In some cases, you might need to have more control over the Active Directory,
and for that, you're better off using the Active Directory Service Interfaces.
This allows you to not only query for the data,
but also, modify the Active Directory objects in case you want to.
In our case here, we'll use the ADSI to find information about user accounts.
So, let's go to our lab environment.
And we are back to our lab environment.
The ADSI is a PowerShell library that allows you to perform
LDAP queries on the Active Directory.
In here, to be more specific, we'll be using the class system,
directory services, and directory searcher.
This class will receive an LDAP query and return an LDAP object to us,
and the best part is,
this PowerShell feature comes by default in most Windows installations,
so we don't have to install anything.
We can simply open a new PowerShell terminal and start to use it.
Also, cooler than that,
we don't even need to type this long class name here every time.
This class has a shortcut called adsisearcher.
We just have to type it between square brackets, and we can use this class.
And talking about that, it's fairly easy to use this feature.
All we have to do is given an LDAP query in between quotes.
For example,
if I want to search all objects that are have in their name the word Kenny,
I can simply use the query name=*Kenny*,
and again,
this will go through the Active Directory and find
objects with their word Kenny in the name.
But before we execute this, let's have a quick pause.
In this demo, we'll cover quite a few LDAP queries.
If you're not familiar with the LDAP,
I would recommend you checking this link here,
which is the LDAP Wiki.
In there,
you can learn how LDAP queries work and even see some examples of queries.
Okay, so let's execute this.
Perfect.
Take a look at this result.
In here, it's just saying that the query was executed successfully,
and there we have the results,
but it is not actually telling us the results themselves.
To get that information, I can run the exact same command,
but now in between brackets and then adding the .FindAll on the end.
This will find all the results and return them to us, so let's run this again.
Perfect.
Now we have here the path for each object found and
the properties for those objects.
Now, we can see here that we found all Active Directory
objects containing the word Kenny, which in my case is just one result.
But we can modify this query to find more stuff,
like I can search for all objects with the letters K and E in their name,
and now we have a list of four objects,
but note here that only two of them are users,
and that's because we are searching for any Active Directory object.
If you want to search just for users on the Active Directory,
we can easily modify our query.
For that,
I will expand the query adding an & operator and adding one more
parenthesis where the objectcategory=person.
But before running this, let's just understand what is happening here.
On my LDAP query, I have an & operator, and then I have a series of conditionals.
The first conditional is filtering for object categories that are named Person,
and the second conditional is filtering for objects
that have K and E in their names.
Once we run this, we can see here that now we have only users in this list.
Okay, so your turn now.
Let's say I want to find out the users in Globomantics.
How can I do that?
How would you do that?
Here, we can use the same query as a base.
To search for all the users,
we can simply remove the name conditional here or we can change it to name=*.
In this way,
we will search for all the persons on the Active
Directory without any filters on their name.
So, let's run this.
Amazing.
Take a look.
We have here a list of all the users on the domain.
Now, you might have noted that we only have very few information about the users.
We only have the account name and few other info.
In our red team engagement, we need way more information about each user.
For that, we can expand our query to get all the properties about a user.
First, in here,
I only have a list of the paths for the AD objects and not the actual AD object.
To get the actual AD object, we can run the same query,
but now adding pipe and executing the function
GetDirectoryEntry for each result.
Once I run this,
my computer will get the directory object for each of the results,
and this might take a little while if you're working a large company.
Take a look.
Now, our result is the actual AD entries,
and now we can query for specific information.
I can run the same query, but now selecting the fields SAMAccountName and Name.
Once I run this,
I get a list of all the usernames and their actual names in the Globomantics.
And more than that, if I want to get all the information about each single user,
I can just run the exact same command, but replacing the fields by star,
so we get every single field.
Perfect.
Let's run this.
Then, take a look.
We've got tons of information about each user,
and this is pretty much the same information we got on
our last demo using the AD module.
Now, similar to users,
we can run a similar command to find all the computers in the domain.
I will use here a basic query to find all the objects
there from the category computers.
Perfect.
Okay, and now,
let's use the same trick as before to retrieve all the
information about each computer.
This here will find each machine and retrieve everything about them.
And again,
this might take a little while since we are using LDAP
queries and retrieving a lot of data.
Perfect.
Take a look.
We've got tons of information about each computer.
I can even see here which version of Windows they are running in their hostname.
Now, we can use the same query to find information about groups.
I just have to change the ObjectCategory to groups and look at
that we have here all the groups in Globomantics.
And if I want to filter this even more to find only the
groups with the word admin on it,
we can change this query and modify the name
conditional so we have admin in the name.
Then we've got to hear all the groups with the name Admin in the name.
Interesting, right?
With this LDAP query, you can retrieve pretty much any information you want.
You just need to know the right LDAP query for that.
And one cool thing we can do here is searching
across all objects for specific data.
For example, every object in Active Directory contain an informational field,
which is basically a field where the administrators can add notes to it.
A lot of times, administrators add sensitive information to those notes.
Like,
I've seen cases where administrators added the password of the
computers in the notes attached to the computer,
and we can use ADSI to search for sensitive information in those notes.
For example,
I will use the adsisearcher to run this query here
where info contains the word pass.
This here will search the whole Active Directory looking for
objects that have the word pass on their notes.
So, if an administrator put any kind of password in an object,
we'll be able to find it.
So, let's run this.
Amazing.
Take a look.
We've got 1 match here, which is the MSSQL‑02 account.
So now, we need to retrieve the notes for that object so we can read them.
For that, I'll use the same trick as we were using before to get an object entry,
and then I will use a Select to get the SamAccountName,
the Name, and the Info field, which is the notes field.
Take a look.
The results got truncated.
So let me run the same command,
but now formatting this as a list so you can see the
whole content of the Info field.
Perfect.
It seems that the administrator left here a temporary password for this account.
We can now try to use this to log into the machine or maybe
even try to use this password in other accounts since
administrators usually reuse passwords.
Pretty cool, right?
In just few minutes,
we're able to use LDAP queries to find information about the domain and
even find passwords saved in the administrator notes.