> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/credentialed-enumeration.md). # Credentialed Enumeration Khi đã có foothold ở domain chúng ta cần tìm hiểu sâu hơn bằng cách sử dụng credentinal của user low privilege. ## CrackMapExec Chúng ta có thể dùng [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) với credentinals MSSQL, SMB, SSH và WinRM. #### 1. CME - Domain User Enumeration Khi đã có một credential trong domain, ta có thể truy xuất được toàn bộ user trong domain (bao gồm cả [badPwdCount](https://docs.microsoft.com/en-us/windows/win32/adschema/a-badpwdcount)). ```bash nduc193@htb[/htb]$ sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --users SMB 172.16.5.5 445 ACADEMY-EA-DC01 [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False) SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] Enumerated domain user(s) SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\administrator badpwdcount: 0 baddpwdtime: 2022-03-29 12:29:14.476567 SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\guest badpwdcount: 0 baddpwdtime: 1600-12-31 19:03:58 SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\lab_adm badpwdcount: 0 baddpwdtime: 2022-04-09 23:04:58.611828 SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\krbtgt badpwdcount: 0 baddpwdtime: 1600-12-31 19:03:58 SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\htb-student badpwdcount: 0 baddpwdtime: 2022-03-30 16:27:41.960920 SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\avazquez badpwdcount: 3 baddpwdtime: 2022-02-24 18:10:01.903395 ``` #### 2. CME - Domain Group Enumeration 
nduc193@htb[/htb]$ sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --groups
SMB         172.16.5.5      445    ACADEMY-EA-DC01  [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         172.16.5.5      445    ACADEMY-EA-DC01  [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 
SMB         172.16.5.5      445    ACADEMY-EA-DC01  [+] Enumerated domain group(s)
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Administrators                           membercount: 3
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Users                                    membercount: 4
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Backup Operators                         membercount: 1
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Replicator                               membercount: 0
<SNIP>
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Domain Admins                            membercount: 19
SMB         172.16.5.5      445    ACADEMY-EA-DC01  Domain Users                             membercount: 0
<SNIP>
...
#### 3. CME - Logged On Users ```bash nduc193@htb[/htb]$ sudo crackmapexec smb 172.16.5.130 -u forend -p Klmcargo2 --loggedon-users SMB 172.16.5.130 445 ACADEMY-EA-FILE [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-FILE) (domain:INLANEFREIGHT.LOCAL) (signing:False) (SMBv1:False) SMB 172.16.5.130 445 ACADEMY-EA-FILE [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 (Pwn3d!) SMB 172.16.5.130 445 ACADEMY-EA-FILE [+] Enumerated loggedon users SMB 172.16.5.130 445 ACADEMY-EA-FILE INLANEFREIGHT\clusteragent logon_server: ACADEMY-EA-DC01 SMB 172.16.5.130 445 ACADEMY-EA-FILE INLANEFREIGHT\lab_adm logon_server: ACADEMY-EA-DC01 SMB 172.16.5.130 445 ACADEMY-EA-FILE INLANEFREIGHT\svc_qualys logon_server: ACADEMY-EA-DC01 SMB 172.16.5.130 445 ACADEMY-EA-FILE INLANEFREIGHT\wley logon_server: ACADEMY-EA-DC01 ``` #### 4. **CME Share Searching** ```bash nduc193@htb[/htb]$ sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 --shares SMB 172.16.5.5 445 ACADEMY-EA-DC01 [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False) SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] Enumerated shares SMB 172.16.5.5 445 ACADEMY-EA-DC01 Share Permissions Remark SMB 172.16.5.5 445 ACADEMY-EA-DC01 ----- ----------- ------ SMB 172.16.5.5 445 ACADEMY-EA-DC01 ADMIN$ Remote Admin SMB 172.16.5.5 445 ACADEMY-EA-DC01 C$ Default share SMB 172.16.5.5 445 ACADEMY-EA-DC01 Department Shares READ SMB 172.16.5.5 445 ACADEMY-EA-DC01 IPC$ READ Remote IPC SMB 172.16.5.5 445 ACADEMY-EA-DC01 NETLOGON READ Logon server share SMB 172.16.5.5 445 ACADEMY-EA-DC01 SYSVOL READ Logon server share SMB 172.16.5.5 445 ACADEMY-EA-DC01 User Shares READ SMB 172.16.5.5 445 ACADEMY-EA-DC01 ZZZ_archive READ ``` #### 5. Spider\_plus ```bash nduc193@htb[/htb]$ sudo crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M spider_plus --share 'Department Shares' SMB 172.16.5.5 445 ACADEMY-EA-DC01 [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False) SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] INLANEFREIGHT.LOCAL\forend:Klmcargo2 SPIDER_P... 172.16.5.5 445 ACADEMY-EA-DC01 [*] Started spidering plus with option: SPIDER_P... 172.16.5.5 445 ACADEMY-EA-DC01 [*] DIR: ['print$'] SPIDER_P... 172.16.5.5 445 ACADEMY-EA-DC01 [*] EXT: ['ico', 'lnk'] SPIDER_P... 172.16.5.5 445 ACADEMY-EA-DC01 [*] SIZE: 51200 SPIDER_P... 172.16.5.5 445 ACADEMY-EA-DC01 [*] OUTPUT: /tmp/cme_spider_plus ``` output được lưu ở **`/tmp/cme_spider_plus/`** ```bash nduc193@htb[/htb]$ head -n 10 /tmp/cme_spider_plus/172.16.5.5.json { "Department Shares": { "Accounting/Private/AddSelect.bat": { "atime_epoch": "2022-03-31 14:44:42", "ctime_epoch": "2022-03-31 14:44:39", "mtime_epoch": "2022-03-31 15:14:46", "size": "278 Bytes" }, "Accounting/Private/ApproveConnect.wmf": { "atime_epoch": "2022-03-31 14:45:14", ``` ## SMBMap [SMBMap](https://github.com/ShawnDEvans/smbmap) dùng để enum các shares từ máy của attacker, ngoài ra còn thu thập permissions, content nếu có thể truy cập, download/upload files, remote exec commands,... ```bash nduc193@htb[/htb]$ smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5 [+] IP: 172.16.5.5:445 Name: inlanefreight.local Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share Department Shares READ ONLY IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share User Shares READ ONLY ZZZ_archive READ ONLY ``` #### Recursive List Of All Directories ```bash nduc193@htb[/htb]$ smbmap -u forend -p Klmcargo2 -d INLANEFREIGHT.LOCAL -H 172.16.5.5 -R 'Department Shares' --dir-only [+] IP: 172.16.5.5:445 Name: inlanefreight.local Disk Permissions Comment ---- ----------- ------- Department Shares READ ONLY .\Department Shares\* dr--r--r-- 0 Thu Mar 31 15:34:29 2022 . dr--r--r-- 0 Thu Mar 31 15:34:29 2022 .. dr--r--r-- 0 Thu Mar 31 15:14:48 2022 Accounting dr--r--r-- 0 Thu Mar 31 15:14:39 2022 Executives dr--r--r-- 0 Thu Mar 31 15:14:57 2022 Finance dr--r--r-- 0 Thu Mar 31 15:15:04 2022 HR dr--r--r-- 0 Thu Mar 31 15:15:21 2022 IT dr--r--r-- 0 Thu Mar 31 15:15:29 2022 Legal dr--r--r-- 0 Thu Mar 31 15:15:37 2022 Marketing dr--r--r-- 0 Thu Mar 31 15:15:47 2022 Operations dr--r--r-- 0 Thu Mar 31 15:15:58 2022 R&D dr--r--r-- 0 Thu Mar 31 15:16:10 2022 Temp dr--r--r-- 0 Thu Mar 31 15:16:18 2022 Warehouse ``` ## rpcclient [rpcclient](https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html) là tool được sử dụng với Samba protocol, nó có thể list, add, thay đổi hoặc remove Object khỏi AD ``` rpcclient -U "" -N 172.16.5.5 ```
Khi nhìn vào bên cạnh user, chúng ta thấy 1 field là **`RID`** và chúng ta có thể queryuser tới rid đó #### RPCClient User Enumeration By RID ```bash rpcclient $> queryuser 0x457 User Name : htb-student Full Name : Htb Student Home Drive : Dir Drive : Profile Path: Logon Script: Description : Workstations: Comment : Remote Dial : Logon Time : Wed, 02 Mar 2022 15:34:32 EST Logoff Time : Wed, 31 Dec 1969 19:00:00 EST Kickoff Time : Wed, 13 Sep 30828 22:48:05 EDT Password last set Time : Wed, 27 Oct 2021 12:26:52 EDT Password can change Time : Thu, 28 Oct 2021 12:26:52 EDT Password must change Time: Wed, 13 Sep 30828 22:48:05 EDT unknown_2[0..31]... user_rid : 0x457 group_rid: 0x201 acb_info : 0x00000010 fields_present: 0x00ffffff logon_divs: 168 bad_password_count: 0x00000000 logon_count: 0x0000001d padding1[0..7]... logon_hrs[0..21]... ``` #### Enumdomusers ```bash rpcclient $> enumdomusers user:[administrator] rid:[0x1f4] user:[guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[lab_adm] rid:[0x3e9] user:[htb-student] rid:[0x457] user:[avazquez] rid:[0x458] user:[pfalcon] rid:[0x459] user:[fanthony] rid:[0x45a] user:[wdillard] rid:[0x45b] user:[lbradford] rid:[0x45c] user:[sgage] rid:[0x45d] user:[asanchez] rid:[0x45e] user:[dbranch] rid:[0x45f] user:[ccruz] rid:[0x460] user:[njohnson] rid:[0x461] user:[mholliday] rid:[0x462] ``` Impacket Toolkit **Impacket** là bộ tool Python để tương tác & khai thác giao thức Windows (SMB, RPC, WMI…) #### Psexec.py **Psexec** nó sẽ upload các file exe random name lên share **`ADMIN$`** sau đó trigger để kéo shell về cho chúng ta. ``` psexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.125 ```
#### wmiexec.py **Wmiexec** là một **semi-interactive** **shell** được execute qua [Windows Management Instrumentation](https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page). **Wmiexec** ko upload file lên và ko tạo ra nhiều log ```bash wmiexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.5 ```
## Windapsearch [Windapsearch](https://github.com/ropnop/windapsearch) là tool được sử dụng để enumerate users, groups, và computers từ Windows domain bằng query LDAP #### Find Domain Admins ```bash nduc193@htb[/htb]$ python3 windapsearch.py --dc-ip 172.16.5.5 -u forend@inlanefreight.local -p Klmcargo2 --da [+] Using Domain Controller at: 172.16.5.5 [+] Getting defaultNamingContext from Root DSE [+] Found: DC=INLANEFREIGHT,DC=LOCAL [+] Attempting bind [+] ...success! Binded as: [+] u:INLANEFREIGHT\forend [+] Attempting to enumerate all Domain Admins [+] Using DN: CN=Domain Admins,CN=Users.CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL [+] Found 28 Domain Admins: cn: Administrator userPrincipalName: administrator@inlanefreight.local cn: lab_adm cn: Matthew Morgan userPrincipalName: mmorgan@inlanefreight.local ``` #### Windapsearch - Privileged Users ```bash nduc193@htb[/htb]$ python3 windapsearch.py --dc-ip 172.16.5.5 -u forend@inlanefreight.local -p Klmcargo2 -PU [+] Using Domain Controller at: 172.16.5.5 [+] Getting defaultNamingContext from Root DSE [+] Found: DC=INLANEFREIGHT,DC=LOCAL [+] Attempting bind [+] ...success! Binded as: [+] u:INLANEFREIGHT\forend [+] Attempting to enumerate all AD privileged users [+] Using DN: CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL [+] Found 28 nested users for group Domain Admins: cn: Administrator userPrincipalName: administrator@inlanefreight.local cn: lab_adm cn: Angela Dunn userPrincipalName: adunn@inlanefreight.local cn: Matthew Morgan userPrincipalName: mmorgan@inlanefreight.local cn: Dorothy Click userPrincipalName: dclick@inlanefreight.local [+] Using DN: CN=Enterprise Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL [+] Found 3 nested users for group Enterprise Admins: cn: Administrator userPrincipalName: administrator@inlanefreight.local cn: lab_adm cn: Sharepoint Admin userPrincipalName: sp-admin@INLANEFREIGHT.LOCAL ``` Bloodhound.py Khi đã có foothold trong domain, chúng ta có thể dùng Bloohound để find attack path. Và tool này có 2 phần là : * **SharpHound** : dùng để enum information ra các file json * **BloodHound** : upload các file json lên để nó tự scan vector attack. ```bash nduc193@htb[/htb]$ sudo bloodhound-python -u 'forend' -p 'Klmcargo2' -ns 172.16.5.5 -d inlanefreight.local -c all INFO: Found AD domain: inlanefreight.local INFO: Connecting to LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL INFO: Found 1 domains INFO: Found 2 domains in the forest INFO: Found 564 computers INFO: Connecting to LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL INFO: Found 2951 users INFO: Connecting to GC LDAP server: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL INFO: Found 183 groups INFO: Found 2 trusts INFO: Starting computer enumeration with 10 workers ``` Sau đó, chúng ta start **`neo4j`** load vào database và truy vấn qua Cypher queries. Sau đó start Bloodhound GUI ```bash sudo neo4j start bloodhound ``` Sau đó có thể query dựa trên
## BloodHound ```bash .\SharpHound.exe -c All ``` ```bash PS C:\htb> .\SharpHound.exe -c All --zipfilename ILFREIGHT 2022-04-18T13:58:22.1163680-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote 2022-04-18T13:58:22.1163680-07:00|INFORMATION|Initializing SharpHound at 1:58 PM on 4/18/2022 2022-04-18T13:58:22.6788709-07:00|INFORMATION|Flags: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote 2022-04-18T13:58:23.0851206-07:00|INFORMATION|Beginning LDAP search for INLANEFREIGHT.LOCAL 2022-04-18T13:58:53.9132950-07:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 67 MB RAM 2022-04-18T13:59:15.7882419-07:00|INFORMATION|Producer has finished, closing LDAP channel 2022-04-18T13:59:16.1788930-07:00|INFORMATION|LDAP channel closed, waiting for consumers 2022-04-18T13:59:23.9288698-07:00|INFORMATION|Status: 3793 objects finished (+3793 63.21667)/s -- Using 112 MB RAM 2022-04-18T13:59:45.4132561-07:00|INFORMATION|Consumers finished, closing output channel Closing writers 2022-04-18T13:59:45.4601086-07:00|INFORMATION|Output channel closed, waiting for output task to complete 2022-04-18T13:59:45.8663528-07:00|INFORMATION|Status: 3809 objects finished (+16 46.45122)/s -- Using 110 MB RAM 2022-04-18T13:59:45.8663528-07:00|INFORMATION|Enumeration finished in 00:01:22.7919186 2022-04-18T13:59:46.3663660-07:00|INFORMATION|SharpHound Enumeration Completed at 1:59 PM on 4/18/2022! Happy Graphing ``` ActiveDirectory PowerShell Module ActiveDirectory PowerShell Module là một nhóm command Powershell được dùng để quản lý AD. Nó bao gồm 147 command. #### Load ActiveDirectory Module ```bash PS C:\htb> Import-Module ActiveDirectory PS C:\htb> Get-Module ModuleType Version Name ExportedCommands ---------- ------- ---- ---------------- Manifest 1.0.1.0 ActiveDirectory {Add-ADCentralAccessPolicyMember, Add-ADComputerServiceAcc... Manifest 3.1.0.0 Microsoft.PowerShell.Utility {Add-Member, Add-Type, Clear-Variable, Compare-Object...} Script 2.0.0 PSReadline {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PS... ``` #### Get Domain Info ```bash PS C:\htb> Get-ADDomain AllowedDNSSuffixes : {} ChildDomains : {LOGISTICS.INLANEFREIGHT.LOCAL} ComputersContainer : CN=Computers,DC=INLANEFREIGHT,DC=LOCAL DeletedObjectsContainer : CN=Deleted Objects,DC=INLANEFREIGHT,DC=LOCAL DistinguishedName : DC=INLANEFREIGHT,DC=LOCAL DNSRoot : INLANEFREIGHT.LOCAL DomainControllersContainer : OU=Domain Controllers,DC=INLANEFREIGHT,DC=LOCAL DomainMode : Windows2016Domain DomainSID : S-1-5-21-3842939050-3880317879-2865463114 ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=INLANEFREIGHT,DC=LOCAL Forest : INLANEFREIGHT.LOCAL InfrastructureMaster : ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL LastLogonReplicationInterval : LinkedGroupPolicyObjects : {cn={DDBB8574-E94E-4525-8C9D-ABABE31223D0},cn=policies,cn=system,DC=INLANEFREIGHT, DC=LOCAL, CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=INLAN EFREIGHT,DC=LOCAL} LostAndFoundContainer : CN=LostAndFound,DC=INLANEFREIGHT,DC=LOCAL ManagedBy : Name : INLANEFREIGHT NetBIOSName : INLANEFREIGHT ObjectClass : domainDNS ObjectGUID : 71e4ecd1-a9f6-4f55-8a0b-e8c398fb547a ParentDomain : PDCEmulator : ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL PublicKeyRequiredPasswordRolling : True QuotasContainer : CN=NTDS Quotas,DC=INLANEFREIGHT,DC=LOCAL ReadOnlyReplicaDirectoryServers : {} ReplicaDirectoryServers : {ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL} RIDMaster : ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL SubordinateReferences : {DC=LOGISTICS,DC=INLANEFREIGHT,DC=LOCAL, DC=ForestDnsZones,DC=INLANEFREIGHT,DC=LOCAL, DC=DomainDnsZones,DC=INLANEFREIGHT,DC=LOCAL, CN=Configuration,DC=INLANEFREIGHT,DC=LOCAL} SystemsContainer : CN=System,DC=INLANEFREIGHT,DC=LOCAL UsersContainer : CN=Users,DC=INLANEFREIGHT,DC=LOCAL ``` #### Get-ADUser ```bash PS C:\htb> Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName DistinguishedName : CN=adfs,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL Enabled : True GivenName : Sharepoint Name : adfs ObjectClass : user ObjectGUID : 49b53bea-4bc4-4a68-b694-b806d9809e95 SamAccountName : adfs ServicePrincipalName : {adfsconnect/azure01.inlanefreight.local} SID : S-1-5-21-3842939050-3880317879-2865463114-5244 Surname : Admin UserPrincipalName : DistinguishedName : CN=BACKUPAGENT,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL Enabled : True GivenName : Jessica Name : BACKUPAGENT ObjectClass : user ObjectGUID : 2ec53e98-3a64-4706-be23-1d824ff61bed SamAccountName : backupagent ServicePrincipalName : {backupjob/veam001.inlanefreight.local} SID : S-1-5-21-3842939050-3880317879-2865463114-5220 Surname : Systemmailbox 8Cc370d3-822A-4Ab8-A926-Bb94bd0641a9 UserPrincipalName : ``` #### Checking For Trust Relationships ```bash PS C:\htb> Get-ADTrust -Filter * Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=LOGISTICS.INLANEFREIGHT.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : False IntraForest : True IsTreeParent : False IsTreeRoot : False Name : LOGISTICS.INLANEFREIGHT.LOCAL ObjectClass : trustedDomain ObjectGUID : f48a1169-2e58-42c1-ba32-a6ccb10057ec SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : LOGISTICS.INLANEFREIGHT.LOCAL TGTDelegation : False TrustAttributes : 32 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=FREIGHTLOGISTICS.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : True IntraForest : False IsTreeParent : False IsTreeRoot : False Name : FREIGHTLOGISTICS.LOCAL ObjectClass : trustedDomain ObjectGUID : 1597717f-89b7-49b8-9cd9-0801d52475ca SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : FREIGHTLOGISTICS.LOCAL TGTDelegation : False TrustAttributes : 8 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False ``` #### Group Enumeration ```bash PS C:\htb> Get-ADGroup -Filter * | select name name ---- Administrators Users Guests Print Operators Backup Operators Replicator Remote Desktop Users Network Configuration Operators Performance Monitor Users Performance Log Users Distributed COM Users IIS_IUSRS Cryptographic Operators Event Log Readers Certificate Service DCOM Access RDS Remote Access Servers RDS Endpoint Servers RDS Management Servers Hyper-V Administrators Access Control Assistance Operators Remote Management Users Storage Replica Administrators Domain Computers Domain Controllers Schema Admins Enterprise Admins Cert Publishers Domain Admins ``` #### Detailed Group Info ```bash PS C:\htb> Get-ADGroup -Identity "Backup Operators" DistinguishedName : CN=Backup Operators,CN=Builtin,DC=INLANEFREIGHT,DC=LOCAL GroupCategory : Security GroupScope : DomainLocal Name : Backup Operators ObjectClass : group ObjectGUID : 6276d85d-9c39-4b7c-8449-cad37e8abc38 SamAccountName : Backup Operators SID : S-1-5-32-551 ``` #### Group Membership ```bash PS C:\htb> Get-ADGroupMember -Identity "Backup Operators" distinguishedName : CN=BACKUPAGENT,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL name : BACKUPAGENT objectClass : user objectGUID : 2ec53e98-3a64-4706-be23-1d824ff61bed SamAccountName : backupagent SID : S-1-5-21-3842939050-3880317879-2865463114-5220 ``` ## PowerView [PowerView](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon) là tool được viết bằng **PowerShell** nó cung cấp một cách để xác định nơi user login vào mạng, enum info domain như user, computer, nhóm, ACLS, trusts, shares và password, Kerberoasting, v.v | `Export-PowerViewCSV` | Append results to a CSV file | | ----------------------------------- | ------------------------------------------------------------------------------------------ | | `ConvertTo-SID` | Convert a User or group name to its SID value | | `Get-DomainSPNTicket` | Requests the Kerberos ticket for a specified Service Principal Name (SPN) account | | **Domain/LDAP Functions:** | | | `Get-Domain` | Will return the AD object for the current (or specified) domain | | `Get-DomainController` | Return a list of the Domain Controllers for the specified domain | | `Get-DomainUser` | Will return all users or specific user objects in AD | | `Get-DomainComputer` | Will return all computers or specific computer objects in AD | | `Get-DomainGroup` | Will return all groups or specific group objects in AD | | `Get-DomainOU` | Search for all or specific OU objects in AD | | `Find-InterestingDomainAcl` | Finds object ACLs in the domain with modification rights set to non-built in objects | | `Get-DomainGroupMember` | Will return the members of a specific domain group | | `Get-DomainFileServer` | Returns a list of servers likely functioning as file servers | | `Get-DomainDFSShare` | Returns a list of all distributed file systems for the current (or specified) domain | | **GPO Functions:** | | | `Get-DomainGPO` | Will return all GPOs or specific GPO objects in AD | | `Get-DomainPolicy` | Returns the default domain policy or the domain controller policy for the current domain | | **Computer Enumeration Functions:** | | | `Get-NetLocalGroup` | Enumerates local groups on the local or a remote machine | | `Get-NetLocalGroupMember` | Enumerates members of a specific local group | | `Get-NetShare` | Returns open shares on the local (or a remote) machine | | `Get-NetSession` | Will return session information for the local (or a remote) machine | | `Test-AdminAccess` | Tests if the current user has administrative access to the local (or a remote) machine | | **Threaded 'Meta'-Functions:** | | | `Find-DomainUserLocation` | Finds machines where specific users are logged in | | `Find-DomainShare` | Finds reachable shares on domain machines | | `Find-InterestingDomainShareFile` | Searches for files matching specific criteria on readable shares in the domain | | `Find-LocalAdminAccess` | Find machines on the local domain where the current user has local administrator access | | **Domain Trust Functions:** | | | `Get-DomainTrust` | Returns domain trusts for the current domain or a specified domain | | `Get-ForestTrust` | Returns all forest trusts for the current forest or a specified forest | | `Get-DomainForeignUser` | Enumerates users who are in groups outside of the user's domain | | `Get-DomainForeignGroupMember` | Enumerates groups with users outside of the group's domain and returns each foreign member | | `Get-DomainTrustMapping` | Will enumerate all trusts for the current domain and any others seen. | #### Domain User Information ```bash PS C:\htb> Get-DomainUser -Identity mmorgan -Domain inlanefreight.local | Select-Object -Property name,samaccountname,description,memberof,whencreated,pwdlastset,lastlogontimestamp,accountexpires,admincount,userprincipalname,serviceprincipalname,useraccountcontrol name : Matthew Morgan samaccountname : mmorgan description : memberof : {CN=VPN Users,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=Shared Calendar Read,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=Printer Access,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=File Share H Drive,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL...} whencreated : 10/27/2021 5:37:06 PM pwdlastset : 11/18/2021 10:02:57 AM lastlogontimestamp : 2/27/2022 6:34:25 PM accountexpires : NEVER admincount : 1 userprincipalname : mmorgan@inlanefreight.local serviceprincipalname : mail : useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH ``` #### Recursive Group Membership ```bash PS C:\htb> Get-DomainGroupMember -Identity "Domain Admins" -Recurse GroupDomain : INLANEFREIGHT.LOCAL GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL MemberDomain : INLANEFREIGHT.LOCAL MemberName : svc_qualys MemberDistinguishedName : CN=svc_qualys,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL MemberObjectClass : user MemberSID : S-1-5-21-3842939050-3880317879-2865463114-5613 GroupDomain : INLANEFREIGHT.LOCAL GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL MemberDomain : INLANEFREIGHT.LOCAL MemberName : sp-admin MemberDistinguishedName : CN=Sharepoint Admin,OU=Service Accounts,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL MemberObjectClass : user MemberSID : S-1-5-21-3842939050-3880317879-2865463114-5228 GroupDomain : INLANEFREIGHT.LOCAL GroupName : Secadmins GroupDistinguishedName : CN=Secadmins,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL MemberDomain : INLANEFREIGHT.LOCAL MemberName : spong1990 MemberDistinguishedName : CN=Maggie Jablonski,OU=Operations,OU=Logistics-HK,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL MemberObjectClass : user MemberSID : S-1-5-21-3842939050-3880317879-2865463114-1965 ``` #### Trust Enumeration ```bash PS C:\htb> Get-DomainTrustMapping SourceName : INLANEFREIGHT.LOCAL TargetName : LOGISTICS.INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/1/2021 6:20:22 PM WhenChanged : 2/26/2022 11:55:55 PM SourceName : INLANEFREIGHT.LOCAL TargetName : FREIGHTLOGISTICS.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FOREST_TRANSITIVE TrustDirection : Bidirectional WhenCreated : 11/1/2021 8:07:09 PM WhenChanged : 2/27/2022 12:02:39 AM SourceName : LOGISTICS.INLANEFREIGHT.LOCAL TargetName : INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/1/2021 6:20:22 PM WhenChanged : 2/26/2022 11:55:55 PM ``` #### Testing for Local Admin Access ```bash PS C:\htb> Test-AdminAccess -ComputerName ACADEMY-EA-MS01 ComputerName IsAdmin ------------ ------- ACADEMY-EA-MS01 True ``` #### Finding Users With SPN Set ```bash PS C:\htb> Get-DomainUser -SPN -Properties samaccountname,ServicePrincipalName serviceprincipalname samaccountname -------------------- -------------- adfsconnect/azure01.inlanefreight.local adfs backupjob/veam001.inlanefreight.local backupagent d0wngrade/kerberoast.inlanefreight.local d0wngrade kadmin/changepw krbtgt MSSQLSvc/DEV-PRE-SQL.inlanefreight.local:1433 sqldev MSSQLSvc/SPSJDB.inlanefreight.local:1433 sqlprod MSSQLSvc/SQL-CL01-01inlanefreight.local:49351 sqlqa sts/inlanefreight.local solarwindsmonitor testspn/kerberoast.inlanefreight.local testspn testspn2/kerberoast.inlanefreight.local testspn2 ``` ## SharpView **SharpView** là phiên bản được phát triển thêm dựa trên **PowerView** và nó có thêm một số chức năng mới như **`Get-NetGmsa`** được sử dụng để hunt [Group Managed Service Accounts](https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview). ```bash PS C:\htb> .\SharpView.exe Get-DomainUser -Help Get_DomainUser -Identity -DistinguishedName -SamAccountName -Name -MemberDistinguishedName -MemberName -SPN -AdminCount -AllowDelegation -DisallowDelegation -TrustedToAuth -PreauthNotRequired -KerberosPreauthNotRequired -NoPreauth -Domain -LDAPFilter -Filter -Properties -SearchBase -ADSPath -Server -DomainController -SearchScope -ResultPageSize -ServerTimeLimit -SecurityMasks -Tombstone -FindOne -ReturnOne -Credential -Raw -UACFilter ``` ```bash PS C:\htb> .\SharpView.exe Get-DomainUser -Identity forend [Get-DomainSearcher] search base: LDAP://ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL/DC=INLANEFREIGHT,DC=LOCAL [Get-DomainUser] filter string: (&(samAccountType=805306368)(|(samAccountName=forend))) objectsid : {S-1-5-21-3842939050-3880317879-2865463114-5614} samaccounttype : USER_OBJECT objectguid : 53264142-082a-4cb8-8714-8158b4974f3b useraccountcontrol : NORMAL_ACCOUNT accountexpires : 12/31/1600 4:00:00 PM lastlogon : 4/18/2022 1:01:21 PM lastlogontimestamp : 4/9/2022 1:33:21 PM pwdlastset : 2/28/2022 12:03:45 PM lastlogoff : 12/31/1600 4:00:00 PM badPasswordTime : 4/5/2022 7:09:07 AM name : forend distinguishedname : CN=forend,OU=IT Admins,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL whencreated : 2/28/2022 8:03:45 PM whenchanged : 4/9/2022 8:33:21 PM samaccountname : forend memberof : {CN=VPN Users,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=Shared Calendar Read,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=Printer Access,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=File Share H Drive,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL, CN=File Share G Drive,OU=Security Groups,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL} cn : {forend} objectclass : {top, person, organizationalPerson, user} badpwdcount : 0 countrycode : 0 usnchanged : 3259288 logoncount : 26618 primarygroupid : 513 objectcategory : CN=Person,CN=Schema,CN=Configuration,DC=INLANEFREIGHT,DC=LOCAL dscorepropagationdata : {3/24/2022 3:58:07 PM, 3/24/2022 3:57:44 PM, 3/24/2022 3:52:58 PM, 3/24/2022 3:49:31 PM, 7/14/1601 10:36:49 PM} usncreated : 3054181 instancetype : 4 codepage : 0 ``` ## Snaffler [Snaffler](https://github.com/SnaffCon/Snaffler) là tool dùng để tìm **sensitive data** như credentials, password, key, file cấu hình, tài liệu nội bộ… nằm trên các file share trong domain. ```bash Snaffler.exe -s -d inlanefreight.local -o snaffler.log -v data ``` ```bash PS C:\htb> .\Snaffler.exe -d INLANEFREIGHT.LOCAL -s -v data .::::::.:::. :::. :::. .-:::::'.-:::::'::: .,:::::: :::::::.. ;;;` ``;;;;, `;;; ;;`;; ;;;'''' ;;;'''' ;;; ;;;;'''' ;;;;``;;;; '[==/[[[[, [[[[[. '[[ ,[[ '[[, [[[,,== [[[,,== [[[ [[cccc [[[,/[[[' ''' $ $$$ 'Y$c$$c$$$cc$$$c`$$$'`` `$$$'`` $$' $$"" $$$$$$c 88b dP 888 Y88 888 888,888 888 o88oo,.__888oo,__ 888b '88bo, 'YMmMY' MMM YM YMM ''` 'MM, 'MM, ''''YUMMM''''YUMMMMMMM 'W' by l0ss and Sh3r4 - github.com/SnaffCon/Snaffler 2022-03-31 12:16:54 -07:00 [Share] {Black}(\\ACADEMY-EA-MS01.INLANEFREIGHT.LOCAL\ADMIN$) 2022-03-31 12:16:54 -07:00 [Share] {Black}(\\ACADEMY-EA-MS01.INLANEFREIGHT.LOCAL\C$) 2022-03-31 12:16:54 -07:00 [Share] {Green}(\\ACADEMY-EA-MX01.INLANEFREIGHT.LOCAL\address) 2022-03-31 12:16:54 -07:00 [Share] {Green}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares) 2022-03-31 12:16:54 -07:00 [Share] {Green}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\User Shares) 2022-03-31 12:16:54 -07:00 [Share] {Green}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\ZZZ_archive) 2022-03-31 12:17:18 -07:00 [Share] {Green}(\\ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL\CertEnroll) 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\GroupBackup.kdb) .kdb 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\ShowReset.key) .key 2022-03-31 12:17:19 -07:00 [Share] {Green}(\\ACADEMY-EA-FILE.INLANEFREIGHT.LOCAL\UpdateServicesPackages) 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\WriteUse.kwallet) .kwallet 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\ProtectStep.key) .key 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\StopTrace.ppk) .ppk 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\WaitClear.key) .key 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\DenyRedo.sqldump) .sqldump 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\AddPublish.sqldump) .sqldump 2022-03-31 12:17:19 -07:00 [Share] {Green}(\\ACADEMY-EA-FILE.INLANEFREIGHT.LOCAL\WsusContent) 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\SetStep.keychain) .keychain 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\FindConnect.tblk) .tblk 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\GetUpdate.psafe3) .psafe3 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Infosec\UnprotectConvertTo.keypair) .keypair 2022-03-31 12:17:19 -07:00 [File] {Black}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\ExportJoin.tblk) .tblk 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\FormatShow.mdf) .mdf 2022-03-31 12:17:19 -07:00 [File] {Red}(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\LockConfirm.mdf) .mdf ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/active-directory/credentialed-enumeration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.