StandIn

StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation. However, StandIn quickly ballooned to include a number of comfort features.

I want to continue developing StandIn to teach myself more about Directory Services programming and to hopefully expand a tool which fits in to the AD post-exploitation toolchain.

Roadmap

Contributing

Contributions are most welcome. Please ensure pull requests include the following items: description of the functionality, brief technical explanation and sample output.

Do you have something you want to see added to StandIn but don't have a PR? Please open a ticket and describe the functionality as best as possible.

ToDo's

The following items are currently on the radar for implementation in subsequent versions of StandIn.

• Domain share enumeration. This can be split out into two parts, (1) finding and getting a unique list based on user home directories / script paths / profile paths and (2) querying fTDfs / msDFS-Linkv2 objects.
• Finding and parsing GPO's to map users to host local groups.
• GPO -> OU & OU -> GPO.
• Rewrite policy function probably.
• Adding optional JSON/XML output for some functions to help with scripting.
• Code needs a re-factor, better modularized functions and split out into different classes.

Subject References

• An ACE up the sleeve (by @_wald0 & @harmj0y) - here
• Kerberoasting (by @xpn) - here
• Roasting AS-REPs (by @harmj0y) - here
• Kerberos Unconstrained Delegation (by @spotheplanet) - here
• S4U2Pwnage (by @harmj0y) - here
• Resource-based Constrained Delegation (by @spotheplanet) - here
• Rubeus - here
• Powerview - here
• Powermad (by @kevin_robertson) - here
• SharpGPOAbuse (by @den_n1s & @pkb1s) - here
• adidnsdump (by @_dirkjan) - here
• Certified Pre-Owned (by @harmj0y & @tifkin_) - here

Index

• Help
• LDAP Object Operations
  • Raw LDAP
  • Get object
  • Get object access permissions
  • Grant object access permission
  • Set object password
  • Add ASREP to object flags
  • Remove ASREP from object flags
• SID
• ASREP
• PASSWD_NOTREQD
• SPN
  • SPN Collection
  • Set SPN
• Unconstrained / constrained / resource-based constrained delegation
• DC's
• Trust
• GPO Operations
  • List GPO's
  • GPO add local admin
  • GPO add user privilege
  • GPO add immediate task
  • GPO increase User / Computer version
• Policy
• DNS
• Groups Operations
  • List group membership
  • Add / remove user from group
• Machine Object Operations
  • Create machine object
  • Disable machine object
  • Delete machine object
  • Add msDS-AllowedToActOnBehalfOfOtherIdentity
  • Remove msDS-AllowedToActOnBehalfOfOtherIdentity
• Active Directory Certificate Services (ADCS)
  • List
  • Client Authentication
  • ENROLLEE_SUPPLIES_SUBJECT
  • PEND_ALL_REQUESTS
  • Change Owner
  • Add Write Permission
  • Add Certificate-Enrollment Permission
• Detection
• Special Thanks

Help

  __
 ( _/_   _//   ~b33f
__)/(//)(/(/)  v1.4


 >--~~--> Args? <--~~--<