# Module 13: Active Directory Enumeration

## Abusing Lightweight Directory Access Protocol

### Understanding LDAP

LDAP was designed to interact with a directory service, such as Active Directory. It is built upon the *client-server model*.

LDAP clients send requests called *operations* to an LDAP server. These are used to authenticated clients or retrieve/modify entries within a directory.

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FMreY1AeVHpcX9PEiHKzU%2Fimage.png?alt=media&#x26;token=f87f9cd8-a202-4314-96ed-5ab9b694f017" alt=""><figcaption><p>Simple LDAP client-server model</p></figcaption></figure>

### Interacting with LDAP

LDAP is inter-operable with custom applications, which is largely possible due to the inclusion of *Active Directory Service Interfaces* (ADSI).

*PowerShell script to perform LDAP lookup*

{% code overflow="wrap" %}

```powershell
PS C:\Users\offsec> $Searcher = New-Object System.DirectoryServices.DirectorySearcher

PS C:\Users\offsec> $Searcher.Filter = '(distinguishedName=CN=DC-2,OU=Domain Controllers,DC=corp,DC=com)'

PS C:\Users\offsec> $Searcher.FindOne()
```

{% endcode %}

{% hint style="info" %}
By default, *DirectorySearcher* instantiates an object with the Filter property to the value of *(objectClass=\*)*, which is an LDAP query returning every entry within a directory service.
{% endhint %}

*PowerShell script to execute LDAP as a different user*

{% code overflow="wrap" %}

```powershell
PS C:\Users\offsec> $Searcher = New-Object System.DirectoryServices.DirectorySearcher

PS C:\Users\offsec> $Searcher.SearchRoot = New-Object System.DirectoryServices.DirectoryEntry("LDAP://DC=corp,DC=com", 'corp\jdoe','Qwerty09!')

PS C:\Users\offsec> $Searcher.Filter = '(&(objectClass=computer)(cn=*dc*))'

PS C:\Users\offsec> $Searcher.FindAll()

Path                                                Properties
----                                                ----------
LDAP://CN=DC01,OU=Domain Controllers,DC=corp,DC=com {ridsetreferences, logoncount, codepage, ob...
LDAP://CN=DC-2,OU=Domain Controllers,DC=corp,DC=com {logoncount, codepage, objectcategory, iscr...
```

{% endcode %}

### Enumerating Active Directory with PowerView

PowerView contains dozens of functions that can be used to enumerate Active Directory. They incorporate OS APIs.

## Detecting Active Directory Enumeration

### Auditing Object Access

To identify malicious enumeration events taking place against AD, we need to implement an *audit policy*. These are extensions of the built-in Windows logging.

We can display and configure audit policies with the *auditpol* command line utility.&#x20;

*Listing audit policy categories*

```powershell
PS C:\Windows\system32> auditpol /list /category
Category/Subcategory
Account Logon
Account Management
Detailed Tracking
DS Access
Logon/Logoff
Object Access
Policy Change
Privilege Use
System
```

*Listing audit policy subcategories*

```powershell
and PS C:\Windows\system32> auditpol /list /subcategory:*
Category/Subcategory
...
DS Access
  Directory Service Access
  Directory Service Changes
  Directory Service Replication
  Detailed Directory Service Replication
...
```

*Listing audit policy subcategory setting*

```powershell
PS C:\Windows\system32> auditpol /get /subcategory:"Directory Service Access"
System audit policy
Category/Subcategory                      Setting
DS Access
  Directory Service Access                Success
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F1dFNZsIjQxjLts0pjCti%2F0695db4c9b450dce9838cee309c47975-properties.png?alt=media&#x26;token=f697693f-6fd6-4993-969d-487dea208edd" alt=""><figcaption><p>DC-2 Options</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F3wyEmeAZYgMHB0vkd9Ka%2F0bd02608d18ac2f74db4bfd37fa6a53b-adv_prop.png?alt=media&#x26;token=6fbec522-f967-4b9a-a1fd-703ac0a5d091" alt=""><figcaption><p>DC-2 Properties</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FUBn0sWLTDMzqupvvkENE%2F78abb1c1852467faa7d408030468d339-dc02.png?alt=media&#x26;token=e6fb7913-bbaa-40b9-8af0-288dff19da32" alt=""><figcaption><p>Auditing permissions on DC-2</p></figcaption></figure>

*Object audit security elements*

| Element        | Description                                                                                                                             |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Principal      | The identity that is being targeted for auditing                                                                                        |
| Type           | Target success, failure, or both types of events                                                                                        |
| Access         | Types of permissions that can be granted (and tracked)                                                                                  |
| Inherited From | Designates whether an audit entry was configured at a higher level than the target object, which would recurse down to any sub entries. |
| Applies To     | Designates whether the entry is targeting only the current object, descendant objects, or specific object types                         |

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FWNLT0NY7mTpfkSDJhZYY%2Fb36219cea164e73bdf5e9e8733e3db40-audit5.png?alt=media&#x26;token=d8d699c7-9011-42f7-b03a-6d6799bfa24e" alt=""><figcaption><p>Object Access event</p></figcaption></figure>

*Key information*

* Subject: Details about the Account that accessed the object.
* Object: Details about the object accessed.
* Operation: Details about the action taken place.

### Baseline Monitoring

Utilize *XPath* filters to select specific nodes from an XML document. When using the "Filter Current Log" option in Event Viewer, we are essentially building an XPath query that is parsed by the logging engine to provide the requested data.

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FgoTLnA1WndnZflYQoGcb%2F4842d77ead5957285f7c6343b258506c-base2.png?alt=media&#x26;token=a47a19a7-14cb-43e7-baec-a6a9e3fb5a79" alt=""><figcaption><p>Event log filter through GUI</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fyd5yipXxBeDOxxcczKb0%2Fb2bb66dda7a926a15f1e5965741513f0-base3.png?alt=media&#x26;token=ce037606-36a7-4718-b581-f845fbd10703" alt=""><figcaption><p>Event log filter in XPath form</p></figcaption></figure>

*XPath query for expected access*

{% code overflow="wrap" %}

```powershell
$FilterXML = @'
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[(EventID=4662)]] and *[EventData[(Data[@Name='SubjectUserSid']='S-1-5-21-2154860315-1826001137-329834519-1107')]] and *[EventData[(Data[@Name='ObjectName']='%{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51}')]] and *[EventData[(Data[@Name='OperationType']='Object Access')]]
   </Select>
  </Query>
</QueryList>
'@
```

{% endcode %}

*Running Get-WinEvent with created XPath*

{% code overflow="wrap" %}

```powershell
PS C:\Windows\system32> Get-WinEvent -FilterXml $FilterXML
   ProviderName: Microsoft-Windows-Security-Auditing
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
1/19/2022 11:24:04 AM   4662 Information   An operation was performed on an object....
1/19/2022 11:24:04 AM   4662 Information   An operation was performed on an object....
1/19/2022 11:24:04 AM   4662 Information   An operation was performed on an object....
...
```

{% endcode %}

*Get-WinEvent script with XML parsing*

{% code overflow="wrap" %}

```powershell
$Logs = Get-WinEvent -LogName Security -FilterXPath $FilterXML
ForEach ($L in $Logs) {
   [xml]$XML = $L.toXml()
   $TimeStamp = $XML.Event.System.TimeCreated.SystemTime
   $SubjectUserName = $XML.Event.EventData.Data[1].'#text'
   $ObjectName = $XML.Event.EventData.Data[6].'#text'
   $AccessMask = $XML.Event.EventData.Data[10].'#text'
   [PSCustomObject]@{'TimeStamp' = $TimeStamp; 'SubjectUserName' = $SubjectUserName; 'ObjectName' = $ObjectName; 'AccessMask' = $AccessMask }
}
```

{% endcode %}

*Results from updated Get-WinEvent script*

{% code overflow="wrap" %}

```powershell
PS C:\Windows\system32> C:\Users\offsec\Desktop\Audit.ps1

TimeStamp SubjectUserName ObjectName AccessMask
--------- --------------- ---------- ----------
2022-01-19T16:24:04.312607600Z offsec   %{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51} 0x10      
2022-01-19T16:24:04.312154600Z offsec   %{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51} 0x10      
2022-01-19T16:24:04.048692000Z offsec   %{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51} 0x10      
2022-01-19T16:24:04.048326000Z offsec   %{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51} 0x10      
...  
```

{% endcode %}

{% hint style="info" %}
We could perform LDAP lookups to dynamically retrieve the friendly name of the Access Mask, however this would generate access alerts.
{% endhint %}

*XPath filter to suppress displaying events where the SID matches offsec's SID*

{% code overflow="wrap" %}

```xml
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
     *[System[(EventID=4662)]] and 
     *[EventData[(Data[@Name='ObjectName']='%{0ca1d341-b9ee-4d46-ab3b-3a2732aa4b51}')]] and
     *[EventData[(Data[@Name='OperationType']='Object Access')]]
     </Select>
   <Suppress Path="Security">
    *[EventData[(Data[@Name='SubjectUserSid']='S-1-5-21-2154860315-1826001137-329834519-1107')]]
   </Suppress>
  </Query>
</QueryList>
```

{% endcode %}

### Using Honey Tokens

The difference between a honey token and a general honeypot is that a honey token is a collection of different types of objects created throughout the directory. Any traffic destined to these lures should be considered suspect.
