Our first task is to install the PowerShell Active Directory module on the
machine that we're using. In a lot of cases, this module is not installed
by default, but it can be easily installed. So, let's go to our lab
environment and see how that's done.
Welcome back to our lab environment.
I'm here on my victim computer logged as a low‑level user.
There are three main ways of installing PowerShell Active Directory module.
Two of those techniques require admin privileges, but one of them
doesn't, so let's explore those three options.
First, we can start the AD module by going to the Server Manager,
and then clicking on the option Add roles and features. And in this
new screen, we can press Next until we get to the Features tab.
Perfect! In this list of Features, we can then scroll down and then
expand the option, Remote Server Administration Tools.
Then inside of it, we expand Role Administration Tools,
then AD DS and AD LDS tools. And finally, we select the option Active
Directory module for Windows PowerShell. Once this is selected,
I can then click on Next and then confirm the installation.
Perfect! If I had admin privileges on this machine,
this would install everything for me.
However, as I don't have admin privileges, I get this error here.
So, let's close this and go to a second method of
installing the Active Directory module.
This one is even easier than the previous one.
I just have to open PowerShell and then use this command here,
Install‑WindowsFeature and then RSAT‑AD‑PowerShell. And once I
press Enter, this will download the Active Directory module and
will try to install that on my system.
But again,
as in here, I don't have admin privileges on my machine. I get
an error during the installation process. Since we don't have
admin privileges on this computer,
we can do a workaround to have this module running.
Instead of installing the module,
we can download the source code for this module and execute it manually.
For example, if we go to this GitHub page here,
we have the Activity Directory module source code.
We could easily download all the files from here and load them manually.
However,
the authors of this amazing GitHub project already created for us
a one‑line command that downloads all the required files into the
memory and loads everything for us.
So, all we have to do is run this one command, and we'll be
ready to use the Active Directory module.
And this can be really interesting in a red team engagement
because we don't need to download any files on the disk, and we
also don't need to have admin privileges.
So, let's go to PowerShell and run this command. In here, I'll just copy
and paste that one‑line command, and let's run this.
Perfect! It seems that it worked. To confirm, let's just
see if the AD commands are available.
We can just type Get‑Command, and then get‑adcom and then star. Nice, take
a look. We have here a few Active Directory commands.
We can even run one AD command to see if that works.
For example, let's run Get‑ADDomain.
Amazing, take a look.
It works.
We have here all the information about the domain.
Another command that we can run to test if everything is working is the
Get‑ADUser command, which retrieves information about a user.
So, let's try this command with the user kennyk, and I'll also add
the flag parameters equals to star so we can get all the
information that we can. Perfect, take a look.
We've got some basic information about Kenny, and this is already a
really good start for a red team engagement. However,
if you want to get even more information about this user,
we need to download the Active Directory module and
load some of the libraries manually.
So in here, we can go to the GitHub page that we discussed before,
then go to my new code, and click on the button,
Download ZIP. Once you've downloaded and extracted the files,
you have a folder like this one here.
As you can see, all the files from GitHub are here.
The additional module that we're looking for is inside of this
folder called ActiveDirectory. In some cases,
since we download those files from the internet, Windows might
block those files. And to unblock those files,
you just have to right‑click on each file,
go to the option, Properties. And in here, you select the option
Unblock and click on Apply, and that's it.
The file now is unblocked.
So, let me quickly do that for all the other files.
Just a few more now, and that's it.
We're done.
All the files are now unblocked.
You can then load them into PowerShell. So, let's go to the
PowerShell terminal. In here, let's go to the folder that
contains the files that were unblocked.
In here, let's use the command Import‑Module to
import the ActiveDirectory.psd1 file.
Once I press Enter, it will load the additional libraries that we need.
And as you can see here, we have an error, but don't worry.
It is just saying that I already have some of the Active
Directory functions in the session.
Now let's see if we can get more information about the user.
Let's just run the exact same Get‑ADUser command as before,
and let's see if we can get more stuff.
Perfect, take a look. We've got tons of information about this user.
We can see here the last log‑on date,
the last password set, and even the email related to this account.
Pretty cool, right?
Using the on‑disk version of this Active Directory module,
we can get more information about the user.
However, it increases your chances of being detected
since you have to save files on a disk.
One important thing to remember is that if I close this
PowerShell window and open a new one,
I will have to import the Active Directory module again.
And this means that every time you open a new PowerShell,
you have to run that one‑line command.
Perfect.
So now that we have the Active Directory module ready,
we can go to our next demos and explore in more
details how to enumerate domains.