Welcome to our lab environment.
As I mentioned,
I'm running the attacks from the Windows machine that are previous compromised.
To check if the machine is part of the domain, let's open the terminal.
Perfect, in here, as you can see, I can ping the domain controller.
Also, if I used the comment whoami,
I consider my user is part of the Globomantics domain.
And just to check more information about this user,
I can use the comment net user /domain and my username.
When I press Enter,
my Windows machine will create the domain for all
the information about this user.
As you can see,
I have here the full name and also the groups that they belong to.
It is important to note that I'm not administrating domain.
I'm just a regular user.
Also,
remember that I mentioned that we could mentally query the
domain for a lot of interesting information.
So, take a look.
For example, if I use the comment net user /domain,
it will require the domain controller for all the users in the domain.
And then, if you want to get more information about one specific user,
I can just type net user /domain and then the username that I want to query.
When I press Enter,
this will create a domain for all the information about the specific user.
And take a look.
This user here is a Hyper‑V administrator,
which is pretty interesting,
but acquiring the domain memory may take a lot of time,
so we need an automated solution, and for this reason,
we have the ADRecon.
So, let's start by visiting the ADRecon GitHub page.
In here, we can find tons of information about the two,
including a really detailed step by step on how to use the ADRecon,
as well as some other cool features.
One thing to note is that if you want a beautiful Excel report,
you need to have Microsoft Excel installed in the machine that you're using.
If you don't have, it is also fine.
The only difference is that all the data will be saved in CSV.
Perfect, now,
let's download the two by clicking this button and then clicking Download ZIP.
Perfect, now let me quickly extract this to my desktop.
Awesome!
As you can see, all the files are here.
We can now use the tool.
So, let's open the Windows terminal,
and then let's go to the ADRecon folder in my desktop.
Perfect, as you can see, in this folder,
I have one ps1 file, which is a PowerShell script.
So to run it, let's start PowerShell by typing powershell and pressing Enter.
Cool.
To use this tool, it's pretty simple.
All I have to do is execute the script by typing .\ and then ADRecon.ps1.
When I press Enter, the two will do a bunch of queries against the domain.
And after all the information is gathered,
you put together a really nice Excel report for us,
and you can see that happening in the background.
This process may take a few minutes, depending the size of your company,
but to not waste your time, I'm speeding up this video so we don't have to wait.
Awesome.
The script now is completed and says that the data was saving
to this Excel file on the ADRecon folder.
You can even see that a new folder was created in here.
And the interesting part is that I have an antivirus installed on this machine,
and nothing was detected.
So, let's check the report.
Let me open the ADRecon folder.
And here, you note that a new folder was created.
Inside of this folder, there's one Excel report and a CSV folder.
All the raw data is in the CSV folder, but for now, let's open the Excel report.
Awesome.
Take a look.
The report has a lot of tabs, and it's fairly well organized.
For example, from this main menu,
I can check the list of all the computers in the domain
by clicking the option Computers.
In here, you can see all the computers in the domain.
And for some of them, we can even see the operational system they are using,
and this can be pretty interesting.
For example, if you see a Windows XP machine,
you know that is a easy target to exploit.
Also, as you may have noted how the data is dividing tabs in the spreadsheet.
So let's take a look on the tab Users.
In here, I can see all the users in the domain,
and I can also see if the account is disabled and some other information.
Also, let's check the password policy for the domain.
For that, let's go to the Default Password Policy tab.
Take a look.
In here, I can see that the password has a minimum of nine characters,
and also, the Account lookout threshold is 0,
which means there is no account lockout,
meaning that we can try as many passwords as we want,
and the account will not be locked out.
So if you get the list of all the users in the domain from
the Users tab and if you build a password list based on
this nine character requirement,
we can run a password brute force attack or even a passwords pre‑attack.
Pretty cool, right?
Now, let's go to the Group Members tab.
In here, we can see all the groups and its members.
So, let's say you want to find out which users are administrators.
I'll use this Excel filter to select all the groups that are admin groups,
for example, the Domain Admins group and the Hyper‑V Admin group.
When I apply the filter,
I will see only the accounts that belongs to those admin groups.
For example, we just found out that this user,
Michael Doug, is a domain administrator,
and this can be really interesting.
Since we know that he has access to everything in the domain,
he could be our next target.
We can try to exploit his computer or simply try to get his password
using some other attacks such as phishing attacks.
And remember, all this information is also in the CSV files in the CSV folder.
Those files have all the raw information,
and you can import this data into other tools,
but personally,
I like to use the Excel spreadsheet since it's way easier to visualize
and search for the data that we are looking for.