Recupera la descrizione degli account AD e cerca una password al suo interno
Lo scopo di questo strumento è verificare se le password sono memorizzate in chiaro nella descrizione degli account di Active Directory.
I requisiti sono :
Se non hai Python, puoi usare la versione .exe degli script nella cartella binary di questo repository.
Vuoi verificare se le password sono memorizzate nel campo descrizione degli account di Active Directory della tua organizzazione.
Post-exploitation: hai effettuato con successo il dump del file ntds.dit e dell'hive SYSTEM e, mentre stai craccando gli hash, vuoi verificare se alcune password in chiaro sono disponibili nel campo descrizione degli account di Active Directory.
Installa i requisiti
$ git clone https://github.com/AssuranceMaladieSec/AD-description-password-finder.git
$ pip3 install -r requirements.txt
> python check_description.py -h
usage: check_description.py [-h] [-system SYSTEM] [-ntds NTDS] [-ts] [-debug]
optional arguments:
-h, --help show this help message and exit
-system SYSTEM SYSTEM hive to parse. MANDATORY
-ntds NTDS NTDS.DIT file to parse. MANDATORY
-ts Adds timestamp to every logging output during hashes extraction
-debug Turn DEBUG output ON during hashes extraction
> python check_description.py -ntds ntds\ntds.dit -system ntds\SYSTEM
Extracting hash and descriptions in the ntds
Saving output to ntds/output.ntds
Creating hash file in './output/description_hashes.json' and plain text file in './output/description_plain.json'
Done!
Loading ./output/description_hashes.json
Loading ./output/description_plain.json
Loading ./ntds/output.ntds
We have 9 user's descriptions to analyze
Done!
We found 4 CONFIRMED password in the accounts description
2 accounts are SUSPECTED of exposing their passwords and need to be verified by a HUMAN
You can find the results in the file ./results/2022-07-21_17h8_results.txt
That's all folks!
CONFIRMED_LEAK - Disabled user - password for user adm-test-alice2 found in description: Achanger6Achanger6!
CONFIRMED_LEAK - Enabled (probably) user - password for user adm-test-alice found in description: Achanger1Achanger2!
SUSPECTED_LEAK - Enabled (probably) user - SUSPECTED password for user anakin in the description: here we go "pwd=test01!"
SUSPECTED_LEAK - Enabled (probably) user - SUSPECTED password for user ahsoka in the description: The new one for test (password=test054!)
CONFIRMED_LEAK - Enabled (probably) user - password for user mariatest02 found in description: test02!
CONFIRMED_LEAK - Enabled (probably) user - password for user blanqui found in description: woof01!
Questo strumento utilizza una versione modificata del codice di secretdump dalla libreria Impacket.
Impacket è uno strumento di SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. Tutti i diritti riservati.
GNU GENERAL PUBLIC LICENSE (GPL) Version 3