Active Directory

Introduction

Once the attacker has obtained a foothold on a computer inside an Active Directory network, its design must be understood, including the number of users, groups, computers, OUs, ACLs, and their relationships.

In this phase, the attacker should be focused on enumerating information that can be further used to elevate privileges or perform lateral movements.

Domain

General Information

• Get current domain

PowerView

Get-Domain [-Domain <DIFFERENT_DOMAIN>]

ADModule

Get-ADDomain [-Identity <DOMAIN>]

• Get current domain controller

PowerView

Get-DomainController [-Domain <DIFFERENT_DOMAIN>] | select Forest, Name, OSVersion | fl 

ADModule

Get-ADDomainController [-DomainName <DOMAIN>] [-Discover]

• Get domain policy data

PowerView

Get-DomainController [-Domain <DIFFERENT_DOMAIN>] | select Forest, Name, OSVersion | fl 

Forest

• Return the forest object

PowerView

Get-Forest [-Forest <FOREST>]

ADModule

Get-ADForest [-Identity <FOREST>]

• Get all domains from your current forest

PowerView

Get-ForestDomain [-Forest <FOREST>]

ADModule

Get-ADForest [-Identity <FOREST>] | fl Domains

• Get the Global Catalogs of the forest

PowerView

Get-ForestGlobalCatalog [-Forest <FOREST>]

ADModule

Get-ADForest | select -ExpandProperty GlobalCatalogs

Trust

• Return all domain trusts for the current or specified domain

PowerView

Get-DomainTrust [-Domain <DomainName>]

ADModule

Get-ADTrust {-Filter * | -Identity "<Domain>"}

CMD

nltest /domain_trusts

• Enumerate all trusts for the current domain and then enumerates all trusts for each domain it finds.

PowerView

Get-DomainTrustMapping

• Return all forest trusts for the current forest or a specified forest.

PowerView

Get-ForestTrust [-Forest <"FOREST>"]

ADModule

Get-ADTrust -Filter 'msDS-TrustForestTrustInfo -ne "$null"'

Users

General Information

• Obtain users

PowerView

Get-DomainUser -Identity <USERNAME> [-Properties DisplayName, MemberOf | fl]
Get-DomainUser -UACFilter NOT_ACCOUNTDISABLE | select samaccountname

ADModule

Get-ADUser -Filter * | ?{ $_.Enabled -eq "true" }  Select SamAccountName
# Detailed information about a user
Get-ADUser -Identity <USERNAME> -Properties *

ADSearch

.\ADSearch.exe --search "objectCategory=user"

• Built-in accounts

PowerView

Get-ADUser -Filter 'Description -like "*built*"' -Properties Description | select name, Description

• Get group memberships

PowerView

Get-DomainGroup -UserName "<USERNAME>"

ADModule

Get-ADPrincipalGroupMembership -Identity "<USERNAME>"

• Obtain the Last time a password was set of each user

PowerView

Get-ADUser -Filter * -Properties * | select name ,logoncount ,@{expression={[datetime]::fromFileTime($_pwdlastset)}}

• Finds domain machines where specific users are logged into. By default 'Domain Admins'

PowerView

Find-DomainUserLocation -Verbose [-CheckAccess] [{-UserGroupIdentity|-UserIdentity} <Identity>]

Security

• Kerberoast

PowerView

Get-DomainUser -SPN | select serviceprincipalname

ADModule

Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

ADSearch

.\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" --attributes cn,servicePrincipalName,samAccountName

• AS-Reporoast

PowerView

Get-DomainUser -PreauthNotRequired -Verbose

ADModule

ADSearch

Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True } -Properties DoesNotRequirePreAuth | select UserPrincipalName

• Search passwords on the description attribute

PowerView

Get-ADUser -Filter 'Description -like "*pass*"' -Properties Description | select name, Description

• Show in which machine you are admin (based on your current privileges)

PowerView

Find-LocalAdminAccess

• Constrained delegation

PowerView

Get-NetUser -TrustedToAuth

ADModule

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

ADSearch

 .\ADSearch.exe --search "(&(objectCategory=user)(msds-allowedtodelegateto=*))" --attributes dnshostname,samaccountname,msds-allowedtodelegateto --json

Groups

• List all the groups in the current domain

PowerView

Get-DomainGroup [| where Name -like "*Admins*" | select SamAccountName]

ADModule

Get-ADGroup -Filter * | select name
# More detailed version
Get-ADGroup -Filter * -Properties *

ADSearch

# Admin Groups
.\ADSearch.exe --search "(&(objectCategory=group)(cn=*Admins))" [--attributes cn,member]
# MSSQL Groups
.\ADSearch.exe --search "(&(objectCategory=group)(cn=MS SQL Admins))" --attributes cn,member

• List all the members in a specific group:

PowerView

Get-DomainGroupMember -Identity "Domain Admins" [| select MemberDistinguishedName]	

ADModule

Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select-Object SamAccountName

• List groups of a user

ADModule

Get-ADPrincipalGroupMembership <USER> 

• Get GPOs of a group

ℹ️To obtain GPO name from GPOUid use Get-GPO -Guid "{...}"

PowerView

Get-DomainGPOUserLocalGroupMapping [-Identity "<GROUP_NAME>" | -LocalGroup Administrators] | select ObjectName, GPODisplayName, ContainerName, ComputerName | fl

Computers

General information

• List computers

PowerView

Get-NetComputer [| select samaccountname, DnsHostName, operatingsystem]
Get-DomainComputer -OperatingSystem "*Server 2016*"

# Get Name, IP and Operating System
Get-NetComputer  -Properties name,dnshostname, OperatingSystem | ForEach-Object { $_ | Add-Member -NotePropertyName IPAddressV4 -NotePropertyValue (Resolve-DnsName -Type A -Name $_.dnshostname).IPAddress -Force; $_  } | Select-object -Property name,dnshostname,IPAddressV4, OperatingSystem | Format-Table -AutoSize

ADModule

Get-AdComputer -Filter * | select Name

• Return PCs that can be pinged

PowerView

Get-NetComputer -Ping
Get-ADComputer -Filter * -Properties DNSHostName | %{Test-Connection -Count 1 -ComputerName $_.DNSHostName | fl Address,IPV4Address,IPV6Address,ResponseTime} 

• Get users logged on (Requires admin privileges)

PowerView

Get-NetLoggedon -ComputerName "<COMPUTER_NAME>" | Select Username

• Get locally logged on users

PowerView

Get-LoggedonLocal -ComputerName "<HOSTNAME>"

• Enumerates local or groups on a machine (Requires admin privileges).

PowerView

Get-NetLocalGroup -ComputerName "<HOSTNAME>"
# Get the members of Local Groups
Get-NetLocalGroupMember -ComputerName "<HOSTNAME>" -GroupName "<GROUP_NAME>"

• Returns the last user who logged onto the local machine (Requires administrative rights and remote registry enabled on the target)

PowerView

Get-LastLoggedOn -ComputerName <HOSTNAME>

Security

• Enumerate all ACES for all domain computers that matches our current computer.

Get-DomainComputer | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")) {$_ | Select-object -Property ObjectDN,ActiveDirectoryRights, AceType,ObjectAceType, Identity |  Format-List}}

• Computers with unconstrained delegation: Exploitation at Unconstrained Delegation

PowerView

Get-DomainComputer -UnConstrained | select samaccountname

ADModule

Get-ADComputer -Filter {TrustedForDelegation -eq $true -and primarygroupid -eq 515} -Properties trustedfordelegation,serviceprincipalname,description

ADSearch

.\ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" --attributes samaccountname,dnshostname

• Computers with constrained delegation: Exploitation at Constrained Delegation

PowerView

Get-DomainComputer -TrustedToAuth | select name,msds-allowedtodelegateto,useraccountcontrol | fl

Get-NetComputer | where-object {$_."msds-allowedtodelegateto" -ne $null} | select name, msds-allowedtodelegateto, useraccountcontrol | fl

Get-NetComputer <COMPUTER_NAME> | Select-Object -ExpandProperty msds-allowedtodelegateto | fl

ADModule

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

• Resource-Based Constrained Delegation: Exploitation at Resource-Based Constrained Delegation (GenericWrite to Computer)

Need a privilege like WriteProperty, GenericAll, GenericWrite or WriteDacl on the computer object:

PowerView

Get-DomainComputer | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match "WriteProperty|GenericWrite|GenericAll|WriteDacl" -and $_.SecurityIdentifier -match "S-1-5-21-569305411-121244042-2357301523-[\d]{4,10}" }

ADModule

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

ADSearch

.\ADSearch.exe --search "(&(objectCategory=computer)(msds-allowedtodelegateto=*))" --attributes dnshostname,samaccountname,msds-allowedtodelegateto --json

Group Policies Objects (GPO)s

General information

• Get list of GPO in current domain.

PowerView

Get-DomainGPO [-ComputerIdentity <COMPUTER_NAME>] -Properties DisplayName | sort -Property DisplayName

• Returns all GPOs that modify local group membership through Restricted Groups or Group Policy Preferences:

PowerView

Get-DomainGPOLocalGroup [-ComputerIdentity <COMPUTER_NAME>] | select GPODisplayName, GroupName

• Enumerates the machines where a specific domain user/group is a member of a specific local group (Useful for finding where domain groups have local admin access):

PowerView

Get-DomainGPOUserLocalGroupMapping -LocalGroup Administrators | select ObjectName, GPODisplayName, ContainerName, ComputerName | fl

• Finds what users/groups are in the specified local group for a target machine through GPO correlation

PowerView

Get-DomainGPOComputerLocalGroupMapping -ComputerIdentity "<HOSTNAME>"

Get Modifiable GPOs

PowerView

Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match "CreateChild|WriteProperty|GenericWrite" -and $_.SecurityIdentifier -match "S-1-5-21-569305411-121244042-2357301523-[\d]{4,10}" }

Principals with "Create groupPolicyContainer objects" privilege

PowerView

Get-DomainObjectAcl -Identity "CN=Policies,CN=System,DC=dev,DC=cyberbotic,DC=io" -ResolveGUIDs | ? { $_.ObjectAceType -eq "Group-Policy-Container" -and $_.ActiveDirectoryRights -contains "CreateChild" } | % { ConvertFrom-SID $_.SecurityIdentifier }

Organizational Units (OU)

• Get Domain Organizational Units:

PowerView

Get-DomainOU [-Properties Name | sort -Property Name]

ADModule

Get-ADOrganizationalUnit -Filter * -Properties *

• Get GPO applied to an OU

PowerView

Get-DomainGPO -Identity "<GPLink_RelativeCN>"

Access Control Lists (ACL)s

• Enumerate user rights:

PowerView

Get-ObjectAcl -SamAccountName "<USER>" -ResolveGUIDs 

• Returns the ACLs associated with a specific active directory object.

PowerView

Get-DomainObjectAcl -ResolveGUIDs -SamAccountName "<USERNAME>"

ADModule

(Get-Acl 'AD:\CN=Administrator,CN=Users,DC=cs,DC=org').Access

• Finds interesting object ACLS in the current domain

PowerView

Find-InterestingDomainAcl -ResolveGUIDs

• Enumerate RDP Users permissions

PowerView

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -match "RDPUsers"}

Shares

• Enumerate shares:

PowerView

Find-DomainShare
# Enumerate the Domain Shares the current user has access
Find-DomainShare -CheckShareAccess

• Enumerates the shares you have access

PowerView

Find-DomainShare -CheckShareAccess

• Find shares on hosts in current domain.

PowerView

Invoke-ShareFinder -Verbose

• Get all fileservers of the domain

PowerView

Get-NetFileServer

• Searches for files matching specific criteria on readable shares in the domain

PowerView

Invoke-FileFinder -Verbose

MSSQL

General information

• Discover Active Directory Domain SQL Server Instances

PowerUpSQL

Get-SQLInstanceDomain

• Tests if the current Windows account or provided SQL Server login can log into an SQL Server.

PowerUpSQL

Get-SQLConnectionTest -Instance "<HOSTNAME,PORT>" | fl
# If there are several instances use the following oneline
Get-SQLInstanceDomain | Get-SQLConnectionTest | ? { $_.Status -eq "Accessible" } | Get-SQLServerInfo

• Returns basic server and user information from target SQL Servers.

PowerUpSQL

Get-SQLServerInfo -Instance "<HOSTNAME,PORT>"

Links

• Look for links to remote servers

PowerUpSQL

Get-SQLServerLink -Verbose -Instance "<HOSTNAME,PORT>" 

MSSQL

select * from master..sysservers

• Enumerate and follow MSSQL database links

PowerUpSQL

Get-SQLServerLinkCrawl -Verbose -Instance "<HOSTNAME,PORT>" 

Perform Queries

• Perform queries

PowerUpSQL

Get-SQLQuery -Instance "<HOSTNAME,PORT>" -Query "select @@servername"

• Perform queries using the linked database

MSSQL

SELECT * FROM OPENQUERY("sql-1.cyberbotic.io", 'select @@servername');

CMDShell

• Check if xp_cmdshell module is enabled

MSSQL

SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'

• Enable xp_cmdshell

MSSQL

sp_configure 'Show Advanced Options', 1; RECONFIGURE;sp_configure 'xp_cmdshell', 1; RECONFIGURE;

• Execute commands

MSSQL

"EXEC xp_cmdshell 'powershell -w hidden -enc <ENCODED_COMMAND>';

Tools

• LinWinPwn: Automates a number of Active Directory Enumeration and Vulnerability checks.

• PowerView: PowerShell tool to gain network situational awareness on Windows domains.

• ADSearch: Perform LDAP queries.

• PowerUPSQL: Module that includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post-exploitation actions such as OS command execution.

• ADModule: The Active Directory module for Windows PowerShell.

References

• AD Enumeration Toolkit

• Bloodhound docs

• PowerView (HackTricks)

• Red Team Ops