Without shell access

1. Run auxiliary/gather/kerberos_enumusers or ker­brute to enu­mer­ate users.

   python kerbrute.py -domain thinc.local -users /usr/share/seclists/Usernames/Names/names.txt -dc-ip $victim

With shell access

Choose one method to enumerate.

1. User and group enumeration with net

(!) See what roles/privileges THIS USER has. Also localy. Maybe he/she has already admin­is­tra­tive privileges.

whoami /all

List (and store!) the users of the domain

net user /domain

List (and store!) infor­ma­tion like full names, group mem­ber­ships, etc. from users:

net user $user /domain

List (and store!) the groups of the domain (An * before groups means, that this group con­tains addi­tion­al per­mis­sions for the users.)

net group /domain

List (and store!) mem­bers of inter­est­ing groups:

net group "IT Department" /domain

1. User and group enumeration with PowerShell

Add this func­tion into a Pow­er­Shell session:

function LDAPSearch {
    param (
        [string]$LDAPQuery
    )
    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name
    $DistinguishedName = ([adsi]'').distinguishedName
    $DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$PDC/$DistinguishedName")
    $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)
    return $DirectorySearcher.FindAll()
}

Enu­mer­ate all users of the domain

LDAPSearch -LDAPQuery "(samAccountType=805306368)"

Enu­mer­ate all groups of the domain (An * before groups means, that this group con­tains addi­tion­al per­mis­sions for the users.)

LDAPSearch -LDAPQuery "(objectclass=group)"

Enu­mer­ate all mem­bers (which could also be groups!) of groups:

foreach ($group in $(LDAPSearch -LDAPQuery "(objectCategory=group)")) { $group.properties | select {$_.cn}, {$_.member} }

Enu­mer­ate all mem­bers of a giv­en group:

$group = LDAPSearch -LDAPQuery "(&(objectCategory=group)(cn=Admin Department*))"
$group.properties.member

Enu­mer­ate the objects from inter­est­ing groups and their ADRights. Pay atten­tion to objects/users with unusu­al high rights like GenericAll

Get-ObjectAcl -Identity "Management Department" |
Where-Object { $_.ActiveDirectoryRights -eq "GenericAll" } |
ForEach-Object {
$sid = $_.SecurityIdentifier
$right = $_.ActiveDirectoryRights
[pscustomobject]@{
Name = Convert-SidToName $sid
SID = $sid
Right = $right
}
}

1. User and group enumeration with PowerView

See the Pow­er­sploit / Pow­erview blog post

1. Enumeration with ADFind

See AdFind

TODO

2. Network enumeration

List “all” com­put­er in the domain:

. .\PowerView.ps1
Get-NetComputer
Get-NetComputer | select operatingsystem,dnshostname,operatingsystemversion // Shorter overview

Get more infor­ma­tion about a found computer:

Get-NetSession -Verbose -ComputerName $systemName

Find sys­tems where the cur­rent user has admin­is­tra­tive priv­i­leges. Pow­erView tries to con­nect to each group com­put­er and open the SCM Ser­vice Con­trol Man­ag­er. If that worked, we have some admin­is­tra­tive priv­i­leges on that system.

Find-LocalAdminAccess

For inter­est­ing com­put­ers, check if they have active ses­sions. Upload PSLoggedon.exe from PSTools. This only works if the Remote Reg­istry ser­vice is enabled, which is not the case since Win­dows 8, but is often acti­vat­ed by admins.

PSLoggedOn.exe \\$sysemName

3. Service enumeration

If you found a ser­vice user (e.g. before in Get-NetUser | select cn,pwdlastset,lastlogon), you can try to get more infor­ma­tion about that service:

• Native­ly in cmd:
  setspn -L iis_service
• With Pow­erView:
  Get-NetUser -SPN | select samaccountname,serviceprincipalname

Enu­mer­ate shares:

Find-DomainShare

After­wards, enu­mer­ate the found shares one by one with (yes, from Powershell!)

ls \\dc1.dom.ain\sysvol\dom.ain\
cat \\FILES04\docshare\docs\email.txt
...

Note: If you find a AES-256 pass­word, e.g. in a policy.xml file, you may be decrypt it with gpp-decrypt $pass on Kali.

4. Step back and connect

Stare some time to the found infor­ma­tion and try to con­nect / reor­ga­nize them.

5. Enumerate with BloodHound

See the Blood­Hound post

6. Things to do after the initial enumeration

• Try Pass­word Spraying
• If you have a user/password combination, 
  • try AS-REP Roast­ing
  • try a Ser­vice Account Attack
• If you have high-priv­i­lege user cre­den­tials, try 
  • Domain Con­troller Syn­chro­niza­tion techniques
  • Sil­ver tick­et attack
  • Gold­en tick­et attack
  • Extract Shad­ow Copies

N. Helpful PowerShell commands during enumeration

Get ACE Access Con­trol Entries from an object (sub­ject, com­put­er, share, …)

Get-ObjectAcl -Identity $object
Get-ObjectAcl -Identity $object | select ObjectSID,ActiveDirectoryRights,SecurityIdentifier

Con­vert a SID into a domain object name

Convert-SidToName S-1-5-21-1987370270-658905905-1781884369-1104

Check all AD objects for spe­cif­ic permissions:

# Get all users from Active Directory
$users = Get-ADUser -Filter * | ForEach-Object {
    $_.DistinguishedName
}

# Define the permissions to check for
$permissionsToCheck = @(
    "Replicating Directory Changes",
    "Replicating Directory Changes All",
    "Replicating Directory Changes in Filtered Set"
)

# Loop through each user and retrieve their ACLs and permissions
$users | ForEach-Object {
    $userDN = $_

    # Get the ACL for the user object and filter for replication-related permissions
    Get-ObjectAcl -Identity $userDN | Where-Object {
        $permissionsToCheck -contains $_.ActiveDirectoryRights.ToString()
    } | ForEach-Object {
        $sid = $_.SecurityIdentifier
        $rights = $_.ActiveDirectoryRights
        $name = Convert-SidToName $sid  # Convert the SID to a human-readable name

        # Output the permissions
        [pscustomobject]@{
            UserDN = $userDN
            SID = $sid
            Name = $name  # Add the converted name
            Rights = $rights
        }
    }
}

Older notes / links

2. Attack Ker­beros
   1. Try to ASRE­PRoast tickets
   2. Try a Ser­vice Account attack, if there are ser­vice user accounts.

Oth­er things, not nec­ces­sar­ly con­nect­ed to AD:

• Try msf> use post/multi/recon/local_exploit_suggester
• Try empire> use­mod­ule privesc/powerup/allchecks