Active Directory is a really great solution.
It has a lot of components, which can make it seem a little bit
daunting when you need to perform a penetration test.
Now there are a number of tools that you could use, and you can also use
some of the traditional approaches of enumeration within Active Directory.
In this demo, we're going to focus on enumeration, but we're going to spend
a couple of minutes to just look at the traditional way, and then we're
going to move towards the modern approach, and then look at the tools that
we can make use of.
If you think of the traditional way of performing enumeration,
these would involve commands such as the net user /domain.
Although this command gives me some actionable information, the problem with
this command is that it is not really OPSEC safe, and it can be easily
detected by defenders on the network or EDR solutions.
So a more modern approach would be to make use of PowerShell since PowerShell
has been included in Windows for some time, and PowerShell gives you a lot of
flexibility that you could use to craft some really great scripts and attacks
and, of course, make yourself PowerShell offensive security tools such as
PowerSploit and so forth.
But before we move into the tools, I want to look at some basic
scripts that we can use with PowerShell to enumerate the domain. And
the reason why I want to spend some time on those basic scripts is to
show you the difference between crafting your own script and the
effort involved compared to making use of an offensive security tools
like PowerSploit.
Now don't get me wrong,
it's great to know how to build your own scripts with PowerShell.
That is a really great skill to have because when you are
performing pen testing in the real world,
you may not have access to those tools.
And again, remember, those offensive security tools are
often detected by EDR solutions as well.
Yes, you can go and perform some evasion,
et cetera, but having knowledge of both will be really beneficial for
you. As we build a script, the first command that we're going to make
use of is the System.DirectoryServices.ActiveDirectory namespace,
specifically the GetCurrentDomain method.
This is going to go ahead and retrieve the domain
object for the currently logged on user.
This is what the command looks like.
I'll go ahead and paste this in PowerShell, and now I've got some
information about the domain. I have the name of the forest, the domain
controller, and where the PDC and RID role owners are. In this case, the
domain controller holds all of the roles.
Let's go ahead and expand onto this.
I have built a directory searcher script, and what this is going to
do is actually perform a search looking for user accounts within the
Active Directory domain. In this script, the domainObj variable will
store the entire domain object, the PDC variable will store the name
of the PDC, and the SearchString will build the provider path for the
output.
In order to make use of the DirectorySearcher class,
I have to specify a SearchRoot, which is the node in the Active
Directory hierarchy where it would search first. And then under the
Searcher.filter, I am using a samAccountType,
which is an attribute then all user, computer, and group objects have. Now you
can refer to some references on Microsoft's website, which will give you
examples about these same account types, but the one that I'm using here will
specifically enumerate all users in the domain.
So let's go ahead and run this in PowerShell. And as I hit Enter,
I now have details about all of the users in the domain, and I
can see some details about their properties.
But I can filter this so that it looks a lot more cleaner. To perform the
filter and to clean it up, I'm going to make use of a double loop, which
will print each property on its own line.
Now this PowerShell script will go and collect the users, and it will give
me the output with the attributes in a much cleaner way.
So let's go ahead and run the script. As I hit Enter, I now have all of
the information about the users printed out in a much cleaner way. Now as
you go ahead and enhance the script further,
you can obtain various results that can help you in your enumeration phase.
But like I said in the beginning of the video,
this is a lot of work that you need to go and build these scripts.
So now let's move on to the next video where we will start
focusing on a more easier approach in a sense of using a
tool which will do this for you.