PenTest – Active Directory – Enumeration
Using BloodHound
Use the correct collector * AzureHound for Azure Active Directory * SharpHound for local Active Directory * RustHound for local Active Directory
- use BloodHoundAD/AzureHound (more info: Cloud – Azure Pentest)
- use BloodHoundAD/BloodHound
# run the collector on the machine using SharpHound.exe # https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.exe # /usr/lib/bloodhound/resources/app/Collectors/SharpHound.exe .\SharpHound.exe -c all -d active.htb --searchforest .\SharpHound.exe -c all,GPOLocalGroup # all collection doesn't include GPOLocalGroup by default .\SharpHound.exe --CollectionMethod DCOnly # only collect from the DC, doesn't query the computers (more stealthy) .\SharpHound.exe -c all --LdapUsername <UserName> --LdapPassword <Password> --JSONFolder <PathToFile> .\SharpHound.exe -c all --LdapUsername <UserName> --LdapPassword <Password> --domaincontroller 10.10.10.100 -d active.htb .\SharpHound.exe -c all,GPOLocalGroup --outputdirectory C:\Windows\Temp --randomizefilenames --prettyjson --nosavecache --encryptzip --collectallproperties --throttle 10000 --jitter 23 # or run the collector on the machine using Powershell # https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/SharpHound.ps1 # /usr/lib/bloodhound/resources/app/Collectors/SharpHound.ps1 Invoke-BloodHound -SearchForest -CSVFolder C:\Users\Public Invoke-BloodHound -CollectionMethod All -LDAPUser <UserName> -LDAPPass <Password> -OutputDirectory <PathToFile> # or remotely via BloodHound Python # https://github.com/fox-it/BloodHound.py pip install bloodhound bloodhound-python -d lab.local -u rsmith -p Winter2017 -gc LAB2008DC01.lab.local -c all # or locally/remotely from an ADExplorer snapshot from SysInternals (ADExplorer remains a legitimate binary signed by Microsoft, avoiding detection with security solutions) # https://github.com/c3c/ADExplorerSnapshot.py pip3 install --user . ADExplorerSnapshot.py <snapshot path> -o <*.json output folder path> - Collect more data for certificates exploitation using Certipy
- use OPENCYBER-FR/RustHound
# Windows with GSSAPI session rusthound.exe -d domain.local --ldapfqdn domain # Windows/Linux simple bind connection username:password rusthound.exe -d domain.local -u user@domain.local -p Password123 -o output -z # Linux with username:password and ADCS module for @ly4k BloodHound version rusthound -d domain.local -u 'user@domain.local' -p 'Password123' -o /tmp/adcs --adcs -z
Then import the zip/json files into the Neo4J database and query them.
root@payload$ apt install bloodhound
# start BloodHound and the database
root@payload$ neo4j console
# or use docker
root@payload$ docker run -itd -p 7687:7687 -p 7474:7474 --env NEO4J_AUTH=neo4j/bloodhound -v $(pwd)/neo4j:/data neo4j:4.4-community
root@payload$ ./bloodhound --no-sandbox
Go to http://127.0.0.1:7474, use db:bolt://localhost:7687, user:neo4J, pass:neo4j
NOTE: Currently BloodHound Community Edition is still a work in progress, it is highly recommended to stay on the original BloodHoundAD/BloodHound version.
git clone https://github.com/SpecterOps/BloodHound
cd examples/docker-compose/
cat docker-compose.yml | docker compose -f - up
# UI: http://localhost:8080/ui/login
# Username: admin
# Password: see your Docker logs
You can add some custom queries like : * Bloodhound-Custom-Queries from @hausec * BloodHoundQueries from CompassSecurity * BloodHound Custom Queries from Exegol – @ShutdownRepo * Certipy BloodHound Custom Queries from ly4k
Replace the customqueries.json file located at /home/username/.config/bloodhound/customqueries.json or C:\Users\USERNAME\AppData\Roaming\BloodHound\customqueries.json.
Using PowerView
- Get Current Domain:
Get-NetDomain - Enum Other Domains:
Get-NetDomain -Domain <DomainName> - Get Domain SID:
Get-DomainSID - Get Domain Policy:
- Get Domain Controlers:
- Enumerate Domain Users:
Get-NetUser Get-NetUser -SamAccountName <user> Get-NetUser | select cn Get-UserProperty #Check last password change Get-UserProperty -Properties pwdlastset #Get a specific "string" on a user's attribute Find-UserField -SearchField Description -SearchTerm "wtver" #Enumerate user logged on a machine Get-NetLoggedon -ComputerName <ComputerName> #Enumerate Session Information for a machine Get-NetSession -ComputerName <ComputerName> #Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain <DomainName> | Select-Object UserName, SessionFromName - Enum Domain Computers:
- Enum Groups and Group Members:
Get-NetGroupMember -GroupName "<GroupName>" -Domain <DomainName> #Enumerate the members of a specified group of the domain Get-DomainGroup -Identity <GroupName> | Select-Object -ExpandProperty Member #Returns all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName - Enumerate Shares
- Enum Group Policies:
- Enum OUs:
- Enum ACLs:
# Returns the ACLs associated with the specified account Get-ObjectAcl -SamAccountName <AccountName> -ResolveGUIDs Get-ObjectAcl -ADSprefix 'CN=Administrator, CN=Users' -Verbose #Search for interesting ACEs Invoke-ACLScanner -ResolveGUIDs #Check the ACLs associated with a specified path (e.g smb share) Get-PathAcl -Path "\\Path\Of\A\Share" - Enum Domain Trust:
- Enum Forest Trust:
- User Hunting:
#Finds all machines on the current domain where the current user has local admin access Find-LocalAdminAccess -Verbose #Find local admins on all machines of the domain: Invoke-EnumerateLocalAdmin -Verbose #Find computers were a Domain Admin OR a specified user has a session Invoke-UserHunter Invoke-UserHunter -GroupName "RDPUsers" Invoke-UserHunter -Stealth #Confirming admin access: Invoke-UserHunter -CheckAccess
Using AD Module
- Get Current Domain:
Get-ADDomain - Enum Other Domains:
Get-ADDomain -Identity <Domain> - Get Domain SID:
Get-DomainSID - Get Domain Controlers:
- Enumerate Domain Users:
- Enum Domain Computers:
- Enum Domain Trust:
- Enum Forest Trust:
- Enum Local AppLocker Effective Policy:
User Hunting
Sometimes you need to find a machine where a specific user is logged in.
You can remotely query every machines on the network to get a list of the users’s sessions.
- CrackMapExec
- Impacket Smbclient
- PowerView Invoke-UserHunter
Other Interesting Commands
- Find Domain Controllers
References
- Explain like I’m 5: Kerberos – Apr 2, 2013 – @roguelynn
- Pen Testing Active Directory Environments – Part I: Introduction to crackmapexec (and PowerView)
- Pen Testing Active Directory Environments – Part II: Getting Stuff Done With PowerView
- Pen Testing Active Directory Environments – Part III: Chasing Power Users
- Pen Testing Active Directory Environments – Part IV: Graph Fun
- Pen Testing Active Directory Environments – Part V: Admins and Graphs
- Pen Testing Active Directory Environments – Part VI: The Final Case
- Attacking Active Directory: 0 to 0.9 – Eloy Pérez González – 2021/05/29
- Fun with LDAP, Kerberos (and MSRPC) in AD Environments
- Penetration Testing Active Directory, Part I – March 5, 2019 – Hausec
- Penetration Testing Active Directory, Part II – March 12, 2019 – Hausec
- Using bloodhound to map the user network – Hausec
- PowerView 3.0 Tricks – HarmJ0y
Related Posts
About The Author
