SpellBook

Mon, 01 Jan 0001 00:00:00 +0000

Collector#

`bloodhound-python`#

Install

sudo apt update && sudo apt install bloodhound-python -y

Run

bloodhound-python -c ALL -ns 172.16.8.3 -u "$user" -p "$pass" -d inlanefreight.local --zip

If ldaps, use --use-ldaps

bloodhound-python -c ALL -ns 172.16.8.3 -u "$user" -p "$pass" -d inlanefreight.local --use-ldaps --zip

If can’t use udp, or behind a pivot box, is using proxychains, use --dns-tcp

bloodhound-python -c ALL -ns 172.16.8.3 -u "$user" -p "$pass" -d inlanefreight.local --dns-tcp --zip

`rusthound-ce`#

install

git clone https://github.com/g0h4n/RustHound-CE.git
cd RustHound-CE
sudo apt update && sudo apt install cargo rustup -y
rustup default stable
make release

Run

Mon, 01 Jan 0001 00:00:00 +0000

Deleted objects#

From `Powershell`#

Query everything of deleted object

Get-ADObject -Filter 'IsDeleted -eq $true' -IncludeDeletedObjects -Properties *

Query specific things like Description,ObjectSid,ObjectGUID,LastKnownParent

Get-ADObject -Filter 'IsDeleted -eq $true' -IncludeDeletedObjects -Properties Description,ObjectSid,ObjectGUID,LastKnownParent

Restore object#

Restore the object, using ObjectGUID

Restore-ADObject -Identity aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa

From linux#

# Query everything
bloodyAD --host dc.domain.name -d domain.name get search -c '1.2.840.113556.1.4.2064' -c '1.2.840.113556.1.4.2065' --filter '(isDeleted=TRUE)'
# Query specific properties
bloodyAD --host dc.domain.name -d domain.name get search -c '1.2.840.113556.1.4.2064' -c '1.2.840.113556.1.4.2065' --attr 'Description,ObjectSid,ObjectGUID,LastKnownParent' --filter '(isDeleted=TRUE)'

If you want Kerberos authentication with ldapsearch, set KRB5CCNAME=user.ccache variable add -Tx -Y GSSAPI flag

Mon, 01 Jan 0001 00:00:00 +0000

Direct Object Rights#

This is a cypher query used in bloodhound. See how to set up bloodhound at 8. Lateral Movement/AD Enumeration/Bloodhound setup#Server

This query shows you what rights accounts have directly assigned. Very good in CTF or small AD environments.

MATCH p=(source)-[r]->(target)
WHERE (source:Computer OR source:User)
AND type(r) <> 'MemberOf'
return p

Mon, 01 Jan 0001 00:00:00 +0000

Get All Properties#

See all attributes of an object

bloodyAD --host "dc01.domain.name" -d "domain.name" -u 'user' -p 'pass' get object 'victim' --resolve-sd

Or, get a specific attribute

bloodyAD --host "dc01.domain.name" -d "domain.name" -u 'user' -p 'pass' get object 'victim' --attr logonHours

Mon, 01 Jan 0001 00:00:00 +0000

Can skip this part if you know for sure there is no account lockout policy

Linux Attacker#

`netexec`#

If null session is available, use this

netexec smb -u '' -p '' $target --pass-pol

If not, then need valid credential

netexec smb $target -u "$user" -p "$pass" --pass-pol

`rpcclient`#

If null session is available, use this

rpcclient -U "" -N $target
rpcclient $> getdompwinfo

If not, then need valid credential

rpcclient -U "$user%$pass" $target
rpcclient $> getdompwinfo

`ldapsearch`#

ldapsearch -h $target -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

Domain joined Windows#

`net.exe`#

net accounts

`Powerview`#

import-module .\PowerView.ps1

Get-DomainPolicy

Mon, 01 Jan 0001 00:00:00 +0000

`netexec`#

netexec smb $target -u "$user" -p "$pass" --users

`enum4linux`#

enum4linux -U $target  | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"

`impacket-samrdump`#

impacket-samrdump $target

`ldapsearch`#

ldapsearch -h $target -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d" "

`kerbrute`#

Clone username list repo

git clone https://github.com/insidetrust/statistically-likely-usernames.git

Download kerbrute binary. Yes, it does not exist in kali’s package manager. And sadly, at the time of writing, it hasn’t been updated since 2019

wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
mv kerbrute_linux_amd64 kerbrute
chmod +x kerbrute

Depends on the account naming convention, chose the correct username list file.

Mon, 01 Jan 0001 00:00:00 +0000

Writable Objects#

Sometimes, we have permission to write specific things on another object, and bloodhound doesn’t show that.

bloodyAD --host "dc01.domain.name" -d "domain.name" -u 'user' -p 'pass' get writable --detail

SpellBook

Collector#

bloodhound-python#

rusthound-ce#

Deleted objects#

From Powershell#

Restore object#

From linux#

Direct Object Rights#

Get All Properties#

Linux Attacker#

netexec#

rpcclient#

ldapsearch#

Domain joined Windows#

net.exe#

Powerview#

netexec#

enum4linux#

impacket-samrdump#

ldapsearch#

kerbrute#

Writable Objects#

`bloodhound-python`#

`rusthound-ce`#

From `Powershell`#

`netexec`#

`rpcclient`#

`ldapsearch`#

`net.exe`#

`Powerview`#

`netexec`#

`enum4linux`#

`impacket-samrdump`#

`ldapsearch`#

`kerbrute`#