layer8secure/silenthoundLDAP을 통해 Active Directory 도메인의 사용자, 관리자, 그룹 등을 조용히 열거합니다.
LDAP 파싱을 통해 Active Directory 도메인의 사용자, 관리자, 그룹 등을 조용히 열거합니다. Layer 8 Security의 Nick Swink가 제작했습니다.
python3 -m pip install --user pipenv
git clone https://github.com/layer8secure/SilentHound.git
cd silenthound
pipenv install
ℹ️ 이 방법은 프로젝트에 필요한 의존성을 갖춘 격리된 가상 환경을 생성합니다. 프로젝트를 사용하려면
pipenv shell로 가상 환경 셸을 열거나pipenv run으로 명령어를 직접 실행할 수 있습니다.
⚠️ 이 방법은 python-ldap으로 인해 많은 의존성 오류가 발생할 수 있으므로 권장되지 않습니다.
pip로 의존성 설치:
python3 -m pip install -r requirements.txt
python3 silenthound.py -h
$ pipenv run python silenthound.py -h
usage: silenthound.py [-h] [-u USERNAME] [-p PASSWORD] [--hashes HASHES] [-o OUTPUT] [-g] [-n] [-k] [--kerberoast] [--ssl] TARGET domain
Quietly enumerate an Active Directory environment.
positional arguments:
TARGET Domain Controller IP
domain Dot (.) separated Domain name including both contexts e.g. ACME.com | HOME.local | htb.net
optional arguments:
-h, --help show this help message and exit
-u USERNAME, --username USERNAME
Supports SIMPLE & NTLM BIND. SIMPLE BIND use username e.g. bobdole | NTLM BIND use domain\\user e.g. HOME.local\\bobdole
-p PASSWORD, --password PASSWORD
LDAP or Active Directory password
--hashes HASHES Uses NTLM BIND to authenticate with NT:LM hashes
-o OUTPUT, --output OUTPUT
Name for output files. Creates output files for hosts, users, domain admins, and descriptions in the current working directory.
-g, --groups Display Group names with user members.
-n, --org-unit Display Organizational Units.
-k, --keywords Search for a list of key words in LDAP objects.
--kerberoast Identify kerberoastable user accounts by their SPNs.
--ssl Use a secure LDAP server on default 636 port.
$ pipenv run python silenthound.py -u 'svc_tgs' -p 'P@$$w0rd123' 10.10.10.100 active.htb -g -n -k --kerberoast
_____ _ _ _ _ _ _
/ ____(_) | | | | | | | | |
| (___ _| | ___ _ __ | |_| |__| | ___ _ _ _ __ __| |
\___ \| | |/ _ \ '_ \| __| __ |/ _ \| | | | '_ \ / _` |
____) | | | __/ | | | |_| | | | (_) | |_| | | | | (_| |
|_____/|_|_|\___|_| |_|\__|_| |_|\___/ \__,_|_| |_|\__,_|
author: Nick Swink aka c0rnbread
company: Layer 8 Security <layer8security.com>
---------------------------------------------------------------------------
[-] Connecting with SIMPLE AUTH to LDAP server 10.10.10.100...
[*] Writing cached data to .active-htb.pickle...
[+] Hosts [1]
DC - 10.10.10.100
[+] Domain Admins [1]
CN=Administrator,CN=Users,DC=active,DC=htb
[+] Domain Users [4]
krbtgt
Guest
Administrator
[email protected]
[+] Descriptions [0]
[+] Group Memberships Found [11]
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
CN=Read-only Domain Controllers,CN=Users,DC=active,DC=htb
CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb
CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Cert Publishers,CN=Users,DC=active,DC=htb
CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Schema Admins,CN=Users,DC=active,DC=htb
CN=Domain Controllers,CN=Users,DC=active,DC=htb
CN=krbtgt,CN=Users,DC=active,DC=htb
CN=Windows Authorization Access Group,CN=Builtin,DC=active,DC=htb
CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=active,DC=htb
CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb
CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb
CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb
CN=Schema Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb
CN=IIS_IUSRS,CN=Builtin,DC=active,DC=htb
CN=S-1-5-17,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=Guests,CN=Builtin,DC=active,DC=htb
CN=Domain Guests,CN=Users,DC=active,DC=htb
CN=Guest,CN=Users,DC=active,DC=htb
CN=Users,CN=Builtin,DC=active,DC=htb
CN=Domain Users,CN=Users,DC=active,DC=htb
CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=Administrators,CN=Builtin,DC=active,DC=htb
CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb
[+] Organizational Units Found [1]
OU=Domain Controllers,DC=active,DC=htb
[+] Key Strings [18]
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
Denied RODC Password Replication Group
Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
Denied RODC Password Replication Group
Denied RODC Password Replication Group
Allowed RODC Password Replication Group
Members in this group can have their passwords replicated to all read-only domain controllers in the domain
CN=Allowed RODC Password Replication Group,CN=Users,DC=active,DC=htb
Allowed RODC Password Replication Group
[+] Kerberoastable Users [1]
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon
-------------------- ------------- -------------------------------------------------------- --------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 2022-11-30
빠르고 조용하게 Active Directory 환경을 열거하는 경량 도구입니다. 이 도구의 목표는 네트워크에서 가능한 한 적은 소음을 내면서 현황을 파악하는 것입니다. 이 도구는 파싱에 사용할 단일 LDAP 쿼리를 수행하며, 네트워크에서 추가 쿼리/소음을 방지하기 위해 캐시 파일을 생성합니다. 자격 증명이 전달되지 않으면 익명 BIND를 시도합니다.
-o 플래그를 사용하면 일반적으로 stdout에 출력되는 각 섹션에 대한 출력 파일이 생성됩니다. 모든 플래그를 사용하여 생성되는 파일은 다음과 같습니다:
-rw-r--r-- 1 kali kali 122 Jun 30 11:37 BASENAME-descriptions.txt
-rw-r--r-- 1 kali kali 60 Jun 30 11:37 BASENAME-domain_admins.txt
-rw-r--r-- 1 kali kali 2620 Jun 30 11:37 BASENAME-groups.txt
-rw-r--r-- 1 kali kali 89 Jun 30 11:37 BASENAME-hosts.txt
-rw-r--r-- 1 kali kali 1940 Jun 30 11:37 BASENAME-keywords.txt
-rw-r--r-- 1 kali kali 66 Jun 30 11:37 BASENAME-org.txt
-rw-r--r-- 1 kali kali 529 Jun 30 11:37 BASENAME-users.txt
✅ ntlm 해시 인증 지원
추가 기능 요청이 있으시면 이슈를 제출하고 enhancement 태그를 추가해 주세요.