Hey there.
It's nice to see you back. In this module, you'll learn how to
enumerate information from Active Directory using PowerShell. This
module is all about gathering information about our target domain, and
enumerating the Active Directory is one of the best ways of doing that.
By querying the AD, we can gather the domain users, the domain
computers, the service accounts, the domain trusts, the group policies,
and much more.
And all this information is vital in case you want to escalate your
privileges or move laterally on the environment.
And the best part is that we can do all this enumeration using PowerShell.
So let's take a quick look at what you'll be learning in this module.
First, we start by understanding Active Directory enumeration and what
kind of information we can get from it.
Then we have a really interesting demo showing you
how to enumerate domain users, computers,
assets, and other artifacts using PowerShell. After that, we'll cover the ADSI,
or Active Directory Service Interface, which allows you to interact with Active
Directory via PowerShell. And last, we have a demo showing how you can retrieve
service account hashes using the Kerberoasting attack, and we'll also see how to
crack those hashes to retrieve the plaintext password. In here, we'll be
continuing the Globomantics red team scenario that we discussed previously. In
this module, we'll be mainly focusing on the Active Directory of Globomantics.
In here, we'll use PowerShell to discover information about the domain and
potentially find a way to escalate a privilege in the domain. To enumerate
information from our domain, we can use three main techniques.
The first one is using the native Active Directory module
in PowerShell, which allows us to query the domain and
gather information that we need.
Similar to that, we can also use the Active
Directory Service Interface, or ADSI,
which allows us to fully control the domain using the
PowerShell command line interface.
For example,
we can add or remove domain users using ADSI. And last, for some
more advanced domain reconnaissance techniques,
we can use some open source PowerShell offensive frameworks that
implement some of the most common attacks for us,
like the Kerberoasting attack. When enumerating domains, we
are mainly interested in domain‑related information such as
domain users and the domain groups.
This can be really interesting to identify who are your domain admins
and which accounts you should try to compromise next.
It is also interesting that we enumerate what are the domain
computers so we can complement the data that we have from the port
scan. Also, we can use PowerShell to enumerate group policies so then
we can craft more advanced attacks.
For example, if we figure out the password lockout policy,
we can run a password brute force attack without locking any accounts.
And also, we can use PowerShell to enumerate certificate information and
service accounts, which are two ways of escalating privileges. And
talking about privilege escalation, we can use PowerShell to exploit
some of the Kerberos vulnerabilities and retrieve password hashes for
some service accounts.
Those hashes can then be cracked offline,
giving us full access to a high privilege account. A
lot of interesting information.
Right?
So let's go to our demos and see how we can collect
this information using PowerShell.