python3 -m pip install --user pipenv
git clone https://github.com/layer8secure/SilentHound.git
cd silenthound
pipenv install

python3 -m pip install -r requirements.txt
python3 silenthound.py -h

$ pipenv run python silenthound.py -h
usage: silenthound.py [-h] [-u USERNAME] [-p PASSWORD] [--hashes HASHES] [-o OUTPUT] [-g] [-n] [-k] [--kerberoast] [--ssl] TARGET domain

Enumere silenciosamente um ambiente do Active Directory.

positional arguments:
  TARGET                IP do Controlador de Domínio
  domain                Nome de domínio separado por ponto (.) incluindo ambos os contextos, ex.: ACME.com | HOME.local | htb.net

optional arguments:
  -h, --help            mostra esta mensagem de ajuda e sai
  -u USERNAME, --username USERNAME
                        Suporta BIND SIMPLES e NTLM. BIND SIMPLES use username ex.: bobdole | NTLM BIND use domínio\\usuário ex.: HOME.local\\bobdole
  -p PASSWORD, --password PASSWORD
                        Senha LDAP ou do Active Directory
  --hashes HASHES       Usa NTLM BIND para autenticar com hashes NT:LM
  -o OUTPUT, --output OUTPUT
                        Nome para os arquivos de saída. Cria arquivos de saída para hosts, usuários, administradores de domínio e descrições no diretório de trabalho atual.
  -g, --groups          Exibe nomes de grupos com membros de usuários.
  -n, --org-unit        Exibe Unidades Organizacionais.
  -k, --keywords        Pesquisa por uma lista de palavras-chave em objetos LDAP.
  --kerberoast          Identifica contas de usuário kerberoastable por seus SPNs.
  --ssl                 Usa um servidor LDAP seguro na porta padrão 636.  

$ pipenv run python silenthound.py -u 'svc_tgs' -p 'P@$$w0rd123' 10.10.10.100 active.htb -g -n -k --kerberoast


 _____ _ _            _   _    _                       _ 
/ ____(_) |          | | | |  | |                     | |
| (___  _| | ___ _ __ | |_| |__| | ___  _   _ _ __   __| |
\___ \| | |/ _ \ '_ \| __|  __  |/ _ \| | | | '_ \ / _` |
____) | | |  __/ | | | |_| |  | | (_) | |_| | | | | (_| |
|_____/|_|_|\___|_| |_|\__|_|  |_|\___/ \__,_|_| |_|\__,_|


  autor: Nick Swink também conhecido como c0rnbread

  empresa: Layer 8 Security <layer8security.com>
  
---------------------------------------------------------------------------

[-] Connecting with SIMPLE AUTH to LDAP server 10.10.10.100...
[*] Writing cached data to .active-htb.pickle...
[+] Hosts [1]
DC - 10.10.10.100


[+] Domain Admins [1]
CN=Administrator,CN=Users,DC=active,DC=htb


[+] Domain Users [4]
krbtgt
Guest
Administrator
[email protected]


[+] Descriptions [0]


[+] Group Memberships Found [11]
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
CN=Read-only Domain Controllers,CN=Users,DC=active,DC=htb
CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb
CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Cert Publishers,CN=Users,DC=active,DC=htb
CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Schema Admins,CN=Users,DC=active,DC=htb
CN=Domain Controllers,CN=Users,DC=active,DC=htb
CN=krbtgt,CN=Users,DC=active,DC=htb


CN=Windows Authorization Access Group,CN=Builtin,DC=active,DC=htb
CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC=active,DC=htb


CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=active,DC=htb
CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=active,DC=htb


CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb


CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb


CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb


CN=Schema Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb


CN=IIS_IUSRS,CN=Builtin,DC=active,DC=htb
CN=S-1-5-17,CN=ForeignSecurityPrincipals,DC=active,DC=htb


CN=Guests,CN=Builtin,DC=active,DC=htb
CN=Domain Guests,CN=Users,DC=active,DC=htb
CN=Guest,CN=Users,DC=active,DC=htb


CN=Users,CN=Builtin,DC=active,DC=htb
CN=Domain Users,CN=Users,DC=active,DC=htb
CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=active,DC=htb
CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC=active,DC=htb


CN=Administrators,CN=Builtin,DC=active,DC=htb
CN=Domain Admins,CN=Users,DC=active,DC=htb
CN=Enterprise Admins,CN=Users,DC=active,DC=htb
CN=Administrator,CN=Users,DC=active,DC=htb


[+] Organizational Units Found [1]
OU=Domain Controllers,DC=active,DC=htb


[+] Key Strings [18]
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
Denied RODC Password Replication Group
Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain
CN=Denied RODC Password Replication Group,CN=Users,DC=active,DC=htb
Denied RODC Password Replication Group
Denied RODC Password Replication Group
Allowed RODC Password Replication Group
Members in this group can have their passwords replicated to all read-only domain controllers in the domain
CN=Allowed RODC Password Replication Group,CN=Users,DC=active,DC=htb
Allowed RODC Password Replication Group



[+] Kerberoastable Users [1]
ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet  LastLogon  
--------------------  -------------  --------------------------------------------------------  ---------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18       2022-11-30 

-rw-r--r--  1 kali  kali   122 Jun 30 11:37 BASENAME-descriptions.txt
-rw-r--r--  1 kali  kali    60 Jun 30 11:37 BASENAME-domain_admins.txt
-rw-r--r--  1 kali  kali  2620 Jun 30 11:37 BASENAME-groups.txt
-rw-r--r--  1 kali  kali    89 Jun 30 11:37 BASENAME-hosts.txt
-rw-r--r--  1 kali  kali  1940 Jun 30 11:37 BASENAME-keywords.txt
-rw-r--r--  1 kali  kali    66 Jun 30 11:37 BASENAME-org.txt
-rw-r--r--  1 kali  kali   529 Jun 30 11:37 BASENAME-users.txt