Enumerating Active Directory

Turn a single foothold into a full map of users, groups, and attack paths.

20 minactive-directoryenumerationbloodhound

What you will learn

-Query AD over LDAP from a low-privilege foothold
-Collect graph data with BloodHound and read the results
-Prioritize the highest-value targets from enumeration output

You have a foothold: one set of valid or a on a domain-joined box. Before you attack anything, you map the terrain. is where engagements are won, because you cannot a path you never saw.

LDAP is the query language of AD

AD exposes its database over . With any valid domain account, even an unprivileged one, you can read most of the . That is by design and it is a gift to the attacker.

attacker@kali

# list every user account in the domain

$ldapsearch -x -H ldap://10.10.10.5 -D 'jdoe@corp.local' -w Passw0rd -b 'DC=corp,DC=local' '(objectClass=user)' sAMAccountName

# accounts with an SPN: kerberoasting candidates

$ldapsearch -x -H ldap://10.10.10.5 -D 'jdoe@corp.local' -w Passw0rd -b 'DC=corp,DC=local' '(&(objectClass=user)(servicePrincipalName=*))'

The -b flag sets the search base, the distinguished name of the domain. The filter in parentheses is what you are asking for. Learn to read a distinguished name like CN=Admin,OU=IT,DC=corp,DC=local from right to left: domain, then OU, then object.

BloodHound draws the graph for you

Reading raw LDAP is slow. collects the same data and renders it as an attack graph, so you can ask "who can reach Domain Admin from here" and a literal path. A collector gathers the data, then you import it into the GUI.

attacker@kali

# Python collector: pull users, groups, sessions, ACLs

$bloodhound-python -u jdoe -p Passw0rd -d corp.local -ns 10.10.10.5 -c All

# quick cross-check of the user list over SMB

$netexec smb 10.10.10.5 -u jdoe -p Passw0rd --users

Drop that zip into the BloodHound GUI and run the built-in query Shortest Paths to Domain Admins. Each is a principal, each edge is a right one node holds over another. Your job is to walk the edges.

Mark your foothold as owned

In BloodHound, right-click the account you already and choose "Mark as Owned." Then the "Shortest Paths from Owned" query shows exactly what your current access can reach, which is far more useful than a generic map.

Read the output like a hunter

From a fresh collection, in this order:

Kerberoastable users: accounts with an SPN, especially in high-value groups.
AS-REP roastable users: accounts that do not require pre-auth.
Dangerous ACLs: GenericAll, WriteDACL, or ForceChangePassword over a privileged object.
Active sessions: where do admins have live logons you could hijack.

What privilege level do you need to read most of the AD directory over LDAP?

Active Directory Fundamentals Kerberos and Kerberoasting

LDAP is the query language of AD

AD exposes its database over . With any valid domain account, even an unprivileged one, you can read most of the . That is by design and it is a gift to the attacker.

attacker@kali

# list every user account in the domain

$ldapsearch -x -H ldap://10.10.10.5 -D 'jdoe@corp.local' -w Passw0rd -b 'DC=corp,DC=local' '(objectClass=user)' sAMAccountName

# accounts with an SPN: kerberoasting candidates

$ldapsearch -x -H ldap://10.10.10.5 -D 'jdoe@corp.local' -w Passw0rd -b 'DC=corp,DC=local' '(&(objectClass=user)(servicePrincipalName=*))'

BloodHound draws the graph for you

attacker@kali

# Python collector: pull users, groups, sessions, ACLs

$bloodhound-python -u jdoe -p Passw0rd -d corp.local -ns 10.10.10.5 -c All

# quick cross-check of the user list over SMB

$netexec smb 10.10.10.5 -u jdoe -p Passw0rd --users

Mark your foothold as owned

Read the output like a hunter

From a fresh collection, in this order:

Kerberoastable users: accounts with an SPN, especially in high-value groups.

AS-REP roastable users: accounts that do not require pre-auth.

Dangerous ACLs: GenericAll, WriteDACL, or ForceChangePassword over a privileged object.

Active sessions: where do admins have live logons you could hijack.

What privilege level do you need to read most of the AD directory over LDAP?