AD Enumeration with PowerView
So far we have only scratched the surface of Active Directory enumeration
by mostly focusing on users and groups.
While the tools we have used so far have given us a good start
and an understanding of how we can communicate with AD and obtain information
other researchers have created more elaborate tools for the same purpose.
One popular option is the PowerView PowerShell script,
which includes many functions to improve the effectiveness of our enumeration.
As a way of introducing PowerView, let’s walk through parts
of our enumeration steps from the previous section.
PowerView is already installed in the C:\Tools folder on CLIENT75.
To use it, we’ll first import it to memory:
With PowerView imported,
we can start exploring various commands that are available.
For a list of available commands in PowerView,
please refer to the linked reference.
Let’s start by running Get-NetDomain,
to retrieve basic information about the domain,
which we used GetCurrentDomain for previously:
Much like the script we created earlier,
PowerView is also using .NET classes to obtain the required LDAP path
and uses it to communicate with AD.
Now let’s get a list of all users in the domain with Get-NetUser:
Get-NetUser automatically enumerates all attributes on the user objects.
This presents a lot of information, which can be difficult to digest.
In the script we created earlier,
we used loops to print certain attributes based on the information obtained.
However, with PowerView we can simply pipe the output into select,
where we can choose the attributes we are interested in.
The current output reveals that
the cn attribute holds the username of the user.
Let’s pipe the output into select and choose the cn attribute:
This produced a cleaned-up list of users in the domain.
When enumerating AD, there are many interesting attributes to search for.
For example, if a user is dormant,
they have not changed their password or logged in recently,
we will cause less interference and draw less attention
if we take over that account during the engagement.
In addition, if a user hasn’t changed their password
since a recent password policy change,
their password may be weaker than the current policy.
This might make it more vulnerable to password attacks.
This is something we can easily investigate.
Let’s run Get-NetUser again,
this time piping the output into select and extracting these attributes.
We now have a nice list which shows us
when the users last changed their password,
as well as when they last logged in to the domain.
Similarly, we can use Get-NetGroup to enumerate groups:
Enumerating specific groups with PowerView is easy.
Although we will not go through the process of unraveling
nested groups in this case,
let’s investigate the Sales Department using Get-NetGroup
and pipe the output into select member:
Now that we have essentially recreated the functionality of our previous script,
we’re ready to explore more attributes and enumeration techniques.