{"id":8651,"date":"2021-06-02T17:39:20","date_gmt":"2021-06-02T15:39:20","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8651"},"modified":"2021-06-04T22:37:06","modified_gmt":"2021-06-04T20:37:06","slug":"pentest-windows-active-directory","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/governance-risk-and-compliance\/pentest-windows-active-directory\/","title":{"rendered":"Deep-dive into Windows Active Directory for Penetesters !"},"content":{"rendered":"

<\/p>\n

\nWhy this post?<\/h2>\n

The purpose of this guide is to view Active Directory from an attacker
\nperspective. I will try to review different aspects of Active Directory and
\nthose terms that every pentester should control in order to understand the
\nattacks that can be performed in a Active Directory network.<\/p>\n

In order to understand how to attack Active Directory (and any other
\ntechnology), I think is important to not only know the tools, but how the
\ntools work, what protocols\/mechanisms they use, and why these
\nmechanisms\/protocols exist.<\/p>\n

The information present here come from open sources and my own experience
\nwith Active Directory. However, I cannot be certain that everything stated here
\nis correct, so you are encourage to perform your own test and in case you found
\nany error, please let me know.<\/p>\n

Moreover, I know that not everything about Active Directory is covered here, but it
\nis my intention to cover at least the basic knowledge required to understand
\nActive Directory and their attacks, and expand this source in the future. So, if
\nyou feel that I miss something that a pentester should know related Active
\nDirectory, please let me know.<\/p>\n

Disclaimer: This is done for educational purposes, and you should only apply the
\nattacks described here to systems that you have permission for.<\/p>\n

I tried to explain the topics present here as well as I could. However, every
\ntopic is complex, so I put as many references to external resources as I could.
\nMy major intention is to collect all of the Active Directory topics in a single
\nplace<\/strong> that can be use to consult attacks\/protocols\/techniques, more than
\nexplain every single detail of an specific technique (even if I try to do it).
\nSo you are totally encourage to follow the hyperlinks to discover more about and
\nspecific topic, there are great resources out there.<\/p>\n

By the way, I would like to thank to all of the content creators<\/strong> that over the
\nyears have share knowledge with the community through tools, blogs, conference
\ntalks, etc. I have consult so many resources that it would be impossible for me
\nto thank all the content creators one by one, but if you found a link to one of
\nyour resources or a resource you have collaborated directly (by adding a
\nfeature to a tool, or helping your friend to write the post) or indirectly (for
\nexample creating a library\/snippet\/language\/OS\/IDE\/editor that is used by a
\ntool or a blog that is used as basis for a post linked here), thank you<\/strong>.<\/p>\n

Throughout the article I will user Powershell to show how to retrieve
\ninformation of Active Directory. For that purpose I will use the
\nActiveDirectory Powershell module<\/a>, but other tools like Powerview<\/a> or ldapsearch<\/a>
\ncan be used instead.<\/p><\/blockquote>\n

Now, let’s get to the point.<\/p>\n

\nWhat is Active Directory?<\/h2>\n

From my perspective, Active Directory is a system that allows to manage a set
\nof computers and users connected in the same network from a central server.<\/p>\n

Sure, this definition is far from being totally accurate, but I hope it is
\nsimple enough to give you an idea of what AD is.<\/p>\n

\n
       ____                         __ \n  o   |    |                       |==|\n \/|  |____| <--------.    .-----> |  |\n \/   \/::::\/          |    |       |__|\n                      v    v\n                       .---.\n                      \/   \/|\n                     .---. |\n                     |   | '\n                     |   |\/ \n                     '---'  \n       ____          ^    ^        ____ \n  o   |    |         |    |       |    |  o\/\n \/|  |____| <-------'    '-----> |____|   | \n \/   \/::::\/                      \/::::\/  \/ \n<\/pre>
\nActive Directory network
\n<\/figcaption><\/figure>\n
Imagine a company with hundreds of employees, where each one works in its own
\n(probably Windows) computer. This company has several different departments,
\nlike sales, human resources, IT, etc.<\/p>\n
Now imagine that the sales department requires a new program to be installed in
\ntheir workstations. Or that each day an user in a different office forgets its
\npassword and it needs to be restored. Or that the new group of interns are
\nonly required to work with a few documents of a file server.<\/p>\n
Should the IT team install the program in all the sales workstations, one by
\none? Should they go to the different offices and restore the user password?
\nShould they create a new user for each intern in the file server that allows
\nonly to see files in a directory?<\/p>\n
Well, they could do that, though I would be a lot of work (and a waste of money
\nfor the company). But since they are smart people, they have all the computers
\nconnected in an Active Directory network, so they can perform all these
\noperations from their workstation.<\/p>\n
Active Directory allows this by maintaining a centralized database where all the
\ninformation about users, computers, policies, permissions, etc, is stored. So,
\nfor example, the IT team can connect to this database and create the new users
\nfor the interns and assign permissions to them to be only allowed to read files
\nin the indicated directories of the specific servers of their departments.<\/p>\n
Then, when one of these interns tries to login to a computer inside the Active
\nDirectory network, the computer consults the central database in order to check
\nthat the intern user exists (and that the password is correct). This way, users
\ncan log on to any of the company computers (if they have permissions), by
\nallowing employees to use only a user to do all its work in all the company
\ncomputers (that can be workstations, database servers, file servers, etc).<\/p>\n
Likewise, in case a user forgets is password, she can alert to the IT team, and
\nthey can change the user password in this central database (and the user is
\nasked to change this password to a new one that only she knows).<\/p>\n
In the case of the sales department, the IT can create a new policy in the
\ndatabase which indicates that computers of that department must install the
\nindicated program, and how they must do it. Then, when sales workstation read
\nthe database, they will know that they must execute this policy and the new
\nprogram will be installed.<\/p>\n
I hope this example allows you to understand why Active Directory is so useful
\nand why almost any (medium-big) organization in the world uses it. Probably you
\nhave used it, normally from a computer that requires you to press Ctrl+Alt+Del
\nbefore prompts you for your username and password.<\/p>\n
And\u2026 what happens if someone can steal the password of an IT user? Could she
\nchange the other users passwords? And access to the database?<\/p>\n
Now that is clear why Active Directory is so important, let’s introduce their
\nitems.<\/p>\n
\nDomains<\/h2>\n
First of all, what we have been calling an Active Directory network is what is
\nusually known as a Domain<\/strong>. A domain is a set of connected computers that
\nshares an Active Directory database, which is managed by the central servers of
\na domain, that are called Domain Controllers<\/strong>.<\/p>\n
\nDomain name<\/h3>\n
Each domain has a DNS name. In many companies, the name of the
\ndomain is the same as their web site, for example contoso.com<\/code>, while others
\nhave a different internal domain such as contoso.local<\/code>.<\/p>\n
\n
PS C:Usersmahyar> $env:USERDNSDOMAIN\nCONTOSO.LOCAL\nPS C:Usersmahyar> (Get-ADDomain).DNSRoot\ncontoso.local<\/code><\/pre>
\nIdentify current user domain from Powershell
\n<\/figcaption><\/figure>\n
\n
PS C:Usersmahyar> (Get-WmiObject Win32_ComputerSystem).Domain\ncontoso.local<\/code><\/pre>
\nIdentify current computer domain from Powershell
\n<\/figcaption><\/figure>\n
In addition to its DNS name<\/strong>, every domain can also being identified with NetBIOS
\nname. For example, the domain contoso.local<\/code> could have the NetBIOS name<\/strong>
\nCONTOSO<\/code>. You can see the NetBIOS name being used in log in operations, where the
\nuser is identified with something like CONTOSOAdministrator<\/code>, where the first
\npart is the NetBIOS name and the second one is the username.<\/p>\n
Finally, a domain can be identified by an SID<\/strong> (Security Identifier). The SID is
\nmore used by programs (using the Windows API) than users, but you should know
\nhow to obtain in case you require it.<\/p>\n
\n
PS C:Usersmahyar> Get-ADDomain | select DNSRoot,NetBIOSName,DomainSID\nDNSRoot       NetBIOSName DomainSID\n-------       ----------- ---------\ncontoso.local CONTOSO     S-1-5-21-1372086773-2238746523-2939299801<\/code><\/pre>
\nGet DNS name, NetBIOS name and SID of domain
\n<\/figcaption><\/figure>\n
\nForests<\/h2>\n
Using a DNS name is very useful, since it allows to specific subdomains
\nbeing created for management purposes. For example, a company can have a root
\ndomain<\/strong> called contoso.local<\/code>, and then subdomains for different (usually big)
\ndepartments, like it.contoso.local<\/code> or sales.contoso.local<\/code>.<\/p>\n
Active Directory offers many ways to organize your infrastructure, as you will
\nnotice, so how an organization uses subdomains varies from one to another, some
\ncreate subdomains for departments, while others use them for different offices.<\/p><\/blockquote>\n
\n
              contoso.local\n                    |\n            .-------'--------.\n            |                |\n            |                |\n     it.contoso.local hr.contoso.local\n            | \n            |\n            |\n  webs.it.contoso.local\n<\/pre>
\ncontoso.local forest.
\n<\/figcaption><\/figure>\n
This tree of domains is known as Forest<\/strong><\/a>. The name of the forest is the same as
\nthe name of the root domain of the tree.<\/p>\n
\n
PS C:Usersmahyar> Get-ADForest\nApplicationPartitions : {DC=DomainDnsZones,DC=contoso,DC=local, DC=ForestDnsZones,DC=contoso,DC=local}\nCrossForestReferences : {}\nDomainNamingMaster    : dc01.contoso.local\nDomains               : {contoso.local}\nForestMode            : Windows2016Forest\nGlobalCatalogs        : {dc01.contoso.local, dc02.contoso.local}\nName                  : contoso.local\nPartitionsContainer   : CN=Partitions,CN=Configuration,DC=contoso,DC=local\nRootDomain            : contoso.local\nSchemaMaster          : dc01.contoso.local\nSites                 : {Default-First-Site-Name}\nSPNSuffixes           : {}\nUPNSuffixes           : {}<\/code><\/pre>
\nForest information with Get-ADForest
\n<\/figcaption><\/figure>\n
In a forest, each domain has its own database and its own Domain Controllers.
\nHowever, users of a domain in the forest can also access to the other domains<\/strong>
\nof the forest.<\/p>\n
This implies that, even if a domain can be autonomous, without the need to
\ninteract with other domains, it is not isolated from a security perspective. The
\nlogical structure that can provide security isolation is the forest.<\/p>\n
As I said before, each domain have its own Domain Controllers<\/strong>, so if a
\ndepartment grows incredibly, you may need dedicated Domain Controllers that
\nprocess the requests of all computers in that department. You can achieve that
\nby creating a new subdomain, and the users will still be able to access
\ncomputers in others subdomains of the same forest.<\/p>\n
\nFunctional Modes<\/h3>\n
As well as Windows computers, domains\/forest can also have their own “version”,
\nthat is called functional mode<\/a>. Depending on the mode of the domain\/forest, new
\ncharacteristics can be used.<\/p>\n
The modes are named based on the minimum Windows Server operative system required
\nto work with them. There are the following functional modes<\/a>:<\/p>\n