Module 21: Active Directory Introduction and Enumeration
Active Directory - Introduction
Enumeration - Defining our Goals
Context for following sections.
Active Directory - Manual Enumeration
Active Directory - Enumeration Using Legacy Windows Tools
Some low-hanging fruit in terms of enumeration:
Enumerating Active Directory using PowerShell and .NET Classes
LDAP path format:
It's best to find the Primary Domain Controller -- the DC holding the most updated information. Only one of these can exist in a domain. To find this, we must find the DC holdin the PdcRoleOwner property.
An example DistinguishedName:
The newly introduced CN is the Common Name which specifies the identifier of an object in the domain. DC in this context (when referring to a Distinguished Name) means Domain Component.
When reading these kinds of entries, you start from the right: DC=corp,DC=com refers to the top of an LDAP tree. It is the Distinguished Named of the domain itself.
Next, is CN=Users which is the Common Name of the container where the user object is stored. i.e. parent container. Lastly is CN=Stephanie which is the Common Name for the object itself.
Invoking the Domain Class and the GetCurrentDomain method:
To automate our script to find the PDC, we'll begin the script as so:
Because $domainObj will contain all the information, we'll single out the PdcRoleOwner:
Now we want to grab the DN:
Finally, let's build the LDAP path:
Adding Search Functionality to our Script
Using the DirectoryEntry and DirectorySearcher classes to build in a search to the script:
Enumerating all users via the samAccountType 0x30000000 (decimal 805306368):
Iterating through each found user, displaying their attributes:
Turning the functionality of our script into a function:
Examples calling the newly revised script:
AD Enumeration with PowerView
PowerView is a powerful PowerShell script with many functions to improve the effectiveness of our enumeration.
Manual Enumeration - Expanding our Repertoire
Enumerating Operating Systems
Still using PowerView to enumerate:
Getting an Overview - Permissions and Logged on Users
PowerView's Find-LocalAdminAccess scans the network in an attempt to determine if our current user has administrative permissions on any computers in the domain. This command relies on the OpenServiceW function which connects to the Service Control Manager (SCM) on the target machines. SCM essentially maintains a database of installed services/drivers on Windows computers. PowerView will attempt to open this database with the SC_MANAGER_ALL_ACCESS access right, which requires administrative privileges.
Gathering currently logged on users of remote machines:
Enumeration Through Service Principal Names
Enumerating SPNs in a domain:
Enumerating Object Permissions
Querying ACEs with PowerView:
Converting SIDs to names via PowerView:
We're primarily interested in the ActiveDirectoryRights and SecurityIdentifier for each object enumerated. The highest permission we can have on an object is GenericAll.
Filtering for the ActiveDirectoryRights property of the Management Department group, only displaying objects that have GenericAll permission on it.
Enumerating Domain Shares
Enumeration with PowerView:
Start by enumerating sysvol shares as it may include files/folders that reside on the DC itself. This share is typically used for various domain policies and scripts. By default this share is mapped to %SystemRoot%\SYSVOL\Sysvol\<domain-name>. Historically, sysadmins would change local workstation passwords through Group Policy Preferences (GPP). These GPP-stored passwords are encrypted with AES-256, but the private key has been posted on MSDN. This key can thus be used to decrypt the encrypted passwords found.
Active Directory - Automated Enumeration
Collecting Data with SharpHound
SharpHound is the companion data collection tool to BloodHound. It is written in C# and uses Windows API functions and LDAP namespace functions. It is available to us in a few different formats: compiling it ourselves, using an already compiled binary, or use it as a PowerShell script.
Using SharpHound as a PowerShell script:
Using the -CollectionMethod to gather All data. This will perform all collection methods except local group policies. By default, SharpHound will gather the data in JSON files and automatically zip them up for us as well:
The bin cache file is used to speed up data collection. It is not needed for our analysis and can safely be deleted.
Analysing Data using BloodHound
To use BloodHound, we need to start the Neo4j service which is installed by default on Kali. Neo4j is essentially an open source graph database (NoSQL) that creates nodes, edges, and properties instead of simple rows & columns. This facilitates the visual representation of our collected data.
Log in to the web console with neo4j as both the username and password. After updating the password, we can use Bloodhound!
We're then presented with an authentication window asking us to log in to the Neo4j Database:
Once the .zip from SharpHound is transferred to Kali, we can then use the Upload Data function on the right side of the GUI to upload it. Once finished, we can analyze the data. Selecting the Hamburger menu at the top-left, we can view the Database Info. We're primarily interested in the Analysis button. A nice setting change can be to update the Node Label Display to Always Display.
A very useful feature is utilizing the Shortest Paths to Domain Admins from Owned Principals as it lets us simulate a "what if" scenario regarding accounts, etc. that we own and what we could then do with them. We must manually mark objects as Owned if we have full access to them to assist BloodHound in determine shortest paths, etc.
Last updated