{"id":8713,"date":"2021-09-05T01:11:31","date_gmt":"2021-09-04T23:11:31","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8713"},"modified":"2021-09-19T03:57:10","modified_gmt":"2021-09-19T01:57:10","slug":"check-if-your-active-direcotry-passwords-are-compromised-in-a-data-breach","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/check-if-your-active-direcotry-passwords-are-compromised-in-a-data-breach\/","title":{"rendered":"Check if your Active Directory passwords are compromised in a data breach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To compare Active Directory accounts against breached passwords you need access to your Active Directory with a specific privileged account, a password list with NTLM hashes and some PowerShell commands.<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">But why should you do this?<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Password hashes of Domain accounts can be dumped locally from SAM, memory, remotely and as well just with Windows built-in features (memory dump).<\/li><li>Users with well known passwords (compromised passwords) are extremely easy to \u201crecover\u201d by using password lists<\/li><li>Therefore the passwords of these accounts must be changed to reduce the risk of getting easily \u201chacked\u201d.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Password list<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As the download of the password list could take a while, start downloading the latest version from:&nbsp;<a rel=\"noreferrer noopener\" href=\"https:\/\/haveibeenpwned.com\/Passwords\" target=\"_blank\">https:\/\/haveibeenpwned.com\/Passwords<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure to download the NTLM password list (version 4 or newer).<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image-1024x100.png\" alt=\"\" class=\"wp-image-8716\" width=\"657\" height=\"64\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image-1024x100.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image-300x29.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image-768x75.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image-1536x151.png 1536w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/09\/image.png 1886w\" sizes=\"auto, (max-width: 657px) 100vw, 657px\" \/><figcaption>NTLM PWNED Passwords<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">When finished, extract the file: I\u2019m using C:\\temp\\pwned-passwords.txt as target.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Export password hashes from AD<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You do not have to be a member of the Domain Admins, Enterprise Admins or the Administrators group, but you need the \u201c<a href=\"https:\/\/support.microsoft.com\/de-ch\/help\/303972\/how-to-grant-the-replicating-directory-changes-permission-for-the-micr\" target=\"_blank\" rel=\"noreferrer noopener\">Replicating Directory Changes All<\/a>\u201d permission on Domain level.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install PS Module<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now launch PowerShell and run:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Install-Module -Name DSInternals<\/p><cite>More info about module:&nbsp;<a href=\"https:\/\/www.powershellgallery.com\/packages\/DSInternals\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.powershellgallery.com\/packages\/DSInternals\/<\/a><\/cite><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Set credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now you have to run another command in PowerShell, then enter the credentials which are delegated on Domain level with ReplDir permissions:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>$mycredentials = Get-Credential<\/p><cite>Enter credentials<\/cite><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Export users and password hashes of all users to file<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command within PowerShell to \u201cpull\u201d all account information from the Domain Controller of your choice. When finished, the hashes are saved in the file c:\\temp\\hashes.txt<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Get-ADReplAccount -all -NamingContext \u201cDC=Domain,DC=local\u201d -Server Domaincontroller.domain.local -Credential $mycredentials | Format-Custom -View HashcatNT | Out-File c:\\temp\\hashes.txt -Encoding ASCII<\/p><cite>Make sure to change<span class=\"has-inline-color has-vivid-red-color\"> Domain name and Domain Controller<\/span>!<\/cite><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Compare it\u2026<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Download PowerShell script from&nbsp;<a href=\"https:\/\/github.com\/DGG-IT\/Match-ADHashes\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/DGG-IT\/Match-ADHashes\/<\/a>&nbsp;and save the file to c:\\temp\\<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Load function and compare hashes<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command to load the function:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>.\\Match-ADHashes.ps1<\/p><cite>Make sure you run it from c:\\temp<\/cite><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Start comparison:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>$list = Match-ADHashes -ADNTHashes C:\\temp\\hashes.txt -HashDictionary C:\\temp\\pwned-passwords.txt<\/p><cite>save result to a list<\/cite><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Export into CSV<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Write output to a CSV file:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>$list | select Hash,Frequency,@{Name=\u2019user\u2019;Expression={[string]::join(\u201c;\u201d, ($_.user))}} | Export-Csv -Path c:\\temp\\report.csv -Delimiter \u2018;\u2019 -NoTypeInformation<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Result<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open the CSV and make sure to remediate all accounts. Set priority on privileged accounts. These must be changed immediately!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To compare Active Directory accounts against breached passwords you need access to your Active Directory with a specific privileged account, a password list with NTLM hashes [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8719,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224,226,230,232],"tags":[125,239,179,258,230,169,190],"class_list":["post-8713","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dfir-and-incident-response","category-identity-and-active-directory","category-penetration-testing","category-powershell-and-automation","tag-active-directory","tag-backup-and-recovery","tag-dfir","tag-ntlm","tag-penetration-testing","tag-powershell"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8713"}],"version-history":[{"count":6,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8713\/revisions"}],"predecessor-version":[{"id":8755,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8713\/revisions\/8755"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8719"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}