Now that we have the PowerShell Active Directory module installed,
we can then start to enumerate domain information such as users,
computers and assets.
In this demo, we'll use some manual commands to enumerate this information,
and then we will create an automated script so we can reuse our code later.
Perfect.
We are back to our live environment.
In here, I already have the PowerShell terminal open,
and also have the ActiveDirectory module loaded.
We are ready to start enumerating information.
Just as a note,
I'm using here a low‑level user with minimal privileges in the domain.
So, let's start by the basics.
All the domain enumeration commands starts with Get‑AD something.
For example, if I run Get‑ADDomain,
we get the basic information about our Globomantics domain,
like the DNS name, the Windows version of this domain,
and some other information.
We can actually get a list of all the enumeration
commands by using the feature Get‑command,
and then get‑AD, and then star.
This star means that we want to list all the commands that starts with get‑AD.
Once I run this, you can note the amount of enumeration commands.
It is a lot.
In this course, we will cover the main commands,
but feel free to explore this list and see if you find any other
enumeration command that is interesting for you.
One good tip here is that you can Filter the
enumeration commands by using a where Filter.
For example, I will run the exact same command as before,
but now I will put Where‑Object,
and then I will add a Filter so the name of the
command contains the word Policy.
In this way, we can enumerate policies in the domain.
Take a look.
We have here quite a few policy enumeration commands.
Some of them might require admin privileges to get information,
but a lot of them can be executed as a normal user.
For example, let's check the password policy for Globomantics.
We can do that by using the Get‑ADDefaultDomainPasswordPolicy.
Once I run this, it will give me all the details of the password policy.
We can see here that the minimum password length is 7 characters.
Also, we can see that my LockoutThreshold is 0,
meaning there is no account lockout in here.
I can try thousands of passwords, and I will not get locked out.
In some companies, you might have here a number like 5,
for example, meaning that I can try up to 4 passwords before locking the account.
We can also see here that accounts get locked for 30 minutes and the
failed login attempts are forgotten after 30 minutes.
This information can be really valuable to perform a password
brute force attack without locking any accounts.
Okay, so now, let's take a look at the other commands.
We can use the Get‑ADComputer to list out the computers in the domain.
In here,
I'm using the star as a Filter so we can actually see every single computer.
Once I run this, I will get a list of all the machines in the domain.
In here, I have quite a lot of information,
so I will select only the few that I want to see using the Select‑Object
command and giving the fields that I'm interested in.
Once I run this,
I'll get a list of all the servers and their status on the domain.
And the cool thing about using PowerShell is that we can easily explore this,
like we can run the exact same command, but now using the Export‑CSV feature.
So then, we can save all data results into a CSV file.
In here, I will save the results on a file called computers.csv.
Then, let's take a look at the file that was created.
Perfect.
See here?
We have all the computers saved into the CSV file.
Now, let's use the same Get‑ADComputer command,
but now to get more information about a specific server.
I can do that by using the flag Identity and then providing the
hostname of the machine that I want to enumerate.
Once I run this, I get all the basic information about the computer.
But, if I want to enumerate even more information about this,
I can just add the flag Properties and then star,
so then we can see everything about this computer. And take a look, we've
got a massive amount of information about this machine,
like the OperationSystemVersion and even the ServicePrincipalNames.
Similar to the Get‑ADComputer, we have to Get‑ADUser.
This command here can enumerate all the users in our domain.
In here,
I'll run this command with a star as a Filter so we can see all the users.
Take a look, we've got a huge list of users.
Just to make it easier to view the data,
I will run the same command, but now selecting only the ColumnsName,
SameAccountName, and Enabled.
Perfect.
Once I run this, I'll get a list of all the users in the domain.
Here, I have their full name, their username, and if they are enabled or not.
And as this is important information for me,
I will save this into a CSV file using the Export‑CSV command.
Then, let's just open the file and make sure the data is there.
Perfect.
It's all there.
This list can be really useful during the red team
engagement since with this information,
we can start to select our next user targets.
And talking about data,
let's say you're looking for a specific employee in the company.
We can find their domain account by running the same
command as we were using before,
but now with a Where‑Object option and a Filter where the account
name contains the name that we're looking for.
Once I run this, I get here all the users that match with the word Kenny.
And if I want to get even more information about this Kenny account,
I can use the same Get‑ADUser command,
but now with the flag Identity and giving the username I'm looking to enumerate.
Take a look, we've got here some basic information about Kenny.
And, if you want to know even more about this user,
I can simply add the flag Properties,
and then put star so we can retrieve every single property.
Perfect.
We have here tons of information about Kenny.
We can see here that he's a senior IT analyst,
his last password set that date, when his account was created,
and much more.
Now, let's talk about groups.
We can enumerate AD groups by using the command
Get‑ADGroup with the flag Filter equal to star.
Also, in here,
I'll format this as a table so it is easier for us to digest the data.
Perfect.
Take a look.
We have here all the groups at Globomantics.
And if you're in a large domain, this list might be quite large.
So, for that,
we can Filter this down to find interesting things for the red team engagement.
For example,
we can run the exact same command, but now with a Where‑Object and a
Filter where the SamAccountName contains the word admin.
The idea here is finding all the admin groups in the domain.
Once I run this, I get the list of groups that contains the word admin.
Interesting, right?
Now, if I want to find out all the users that are in each group,
I can use Get‑ADGroupMember and then use the flag Identity to say that I
want to enumerate users on the Administrators group.
And as always, I'll format this as a table so we can better see the data.
Then, take a look, we have here at list of the admins in the company.
Those are the accounts that you should try to hack into since they might
give you domain admin privileges in the environment.
As this data is important for us,
I will save the contents of this query into a CSV file called admins.csv.
Perfect.
So, we saw how to search all the users in the group.
Now, let's say that I want to do the opposite.
I want to figure out all the groups that one user belongs to.
I can do that by using the command Get‑AD PrincipalGroupMembership
and then using the flag Identity to specify the username that I'm
interested in, and once I run this,
I will find out how the groups that Kenny belongs to. And again,
we can see here that Kenny is an administrator.
Okay, so I enumerated the domain information, the computers, and the users.
Let's now explore a few other interesting enumeration commands.
We can use the command Get‑ADTrust with the star as a Filter to
get all the domain trusts for Globomantics.
In my case, this is empty, but in your case, that might be different.
Also,
we can use the Get‑ADDomainController to get information about the
actual domain controller server in the environment.
And this has tons of interesting information,
like the version of Windows that this machine runs.
This can be really interesting because if the disk is
running an outdated Windows version.
We can try to exploit some vulnerabilities.
Another interesting command is the Get‑ADForest,
which will return to us information about the forest of the domain.
A lot of interesting stuff, right?
Now,
since we are dealing with PowerShell we can automate out this domain
enumeration so we don't have to type everything manually.
What we can do is create a script with the main commands that we cover here,
so we can reuse that later.
For that, let's open our PowerShell ISE so we can start our script.
In here, I will add the domain enumeration commands that we just discussed.
For example, we can start by enumerating information about the domain itself.
Then, we can list the password policy for the domain.
After that,
we can list all the computers in the domain and save that into a file.
Similar to that,
we can enumerate all the users and save that into a CSV file too.
In here,
I'll also add the line to enumerate all the groups that
contain the word admin and save the members of the group
Administrators into a CSV file.
And last,
I will add here two commands to get information about the domain
controller and the forest. Then, all the commands here are exactly the
same as the one that we discussed during the demo.
I'm basically just copying and pasting them here.
Now, just to make things prettier, I will add some messages during the
execution of the script, so the data is separated into sections.
Perfect.
Just a few more messages, and that's it.
We have our scripts ready.
Let's just save this into a file, and I will call this
as domain‑enumeration.ps1. Perfect.
Now, let's go to our PowerShell terminal and go to the
folder where my script is located. Then, now let's cross
our fingers and run the script.
Amazing.
It works.
We have here all the information about the domain and also a few files
containing the users, computers, and admins of Globomantics. Pretty cool,
right? In just a few minutes, we're able to create a script that enumerates
pretty much everything we need from our domain.
And the best part is, we then out this enumeration using a low privilege user.
We don't even need to be an admin to enumerate the domain.