Chapter 10: Working with Active Directory Attacks

As more users and devices are connected to an organization's network, the need to implement centralized management arises. Imagine having to configure a new user account on each computer within your company, each time a new employee is hired, or having to manually configure policies on each device to ensure users are restricted from performing administrative actions. Microsoft Windows Server allows IT professionals to install and configure the role of Active Directory Domain Services (AD DS), which enables IT professionals to centrally manage all users, groups, policies, and devices within the domain.

In this chapter, you will gain an understanding of the role, function, and components of Active Directory within an organization. You will learn how to use various tools and techniques to enumerate sensitive information from a Window domain that can be used to understand the attack path to compromise the domain and the domain controller...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following hardware and software requirements:

• Kali Linux 2021.2: https://www.kali.org/get-kali/
• Windows Server 2019: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2019
• Windows 10 Enterprise:
• hashcat: https://hashcat.net/hashcat/
• PowerView: https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
• Bloodhound: https://github.com/BloodHoundAD/BloodHound

Understanding Active Directory

As an organization grows by increasing the number of employees needed to support the daily business functions, the number of devices connected to the organization's network increases as well. While an organization is small, there are very few users and computers on the network, and having a dedicated IT team is not always needed. Most importantly, since a small company has very few users, the IT professional can easily create a local user account on each system per employee. However, as the number of users and devices increases to a medium-sized or large organization, creating local accounts for each user per device is not efficient.

Imagine that you have to change a user's password on their user account and there are over 100 devices within the network – this can be very challenging. Within Microsoft Windows Server, you will find many roles and features that can be installed and configured to help IT professionals provide many services...

Enumerating Active Directory

Enumerating will allow you to gather sensitive information about all the objects, users, devices, and policies within the entire Active Directory domain. Such information will provide you with insights into how the organization uses Active Directory to manage its domain. You will also be able to gain a clear idea of how to exploit the trust between domain clients, users, and the domain controller to compromise an organization's Active Directory domain.

To recap, in Chapter 3, Setting Up for Advanced Hacking Techniques, you learned how to assemble our Red Team Lab, which will be highly utilized during this chapter to help you understand and exploit an Active Directory domain. The following diagram shows the topology that we'll be using throughout this chapter:

Figure 10.3 – Red Team Lab topology

As shown in the preceding diagram, Kali Linux is the attacker machine that is connected to the Red Team Lab, which...

Leveraging network-based trust

While this chapter focuses on exploiting the trust of the Active Directory role and services within a Windows environment, there are various types of attacks that exploit the security vulnerabilities found within the protocols of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite. When we think of TCP/IP, it's often referring to network-related technologies and devices. However, the protocols that exist within TCP/IP can be found within the operating system and the applications that are running on a host device. As an aspiring penetration tester, it's important to discover as many possible techniques and develop strategies to compromise your target.

In this section, you will learn how to discover and exploit security weaknesses found within the underlying network protocols of TCP/IP. These are used within an Active Directory domain to connect clients such as Windows 10 Enterprise systems to a domain controller that...

Summary

In this chapter, you learned how Active Directory is used within organizations to help their IT teams centrally manage all the users and devices within their network. You have also gained some hands-on experience and the skills to extract sensitive information from Active Directory and identify the attack paths to compromise the domain. Furthermore, you know how to perform various network-based attacks that take advantage of the trust between domain clients and the domain controller within a network.

I hope this chapter has been informative for you and is helpful in your journey as an aspiring penetration tester, learning how to simulate real-world cyberattacks to discover security vulnerabilities and perform exploitation using Kali Linux. In the next chapter, Advanced Active Directory Attacks, you will learn how to perform advanced attacks that exploit the trust on an Active Directory domain.

Further reading

To learn more about the topics that were covered in this chapter, visit the following links:

• Active Directory Domain Services Overview: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
• PowerView command list: https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
• Bloodhound documentation: https://bloodhound.readthedocs.io/en/latest/index.html
• LLMNR/NBT-NS Poisoning and SMB Relay: https://attack.mitre.org/techniques/T1557/001/