This article covers Active directory penetration testing that can help for penetration testers and security experts who want to secure their network.
“Active Directory” Called as “AD” is a directory service that Microsoft developed for the Windows domain network. Using it you can to control domain computers and services that are running on every node of your domain.
Active Directory Penetration Testing
In this section, we have some levels, the first level is reconnaissance your network. every user can enter a domain by having an account in the domain controller (DC).
All this information is just gathered by the user that is an AD user. In the
+ c: > net user
By running this command in CMD (Command Prompt) you can easily see local users on your PC.
+ c: >whoami
This command can help you to see the current user associated with Active Directory logged in.
+ c: >whoami /groups
This command helps you to show you the current group
+ c: > net user domain
This command shows you all users from any group in the active directory.
also, you can see every user’s group by running this command :
+ c: > net user [username] domain.
To have a better look, you can user “AD Recon” script. AD Recon is a script
You can download this script from GitHub: https://github.com/sense-of-security/ADRecon screenshots of the report of this app:
When you get all AD users, now you should take a look at the group policy. The group policy is a feature of Microsoft Windows NT family of operating systems that controls the working environment of user accounts and computer accounts. in the group policy, you can see environment policy such as”Account Lockout Policy“.
It is a
When you get all the
Brute Force Active Directory
To brute force attack on active directory, you can use Metasploit Framework auxiliaries. You can
msf > use auxiliary/scanner/smb/smb_login
The options of this auxiliary you can set username file and password file. and set an IP that has SMB service open.
then you can run this auxiliary by entering “run” command.
If you try false passwords more than Account Lockout Policy, you can see this message “Account Has Been Locked out“.
If you try it on all accounts, all users will
All hashes are stored in a file named “NTDS.dit” in this location :
You will extract hashes from this file by using
Then you can see hashes and password (if the
The active directory includes several services that run on Windows servers, it includes user groups, applications, printers, and other resources.
It helps server administrators to manage devices connected with the network and it includes a number of services such as Domain, Certificate Services, Lightweight Directory Services, Directory Federation and rights management.
Active directory penetration testing is required for any organization, nowaday APT groups actively targeting Active Directories using different techniques.
Source & Credits
The Article Prepared by Omid