Hey there, welcome to Pluralsight.
In this course,
you'll learn how to gather valuable information from your
target Active Directory using the ADRecon tool.
But you may be wondering,
why is the information in Active Directory so
important for a red team engagement.
Well, the AD is the central source of information for an IT department.
A lot of information is stored in there.
What most people don't know is that any user in the domain can
request tons of valuable information from the AD,
such as the list of all users in the company,
the list of all the admins, the list of all computers,
server security policies, and even some Kerberos tickets.
And again, any user can request information.
You don't need to be a domain admin for that. Now, imagine what
a hacker could do with all this information.
For example, having the list of all the users and the password policy,
an attacker can start a password spray attack, and this attack
consists of looking at the password policy and creating a list
of our most probable passwords.
And then, since we have a list of all the users in the domain,
we can test those most probable passwords against all the
users to see if we can get any credentials.
Pretty cool, right?
Also, imagine the attacker gets access to the list
of administrators in the company.
Then the attacker could use this list to perform some target phishing attacks.
And not only that, if an attacker gets access to the Kerberos service tickets,
he can perform a very common attack called Kerberoasting, which
would give the attacker the credentials for the service accounts in
the domain. Now you can imagine why gathering information from
Active Directory is so important.
Although all those information requests can be done manually,
the best way of gathering information from your Active Directory is
using the ADRecon tool, which automates the data collection and put
it in a really nice format for us.
The ADRecon tool was developed by Prashant Mahajan, and thanks to
him, our job as a red team specialist is way easier.
If you're interested in offensive security,
you should check his Twitter and his other tools.
The formal definition of the ADRecon is that it's a tool that
gathers information about the Active Directory and generates a
report of the current state of your AD.
This tool was actually developed for IT admins so they can
get statistics about the environment.
However,
since it contains a lot of valuable information, a lot of red team specialists
use this tool to get sensitive information from the domain.
What I love about this tool is that it's an open
source tool under the GNU version 3.0,
which means that you can download it and edit the source code to customize
the tool. You can download the ADRecon from this GitHub.
Also, if your client has Azure Active Directory,
you can find the ADRecon for Azure on this GitHub. It is
basically the same tool, but instead of extracting
information from local Activity Directory,
it extracts the data from the Active Directory on the Azure cloud.
Another thing that I love about this tool is that
because it is widely used by IT admins,
most of the anti‑virus solutions do not flag this as malicious.
Of course,
you should always test this tool in your own lab to make sure that the
anti‑virus of your client will not detect this, but from my experience, most of
the time you can use this tool without being detected.
Also, as I mentioned at the beginning of this course,
you don't need the admin privilege to run this tool, so even if you
have just a low privilege account this will work.
Also this tool provides you with a lot of interesting
information such as user accounts, service accounts,
security policies, computers, and much more.
In our demos,
you see that you can get a really complete report about the Active Directory.
If you're familiar with the red team kill chain, it can map the
ADRecon tool right after the exploitation phase.
And this means that to use the ADRecon,
you do need credentials of one user in the domain and also
access to a Windows machine on the network,
which you may have done by exploiting _____ or even
phishing some credentials via email.
Once you're in the network,
you can use ADRecon to get information about the environment and use this
information to escalate privileges and move laterally.
The idea is that with ADRecon you're able to extract crucial
information from the Active Directory,
and this will allow you to get access to another user
account or even service account.
If we map the techniques that we learned in this
course to the MITRE ATT&CK framework,
you see that in here we focus on three main areas,
which are discovery, collection, and credential access.
Inside of discovery, we covered three main techniques.
The T1201, which is password policy discovery,
in which we are able to get information about the password
policy for the company, so then we can run advanced attacks
such as password spraying.
Also,
we covered the T1069, which is permission group discovery. And also
we covered the T1087, which is account discovery,
which will provide us with a list of all the accounts in the domain.
Although ADRecon is mostly a discovery tool, it can also be used for
attacks in the credential access and collection areas.
For example, with the ADRecon we can steal or forge Kerberos tickets,
which is the technique T1558 in the MITRE ATT&CK framework. And more specific,
we covered a sub‑technique called Kerberoasting. Also, with ADRecon we can
collect a lot of data from the Active Directory,
which is described on the technique T1213.
As you can see, with ADRecon we can perform several
techniques with just one tool.
But before getting to the technical part of this course, I want you to
keep in mind that performing this attack without authorization is illegal
in most of the countries, and this means that if you use this attack in a
company without their authorization, you may go to jail,
especially for the Kerberoasting attack, so it is really important to
stay legal. First, if you're working a red team project,
make sure you have a letter of engagement from the client
detailing the dates and the tasks that will be executed, as
well as the types of attacks and scope.
Also,
it is really important to have a formal document signed by the client
detailing and authorizing the attacks that you'll be performing.
And this is the document that differentiates a criminal from
a professional red team specialist. And,
as a personal recommendation,
always consult the client before executing any
attack that may impact the network.
So, bottom line,
don't be a criminal. Before we go to our demo, let's have a
quick recap on how this attack works.
Let's say you're working on a red team engagement in a
specific client. In the beginning of the engagement, using
malware in a phishing email, you're able to get access to someone's laptop,
and this means that now you have remote access to their Windows
machine and their machine is in the domain.
So then, you download the ADRecon tool on that machine or you
simply run it from memory using PowerShell.
Then with ADRecon you'll be able to query the Active Directory,
which you would then return as a detailed report
with a lot of useful information.
Then we can extract this information to our attacking machine, and then use
this data to plan another attack such as password sprays or the Kerberoasting
attack. Even though this looks like a really simple attack, you've seen our
demos how effective this attack is.
If you want to get the most out of this course,
I do recommend you creating a small lab environment so you can practice this
attack. In here, I'm using a simple Windows 2016 domain,
which includes a Windows 2016 domain controller and a Windows workstation.
Or, in other words, all you need is a laptop connected to a domain.
In addition to this,
I'll use a Kali Linux virtual machine as my attacker machine. And
this machine is totally optional, but I will use this Kali Linux to
remote desktop into the Windows machines.
So, enough with talking,
let's go to our demo and see how to harvest information from the Active
Directory, and how to use this information in some attacks.