So now that we've used Portscan to look for open ports,
let's go ahead and look for any type of shares that currently
exist in the domain. PowerSploit allows you to easily find
shares that exist in the domain.
The command that we're going to use here is Invoke‑ShareFinder, and I'm
going to go and pipe this output so that I only see the name of the share
and the Computername which the share resides on.
So I'll go ahead and run this and give it a couple of
minutes so that we get some results back.
Remember that when you run this in a live environment,
depending on the size of the environment,
it could take some time for you to get the results
back. As the results come back,
I can see all of the shares that currently exist on this domain.
Now looking at the Admin‑PC in my results,
there are a couple of default shares, but there's also a
normal share which is called Domain Tools.
Now I can use PowerSploit to actually check if I've got access to
that share by making use of another command.
The command that I can use is Find‑DomainShare, followed by the computername,
and then using the checkaccess switch. I could also use this command without any
switches to go out and find all the domain shares.
It'll give me a result similar to the Invoke‑ShareFinder.
So I'm going to go ahead and hit Enter, and let's see if we've got
access to any of the shares on the Admin‑PC.
So looking at the results,
I can see that this current user has access to the Domain
Tools share that exists on the Admin‑PC.
Using this information,
I can use some additional tools to perform SMB enumeration or even
making use of an SMB exploit on their target machine.
So moving on, let's talk about weak permissions.
PowerSploit offers another valuable way that you can use to
find weak permissions within Active Directory.
Now you may know that Active Directory's permissions can be very,
very complex, and sometimes it can be really confusing.
There are also tons of access control lists that exist within Active
Directory, a lot of them having default permissions,
which are actually bad because you need to go and secure them as a
good security administrator. As a pen tester, you need to check
these permissions and access controllers because sometimes
administrators might miss the defaults and leave them open where you
can actually make use of it.
PowerSploit provides you with a great tool that you can
use to discover these access control lists, and that is
the Invoke‑ACLScanner command.
This command works by looking for the easiest permissions that you can
use to exploit by filtering out the permissions where the set of the
user or group have resource IDs above 1000.
It also looks for any rights granted that can provide
modify access to the targeted object.
So I'm going to go ahead and run this, and what it will do is it'll actually
give me a list of all the different ACLs with weak permissions.
Keep in mind that it might take a minute or so to actually run because it's
actually enumerating all of this under domain controller.
So looking at the results that have been returned,
there are a number of access control lists that have the
standard out‑of‑the‑box permissions.
Looking at the rights that they have,
we can see that these are pretty extensive and we
can leverage it for exploitation.
So now let's move on to privilege escalation, and let's see how we can
make use of PowerSploit to escalate our privileges.