Zilbon

AD Checklist

 
  • Mar 14, 2023

AD checklist

Enumeration

Network and service discovery
a. Network mapping (Bloodhound)
  - Reachable High value targets
  - High value groups
  - RDP on machines
  - GPO
b. Identifying domain controllers
c. Start responder to capture hash
d. Finding Exposed Services 
    - LDAP
    - SMB
    - Kerberos
    - MSSQL
e. Check if additional interfaces are present on the domain controller (Possible to check with crackmapexec ioxidresolver)

Collecting Active Directory Information
a. Users, groups and members
b. Password policies
c. Network shares and permissions
d. ACLs and permissions
e. Configuring Services and Applications

Recognition of potential vulnerabilities
a. Updating systems and software
b. Analysis of default configurations
c. Search for known vulnerabilities(CVEs)
d. Weak authentication tests

Exploitation

Exploitation of identified vulnerabilities
a. Brute force attacks
b. Using public or custom exploits
c. Injection of scripts or commands
d. Pass-the-hash or pass-the-ticket attacks

Access to sensitive resources
a. Access to read SMB shares on domain controllers
b. Reading configuration files and logs
c. Extraction of sensitive data
    - hashes
    - tickets
    - keys
    - etc

Scanning for Active Directory specific vulnerabilities
a. NoPac Vulnerability
b. Vulnerability PetitPotam
c. Kerberroasting attacks
d. Exploitation of gold and silver tickets
e. "DCSync" and "DCShadow" type attacks

Escalation of privileges

Escalation of local privileges
a. Exploitation of operating system vulnerabilities
b. Abuse of features or services
    - MSSQL
c. Manipulation of tokens and privileges

Privilege escalation within Active Directory
a. Adding a user to privileged groups (ex: Domain Admins)
b. Changing access rights and permissions
c. Creating new accounts with elevated privileges

Maintaining and Concealing Access
a. Creation of backdoors and hidden accounts
b. Use of persistence techniques
  - Task Scheduler
  - Startup Folder
  - Registry AutoRun
c. Erasing traces and logs

Tools and command useful during an Active Directory pentest

  • Find the ip(s) of the domain controller(s) 
    nslookup -type=SRV _ldap_.tcp.dc._msdcs.YOUR_DOMAIN
  • Responder 
    tmux new -s responder

    responder -I eth0

    CTRL + b d
  • Bloodhound 
    bloodhound-python -u 'USER' -p 'PASSWORD' -d 'DOMAIN' -c All -ns IP
  • ldapsearch 
    ldapsearch -x -h YOUR_IP -s base 

    ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" +
  • enum4linux 
    enum4linux -a -dc-ip IP

    enum4linux -U IP | grep 'user:'
  • crackmapexec 
    crackmapexec smb <ip> -u 'user' -p 'password'

    crackmapexec smb <ip> -u 'user' -p 'password' --shares

    crackmapexec smb <ip> -u 'user' -p 'pass' -M nopac

    crackmapexec smb <ip> -u '' -p '' -M petitpotam

    crackmapexec smb <ip> -u '' -p '' -M zerologon

    crackmapexec smb <ip> -u '' -p '' -M ioxidresolver
Search