Active Directory - Enumeration Using Legacy Windows Tools
Since we are starting in an assumed breach scenario
and we have credentials for stephanie,
we will use those credentials to authenticate to the domain
via a Windows 11 machine (CLIENT75).
We’ll use the Remote Desktop Protocol with xfreerdp
to connect to the client and log in to the domain.
We’ll supply the user name with /u,
the domain name with /d,
and enter the password.
AD contains so much information
that it can be hard to determine where to start enumerating.
But since every AD installation fundamentally contains users and groups,
we’ll start there.
To start gathering user information,
we will use net.exe,
which is installed by default on all Windows operating systems.
More specifically, we will use the net user sub-command.
While we can use this tool to enumerate local accounts on the machine,
we’ll instead use /domain to print out the users in the domain.
The output from this command will vary depending on the size of the organization.
Armed with a list of users,
we can now query information about individual users.
Administrators often have a tendency to add prefixes or suffixes
to usernames that identify accounts by their function.
Based on the output,
we should check out the jeffadmin user
because it might be an administrative account.
Let’s inspect the user with net.exe and the /domain flag:
According to the output,
jeffadmin is a part of the Domain Admins group,
which is something we should take note of.
If we manage to compromise this account,
we’ll essentially elevate ourselves to domain administrator.
We can also use net.exe to enumerate groups in the domain with net group:
The output includes a long list of groups in the domain.
Some of these are installed by default.
Others, are custom groups created by the administrator.
Let’s enumerate a custom group first.
We’ll again use net.exe to enumerate the group members,
this time focusing on the Sales Department group.
This reveals that pete and stephanie are members of the Sales Department group.
Although this doesn’t seem to reveal much,
each small piece of information
gained through enumeration is potentially valuable.
In a real-world assessment,
we might enumerate each group,
cataloging the results.
This will require good organization,
which we’ll discuss later,
but we’ll move on for now as we have more flexible alternatives to net.exe
to discuss in the next section.