Active Directory Exploitation Cheat Sheet

تحتوي ورقة الغش هذه على طرق التعداد والهجوم الشائعة لنظام Windows Active Directory.

ℹ️ تم إنشاء هذا المستودع بواسطة Nikos Katsiopis و Nikos Vourdas.

هذه ورقة الغش مستوحاة من مستودع PayloadAllTheThings.

Summary

• Active Directory Exploitation Cheat Sheet
  • Summary
  • Tools
  • Domain Enumeration
    • Using PowerView
    • Using AD Module
    • Using BloodHound
      • Remote BloodHound
      • On Site BloodHound
    • Using Adalanche
      • Remote adalanche
    • Export Enumerated Objects
    • Useful Enumeration Tools
  • Local Privilege Escalation
    • Useful Local Priv Esc Tools
  • Lateral Movement
    • Powershell Remoting
    • Remote Code Execution with PS Credentials
    • Import a PowerShell Module and Execute its Functions Remotely
    • Executing Remote Stateful commands
    • Mimikatz
    • Remote Desktop Protocol
    • URL File Attacks
    • Useful Tools
  • Domain Privilege Escalation
    • Kerberoast
    • ASREPRoast
    • Password Spray Attack
    • Force Set SPN
    • Abusing Shadow Copies
    • List and Decrypt Stored Credentials using Mimikatz
    • Unconstrained Delegation
    • Constrained Delegation
    • Resource Based Constrained Delegation
    • DNSAdmins Abuse
    • Abusing Active Directory-Integraded DNS
    • Abusing Backup Operators Group
    • Abusing Exchange
    • Weaponizing Printer Bug
    • Abusing ACLs
    • Abusing IPv6 with mitm6
    • SID History Abuse
    • Exploiting SharePoint
    • Zerologon
    • PrintNightmare
    • Active Directory Certificate Services
    • No PAC
  • Domain Persistence
    • Golden Ticket Attack
    • DCsync Attack
    • Silver Ticket Attack
    • Skeleton Key Attack
    • DSRM Abuse
    • Custom SSP
  • Cross Forest Attacks
    • Trust Tickets
    • Abuse MSSQL Servers
    • Breaking Forest Trusts

Tools

• Powersploit
• PowerUpSQL
• Powermad
• Impacket
• Mimikatz
• Rubeus -> النسخة المجمعة
• BloodHound
• AD Module
• ASREPRoast
• Adalanche

Domain Enumeration

Using PowerView

Powerview v.3.0
Powerview Wiki

• الحصول على النطاق الحالي: Get-Domain

• تعداد النطاقات الأخرى: Get-Domain -Domain <DomainName>

• الحصول على SID النطاق: Get-DomainSID

• الحصول على سياسة النطاق: ```powershell Get-DomainPolicy

  #Will show us the policy configurations of the Domain about system access or kerberos Get-DomainPolicy | Select-Object -ExpandProperty SystemAccess Get-DomainPolicy | Select-Object -ExpandProperty KerberosPolicy

• احصل على وحدات تحكم المجال: ```powershell Get-DomainController Get-DomainController -Domain

• سرد مستخدمي المجال: ```powershell #Save all Domain Users to a file Get-DomainUser | Out-File -FilePath .\DomainUsers.txt

  #Will return specific properties of a specific user Get-DomainUser -Identity [username] -Properties DisplayName, MemberOf | Format-List

  #Enumerate user logged on a machine Get-NetLoggedon -ComputerName

  #Enumerate Session Information for a machine Get-NetSession -ComputerName

  #Enumerate domain machines of the current/specified domain where specific users are logged into Find-DomainUserLocation -Domain | Select-Object UserName, SessionFromName

• تعداد أجهزة كمبيوتر المجال: ```powershell Get-DomainComputer -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName

  #Enumerate Live machines Get-DomainComputer -Ping -Properties OperatingSystem, Name, DnsHostName | Sort-Object -Property DnsHostName

• تعداد المجموعات وأعضاء المجموعات: ```powershell #Save all Domain Groups to a file: Get-DomainGroup | Out-File -FilePath .\DomainGroup.txt

  #Return members of Specific Group (eg. Domain Admins & Enterprise Admins) Get-DomainGroup -Identity '' | Select-Object -ExpandProperty Member Get-DomainGroupMember -Identity '' | Select-Object MemberDistinguishedName

  #Enumerate the local groups on the local (or remote) machine. Requires local admin rights on the remote machine Get-NetLocalGroup | Select-Object GroupName

  #Enumerates members of a specific local group on the local (or remote) machine. Also requires local admin rights on the remote machine Get-NetLocalGroupMember -GroupName Administrators | Select-Object MemberName, IsGroup, IsDomain

  #Return all GPOs in a domain that modify local group memberships through Restricted Groups or Group Policy Preferences Get-DomainGPOLocalGroup | Select-Object GPODisplayName, GroupName

• تعداد المشاركات: ```powershell #Enumerate Domain Shares Find-DomainShare

  #Enumerate Domain Shares the current user has access Find-DomainShare -CheckShareAccess

  #Enumerate "Interesting" Files on accessible shares Find-InterestingDomainShareFile -Include passwords

• تعداد سياسات المجموعة: ```powershell Get-DomainGPO -Properties DisplayName | Sort-Object -Property DisplayName

  #Enumerate all GPOs to a specific computer Get-DomainGPO -ComputerIdentity -Properties DisplayName | Sort-Object -Property DisplayName

  #Get users that are part of a Machine's local Admin group Get-DomainGPOComputerLocalGroupMapping -ComputerName

• تعداد OUs: ```powershell Get-DomainOU -Properties Name | Sort-Object -Property Name

• تعداد ACLs: ```powershell

  Returns the ACLs associated with the specified account

  Get-DomainObjectAcl -Identity -ResolveGUIDs