search

Credentialed Enumeration

circle-info

Since we have a general idea about the domain's userbase and machines, it's time to enumerate the domain in depth. We are interested in information about domain user and computer attributes, group membership, Group Policy Objects, permissions, ACLs, trusts, and more.

Most important thing to remember is that most of these tools will not work without valid domain user credentials at any permission level. So at a minimum, we will have to have acquired a user's cleartext password, NTLM password hash, or SYSTEM access on a domain-joined host.

hashtag
Linux

hashtag
CrackMapExec

It utilizes packages from the Impacket and PowerSploit toolkits to perform its functions.

hashtag
Domain User Enumeration

$ sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --users

SMB         172.16.5.5      445    ACADEMY-EA-DC01  [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         172.16.5.5      445    ACADEMY-EA-DC01  [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 
SMB         172.16.5.5      445    ACADEMY-EA-DC01  [+] Enumerated domain user(s)
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\administrator                  badpwdcount: 0 baddpwdtime: 2022-03-29 12:29:14.476567
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\guest                          badpwdcount: 0 baddpwdtime: 1600-12-31 19:03:58
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\lab_adm                        badpwdcount: 0 baddpwdtime: 2022-04-09 23:04:58.611828
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\krbtgt                         badpwdcount: 0 baddpwdtime: 1600-12-31 19:03:58
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\htb-student                    badpwdcount: 0 baddpwdtime: 2022-03-30 16:27:41.960920
SMB         172.16.5.5      445    ACADEMY-EA-DC01  INLANEFREIGHT.LOCAL\avazquez                       badpwdcount: 3 baddpwdtime: 2022-02-24 18:10:01.903395

<SNIP>

hashtag
Domain Group Enumeration

Take note of key groups like Administrators, Domain Admins, Executives, any groups that may contain privileged IT admins, etc. These groups will likely contain users with elevated privileges worth targeting during our assessment.

hashtag
Logged on Users

hashtag
Share Searching

  • Share Enumeration - Domain Controller

  • We see several shares available to us with READ access. The Department Shares, User Shares, and ZZZ_archive shares would be worth digging into further as they may contain sensitive data such as passwords or PII

  • spider_plus to will dig through each readable share on the host and list all readable files.

hashtag
SMBMap

SMBMap is great for enumerating SMB shares from a Linux attack host. It can be used to gather a listing of shares, permissions, and share contents if accessible. Once access is obtained, it can be used to download and upload files and execute remote commands.

hashtag
SMBMap To Check Access

hashtag
Recursive List Of All Directories

hashtag
RPCClient

  • RID (Relative Identifier):

    • In rpcclient, users are associated with a field called "rid," which stands for Relative Identifier.

    • RID is a unique hexadecimal identifier used by Windows to track and identify objects.

  • SID (Security Identifier):

    • A SID represents a security identifier in Windows and has a format like S-1-5-21-3842939050-3880317879-2865463114.

    • When an object is created within a domain, this SID is combined with a RID to create a unique value for the object.

  • Example with a User:

    • For example, the domain user "htb-student" with a RID of [0x457] (Hex) or 1111 (decimal) will have a full user SID of S-1-5-21-3842939050-3880317879-2865463114-1111.

    • This unique SID identifies the "htb-student" object in the "INLANEFREIGHT.LOCAL" domain, ensuring no other object in this domain or any other will have the same paired value.

  • Built-In Administrator Account:

    • Certain accounts, like the built-in Administrator for a domain, have the same RID regardless of the host.

    • For instance, the built-in Administrator account may have a RID [administrator] rid:[0x1f4] (Hex), which equals 500 in decimal.

    • This value (RID 500) is consistently associated with the built-in Administrator account and can be used to gather more information about it within the domain.

  • Enumeration with rpcclient:

    • You can utilize rpcclient to explore and enumerate information about objects in the domain, like the "htb-student" user or the built-in Administrator account.

hashtag
RPCClient User Enumeration By RID

hashtag
Enumdomusers

hashtag
Impacket Toolkit

Impacket is a versatile toolkit that provides us with many different ways to enumerate, interact, and exploit Windows protocols and find the information we need

hashtag
psexec.py

To connect to a host with psexec.py, we need credentials for a user with local administrator privileges.

hashtag
wmiexec.py

This is a more stealthy approach to execution on hosts than other tools, but would still likely be caught by most modern anti-virus and EDR systems.

hashtag
Windapsearch

Windapsearcharrow-up-right is another handy Python script we can use to enumerate users, groups, and computers from a Windows domain by utilizing LDAP queries.

hashtag
Windapsearch - Domain Admins

hashtag
Windapsearch - Privileged Users

hashtag
Bloodhound.py

hashtag
Executing BloodHound.py

hashtag
Viewing the Results

  1. Results are saved here

  2. Zip the files

  3. Start neo4j

  4. Start bloodhound

  5. Upload the zip file

  6. Now that the data is loaded, we can use the Analysis tab to run queries against the database. These queries can be custom and specific to what you decide using custom Cypher queriesarrow-up-right. We can use the built-in Path Finding queries on the Analysis tab on the Left side of the window.

  7. The query chosen to produce the map above was Find Shortest Paths To Domain Admins. It will give us any logical paths it finds through users/groups/hosts/ACLs/GPOs, etc., relationships that will likely allow us to escalate to Domain Administrator privileges or equivalent.

hashtag
Windows

hashtag
Active Directory Powershell Module

hashtag
Discover Modules

hashtag
Load Modules

hashtag
Get Domain Info

hashtag
Get-ADUser

hashtag
Checking For Trust Relationships

hashtag
Group Enumeration

hashtag
Detailed Group Info

hashtag
Group Membership

hashtag
PowerView

Command

Description

Export-PowerViewCSV

Append results to a CSV file

ConvertTo-SID

Convert a User or group name to its SID value

Get-DomainSPNTicket

Requests the Kerberos ticket for a specified Service Principal Name (SPN) account

Domain/LDAP Functions:

Get-Domain

Will return the AD object for the current (or specified) domain

Get-DomainController

Return a list of the Domain Controllers for the specified domain

Get-DomainUser

Will return all users or specific user objects in AD

Get-DomainComputer

Will return all computers or specific computer objects in AD

Get-DomainGroup

Will return all groups or specific group objects in AD

Get-DomainOU

Search for all or specific OU objects in AD

Find-InterestingDomainAcl

Finds object ACLs in the domain with modification rights set to non-built in objects

Get-DomainGroupMember

Will return the members of a specific domain group

Get-DomainFileServer

Returns a list of servers likely functioning as file servers

Get-DomainDFSShare

Returns a list of all distributed file systems for the current (or specified) domain

GPO Functions:

Get-DomainGPO

Will return all GPOs or specific GPO objects in AD

Get-DomainPolicy

Returns the default domain policy or the domain controller policy for the current domain

Computer Enumeration Functions:

Get-NetLocalGroup

Enumerates local groups on the local or a remote machine

Get-NetLocalGroupMember

Enumerates members of a specific local group

Get-NetShare

Returns open shares on the local (or a remote) machine

Get-NetSession

Will return session information for the local (or a remote) machine

Test-AdminAccess

Tests if the current user has administrative access to the local (or a remote) machine

Threaded 'Meta'-Functions:

Find-DomainUserLocation

Finds machines where specific users are logged in

Find-DomainShare

Finds reachable shares on domain machines

Find-InterestingDomainShareFile

Searches for files matching specific criteria on readable shares in the domain

Find-LocalAdminAccess

Find machines on the local domain where the current user has local administrator access

Domain Trust Functions:

Get-DomainTrust

Returns domain trusts for the current domain or a specified domain

Get-ForestTrust

Returns all forest trusts for the current forest or a specified forest

Get-DomainForeignUser

Enumerates users who are in groups outside of the user's domain

Get-DomainForeignGroupMember

Enumerates groups with users outside of the group's domain and returns each foreign member

Get-DomainTrustMapping

Will enumerate all trusts for the current domain and any others seen.

hashtag
Domain User Information

hashtag
Recursive Group Membership

hashtag
Trust Enumeration

hashtag
Testing for Local Admin Access

hashtag
Finding Users With SPN Set

This will help us find kerberoastable accounts

hashtag
SharpView

Here we can use SharpView to enumerate information about a specific user, such as the user forend, which we control.

hashtag
Snaffler

Snafflerarrow-up-right is a tool that can help us acquire credentials or other sensitive data in an Active Directory environment. Snaffler works by obtaining a list of hosts within the domain and then enumerating those hosts for shares and readable directories. Once that is done, it iterates through any directories readable by our user and hunts for files that could serve to better our position within the assessment. Snaffler requires that it be run from a domain-joined host or in a domain-user context.

hashtag
Bloodhound

hashtag
SharpHound in Action

hashtag
Unsupported Operating Systems

hashtag
Local Admins

PreviousSecurity ControlsNextLiving Off the Land Techniques

Last updated