1 - Manual Enumeration

Low Hanging Fruits

List local and domain users 

net user
net user /domain

Basically /domain queries the DC while w/o it queries the local machine

Check specific user:

net user jeffadmin
net user jeffadmin /domain

List local and domain groups:

net localgroup
net group /domain

Check specifc group:

net localgroup "Sales Department"
net group "Sales Department" /domain

Bypass Script Execution Policy Scope

Set-ExecutionPolicy Bypass -Scope Process

Powerview

Download here => https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

Import module:

Get domain information:

Get all users:

Get all groups:

Get group members:

Get computers joined to the domain:

List domain joined computers where we have local admin access

List users connected to a specific machine:

Services Instances (SPNs)

SPN is a unique identifier for Kerberos that links a service account (unique) to a service instance (0,1 or more. E.g. a IIS webserver running on SERVER01)

List all SPNs for IIS

We can see a webserver running on the web04 machine.

List all SPN for all service accounts (requires powerview)

Get the IP of the machine the service instance is running on:

Objects ACL

What to look for:

Check our own user object ACL:

One ACL returned:

  • ActiveDirectoryRights: ReadProperty means a security principal has read access to our user object

  • SecurityIdentifier is the SID of the security principal that has the read permission on our object

We can translate the SID to something readable like that:

To get the ACL of a file for example:

List all security principa' SIDs that have full permission on the group specified:

We can bulk translate the SIDs to readable names:

Domain Shares

We find domain shares with Powerview:

This will return machine names and share names:

This is how we list the content of a share (we can cat, cd...):

PreviousHacking ADNext2 - Sharphound + BloodHound

Last updated