{"id":1297,"date":"2020-04-25T14:10:02","date_gmt":"2020-04-25T12:10:02","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1297"},"modified":"2025-03-19T10:07:10","modified_gmt":"2025-03-19T09:07:10","slug":"active-directory-checklist","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1297","title":{"rendered":"Basic Active Directory Enumeration"},"content":{"rendered":"\n

Without shell access<\/h1>\n\n\n\n
    \n
  1. Run auxiliary\/gather\/kerberos_enumusers <\/i>or ker\u00adbrute to enu\u00admer\u00adate users.\n
    python kerbrute.py -domain thinc.local -users \/usr\/share\/seclists\/Usernames\/Names\/names.txt -dc-ip $victim<\/pre>\n<\/li>\n<\/ol>\n\n\n\n
    With shell access<\/h1>\n\n\n\n
    Choose one method to enumerate.<\/p>\n\n\n\n
    1. User and group enumeration with net<\/h2>\n\n\n\n
    (!) See what roles\/privileges THIS<\/span> USER<\/span> has. Also localy. Maybe he\/she has already admin\u00adis\u00adtra\u00adtive privileges.<\/p>\n\n\n\n
    whoami \/all<\/pre>\n\n\n\n
    List (and store!) the users of the domain<\/p>\n\n\n\n
    net user \/domain<\/pre>\n\n\n\n
    List (and store!) infor\u00adma\u00adtion like full names, group mem\u00adber\u00adships, etc. from users:<\/p>\n\n\n\n
    net user $user \/domain<\/pre>\n\n\n\n
    List (and store!) the groups of the domain  (An * before groups means, that this group con\u00adtains addi\u00adtion\u00adal per\u00admis\u00adsions for the users.<\/a>)<\/p>\n\n\n\n
    net group \/domain<\/pre>\n\n\n\n
    List (and store!) mem\u00adbers of inter\u00adest\u00ading groups:<\/p>\n\n\n\n
    net group \"IT Department\" \/domain<\/pre>\n\n\n\n
    1. User and group enumeration with PowerShell<\/h2>\n\n\n\n
    Add this func\u00adtion into a Pow\u00ader\u00adShell session:<\/p>\n\n\n\n
    function LDAPSearch {\n    param (\n        [string]$LDAPQuery\n    )\n    $PDC = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().PdcRoleOwner.Name\n    $DistinguishedName = ([adsi]'').distinguishedName\n    $DirectoryEntry = New-Object System.DirectoryServices.DirectoryEntry(\"LDAP:\/\/$PDC\/$DistinguishedName\")\n    $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher($DirectoryEntry, $LDAPQuery)\n    return $DirectorySearcher.FindAll()\n}<\/pre>\n\n\n\n
    Enu\u00admer\u00adate all users of the domain<\/p>\n\n\n\n
    LDAPSearch -LDAPQuery \"(samAccountType=805306368)\"<\/pre>\n\n\n\n
    Enu\u00admer\u00adate all groups of the domain  (An * before groups means, that this group con\u00adtains addi\u00adtion\u00adal per\u00admis\u00adsions for the users.<\/a>)<\/p>\n\n\n\n
    LDAPSearch -LDAPQuery \"(objectclass=group)\"<\/pre>\n\n\n\n
    Enu\u00admer\u00adate all mem\u00adbers (which could also be groups!) of groups:<\/p>\n\n\n\n
    foreach ($group in $(LDAPSearch -LDAPQuery \"(objectCategory=group)\")) { $group.properties | select {$_.cn}, {$_.member} }<\/pre>\n\n\n\n
    Enu\u00admer\u00adate all mem\u00adbers of a giv\u00aden group:<\/p>\n\n\n\n
    $group = LDAPSearch -LDAPQuery \"(&(objectCategory=group)(cn=Admin Department*))\"
    $group.properties.member<\/pre>\n\n\n\n
    Enu\u00admer\u00adate the objects from inter\u00adest\u00ading groups and their ADRights<\/a>. Pay atten\u00adtion to objects\/users with unusu\u00adal high rights like GenericAll<\/p>\n\n\n\n
    Get-ObjectAcl -Identity \"Management Department\" |\nWhere-Object { $_.ActiveDirectoryRights -eq \"GenericAll\" } |\nForEach-Object {\n$sid = $_.SecurityIdentifier\n$right = $_.ActiveDirectoryRights\n[pscustomobject]@{\nName = Convert-SidToName $sid\nSID = $sid\nRight = $right\n}\n}<\/pre>\n\n\n\n
    1. User and group enumeration with PowerView<\/h2>\n\n\n\n
    See the Pow\u00ader\u00adsploit \/ Pow\u00aderview blog post<\/a><\/p>\n\n\n\n
    1. Enumeration with ADFind<\/h2>\n\n\n\n
    See AdFind<\/a><\/p>\n\n\n\n
    TODO<\/span><\/p>\n\n\n\n
    2. Network enumeration<\/h1>\n\n\n\n
    List \u201call\u201d com\u00adput\u00ader in the domain:<\/p>\n\n\n\n
    . .\\PowerView.ps1
    Get-NetComputer
    Get-NetComputer | select operatingsystem,dnshostname,operatingsystemversion \/\/ Shorter overview<\/pre>\n\n\n\n
    Get more infor\u00adma\u00adtion about a found computer:<\/p>\n\n\n\n
    Get-NetSession -Verbose -ComputerName $systemName<\/pre>\n\n\n\n
    Find sys\u00adtems where the cur\u00adrent user has admin\u00adis\u00adtra\u00adtive priv\u00adi\u00adleges. Pow\u00aderView tries to con\u00adnect to each group com\u00adput\u00ader and open the SCM<\/span> Ser\u00advice Con\u00adtrol Man\u00adag\u00ader. If that worked, we have some admin\u00adis\u00adtra\u00adtive priv\u00adi\u00adleges on that system.<\/p>\n\n\n\n
    Find-LocalAdminAccess<\/pre>\n\n\n\n
    For inter\u00adest\u00ading com\u00adput\u00aders, check if they have active ses\u00adsions. Upload PSLoggedon.exe from PSTools<\/a>. This only works if the Remote Reg\u00adistry ser\u00advice is enabled, which is not the case since Win\u00addows 8, but is often acti\u00advat\u00aded by admins.<\/p>\n\n\n\n
    PSLoggedOn.exe \\\\$sysemName<\/pre>\n\n\n\n
    3. Service enumeration<\/h2>\n\n\n\n
    If you found a ser\u00advice user (e.g. before in Get-NetUser | select cn,pwdlastset,lastlogon<\/code>), you can try to get more infor\u00adma\u00adtion about that service:<\/p>\n\n\n\n