Active Directory Enumeration
Active Directory enumeration is the process of gathering information about users, groups, computers, and permissions within an organization's Active Directory (AD) environment. Attackers or security professionals use enumeration techniques to identify vulnerabilities, misconfigurations, or potential attack paths. Common methods include LDAP queries, PowerShell scripts, and specialized tools. Understanding AD enumeration helps organizations strengthen security by implementing least privilege access, monitoring suspicious queries, and enforcing strict authentication and authorization controls.
What is Active Directory Enumeration?
Active Directory Enumeration is the process of gathering information about an Active Directory (AD) environment, such as users, groups, permissions, domains, and other important configuration details. This step is critical for penetration testing, red teaming, and attacks on Active Directory environments, as it provides attackers with essential insights into the network's structure and vulnerabilities.
Why is AD Enumeration Important?
● Identify Targets: Discover high-privilege accounts, service accounts, and vulnerable groups.
● Map the Network: Understand the structure of domains, organizational units (OUs), and trusts.
● Find Weaknesses: Look for outdated accounts, weak permissions, and misconfigurations.
● Plan Lateral Movement: Plan how to escalate privileges and move laterally within the network.
________________________________________
Key Elements of Active Directory Enumeration
1.User Accounts: Identify users, including admin, service, and guest accounts.
2.Groups: Discover group memberships, especially privileged groups like Domain Admins, Enterprise Admins, etc.
3.Domain Structure: Enumerate domains, OUs, and trust relationships to understand the layout of the network.
4.Services: Identify service accounts, exposed SMB shares, and RDP-enabled hosts.
5.Permissions: Check for misconfigured permissions or over-permissive access in groups and shares.
6.Replication: Identify potential replication targets to use for further exploitation (e.g., DCSync).
________________________________________
Tools for Active Directory Enumeration
|
Tool |
Description |
|
PowerView |
A PowerShell tool that provides powerful enumeration features for AD environments. |
|
BloodHound |
A tool that can map out Active Directory trust relationships and highlight attack paths for privilege escalation. |
|
Impacket (GetADUsers.py, GetADGroups.py) |
Python scripts for querying AD users, groups, and other attributes. |
|
Nmap |
Network scanning tool that can be used to detect SMB shares, AD ports, and more. |
|
LDAP Enumeration Tools (ldapsearch) |
A command-line tool to interact with the LDAP protocol and enumerate AD objects. |
|
Netcat / Metasploit |
Use these tools to interact with AD services and perform remote enumeration (e.g., using SMB). |
________________________________________
Active Directory Enumeration Methods
1. User and Group Enumeration (PowerView)
Get a List of All AD Users
Get-NetUser
● Returns all users in the domain, including their group memberships.
Find Users in Privileged Groups
Get-NetGroup -Group "Domain Admins"
● Returns users who are members of privileged groups like Domain Admins or Enterprise Admins.
Enumerate User Properties
Get-ADUser -Filter * -Properties *
● Gets detailed user properties like lastLogon, passwordLastSet, memberof, etc.
2. Group Enumeration (PowerView)
Enumerate All Groups
Get-NetGroup
● Lists all groups within the domain.
Find Groups and Their Members
Get-ADGroupMember "Domain Admins"
● Lists all members of the “Domain Admins” group.
3. Domain and Organizational Unit Enumeration (PowerView)
Enumerate Domains in a Forest
Get-NetDomain
● Identifies all domains in the Active Directory forest.
Enumerate Organizational Units (OUs)
Get-NetOU
● Lists all organizational units within the domain.
4. Service Account Enumeration
Search for Service Accounts
Get-NetUser -UserType Service
● Finds accounts with the "Service" type, often used for running critical services.
5. SMB and Share Enumeration (Nmap)
Scan for SMB Shares
nmap --script smb-enum-shares.nse
● Scans for and enumerates SMB shares available on a remote host.
________________________________________
Example of Enumeration Using PowerView
List All Users
1. Get-NetUser
○ This command will output a list of all users, which you can use to identify key accounts or service accounts for further targeting.
Enumerate Groups (e.g., Domain Admins)
2. Get-NetGroup -Group "Domain Admins"
○ This will show members of the Domain Admins group, which is critical for high-privilege attacks.
Find Users with Specific Permissions
3. Get-NetUser -Filter {memberof -eq "Domain Admins"}
○ This shows all users that are members of the Domain Admins group.
Enumerate Organizational Units (OUs)
4. Get-NetOU
○ Reveals the structure of your target Active Directory environment, including all OUs.
________________________________________
Real-World Scenario:
Scenario 1: Compromising an Account via Enumeration
1. Identify Users: You use PowerView to list all users and notice a user in the Domain Admins group.
2. Check User Details: You gather further information on the user (password policy, last login).
3. Find Weaknesses: If you notice weak password policies or unused accounts, you may exploit this to escalate privileges.
Scenario 2: Lateral Movement via SMB Shares
1. Scan SMB Shares: Use Nmap to identify accessible SMB shares on other domain machines.
2. Find Sensitive Shares: Discover a share containing sensitive data or credentials.
3. Access Data: Use this data to escalate privileges or find further attack vectors.
________________________________________
How to Detect & Prevent Active Directory Enumeration
Detection (Blue Team)
- Monitor PowerShell activity using Windows Event Logs (Event ID 4104).
- Detect suspicious network activity and SMB connections using Sysmon and SIEM systems.
- Look for unusual service accounts that may have excessive privileges or can be exploited.
- Alert on enumeration of domain objects like groups, users, and OUs.
Here are 15 one-word questions with their corresponding answers and hints based on the content about Active Directory Enumeration: