory Sites and Services and select Change Forest → Enter tk.domain.com as the Root domain and Click OK
Right-click on Active Directory Users and Computers and select Change Domain → Enter tk.domain.com as the Domain and Click OK
Right-click on Active Directory Users and Computers in the left-hand pane → Click on View -> Advanced Features
If it is not joined:
Use runas.exe to authenticate → In the cmd prompt type mmc
Navigating the MMC console:
CMD.exe && Powershell Commands
CMD.exe ENUMERATION
# VERIFICAR autenticación al dominio:
net view \\contoso\
net user # Local users
# hello
net user /domain # Domain users
net group /domain # Domain groups
net group "Domain Admins" /domain # Users of group Domain Admins
net user will.payne /domain # Domain user info
net account # Password policy locally (Account Lockout, etc.)
net account /domain # Password policy for DomainPOWERSHELL.exe ENUMERATION
# -Server seems to be optional unless the machine is not AD-Joined
Get-AdUser alan.watts -Server ad.domain.com -Properties * | format-table Name,Title -A
Get-ADUser -Identity alan.watts -Server ad.domain.com -Properties *
# Format-table & Filtering results (Like Grep with wildcards)
Get-ADUser -Filter 'Name -like "*stevens"' -Server ad.domain.com | Format-Table Name,SamAccountName -A
Get-ADGroup -Identity "Admins"
Get-AdGroupMember -Identity Administrators
# get "clark"'s Group membership (List only group names Clark is member of)
(Get-ADPrincipalGroupMembership -Identity "clark").name
# List all groups by name & Group Category
Get-ADGroup -Filter '*' | Format-table Name,GroupCategory
Get-ADObject -Filter 'badPwdCount -gt 0' -Server ad.domain.com
PS C:\> $ChangeDate = New-Object DateTime(2022, 02, 28, 12, 00, 00)
PS C:\> Get-ADObject -Filter 'whenChanged -gt $ChangeDate' -includeDeletedObjects -Server ad.domain.comDEFENSIVE & HARDENING, BEST PRACTICES, ETC
Lifecycle: Harden, Audit/Assess, Harden, SIEM
SIEM + AD logs
Pentesting & Security Assessments
“Modern Active Directory Attacks, Detection, and Protection Whitepaper” (Very Good)
Credit: https://github.com/Orange-Cyberdefense
Tools
adPEAS
Use ldapdomaindump.py + pretty . pretty.py loads already generated results with ldapdomaindump & display them at stdout:
(For this scenario I used “Badblood” for populating a dummy AD environment)
Check Pingcastle:
Example Reports
Guides, reads,
Recon
Having:
- An IP with open 3389, grab the screenshot of RDP session (If it’s not using NTLM) with
# If -u is not provided, the current user (Kali, Root, Parrot, My_Name) will be used to authenticate. With an empty -u we can see all the users that have logged in (ADministrator, etc.).
rdesktop -u '' <IP>About Bloodhound, Sharphound, Bluehound, Plumhound:
Microsoft Active Directory Houndsquad
Kerberoasting
Find Service Accounts with Bloodhound, Plumhound, get-spn.py, simply enumerating with PS, etc. that have the SPN (Service Principal Name) enabled. Examples:
# 1.- Request Kerberos ticket auth:
add-type -assemblyName system.identitymodel
new-object system.identityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "<SPN of Target Service Account>"
# 2.- Mimikatz For offloading Ticket + Hash
# 3.- Offline Cracking Krbtgt hash
1650323529/w=640,quality=90,fit=scale-down)
