Active Directory Enumeration With Server Manager

Key Takeaways

[Music] hey guys hackersploit here back again with another video welcome back to the penetration testing boot camp as i said we're going to be resuming from where we left off so we'll be exploring uh you know enumeration with server manager so again this is part of the post exploitation uh section of the pen testing boot camp where we were exploring uh you know post exploitation techniques within an active directory environment but really uh primarily focused on windows right so uh we had completed you know golden ticket attacks with mimikats and we were now uh you know exploring uh ad enumeration with server manager so i've already uh started up the target system here and as you can see we need to actually read through the description so this is really not applicable in terms of exploitation unless rdp is enabled on the target but you know that's what we're trying to get an understanding of here so uh because servers are hardly ever logged on unless it's for maintenance this always gives you an easy way for enumerating only using the built-in windows features such as the server manager if you already have a domain admin you have a lot of access to the server manager in order to change trusts add or remove users look at groups this can be an entry point to find other users with other sensitive information on on their machines or find other users on the domain network with access to other networks in order to pivot and of course we'll be exploring pivoting as we actually move on all right so the only way to access the server managers to rdp into the server and access the server over an rdp connection all right so we'll only be going over the basics such as looking at users etc etc right now as i said our primary access of vector is via rdp now you know in some cases you may not be you know you may not be familiar with uh whether or not rdp has been enabled on the target but a quick port scan will reveal that especially uh if it's running on the default rdp port which is port 3389 right so again what we'll do here is we'll just copy the target ip and in order to log in via dp on linux you can either use a an rdp client like romina or you can use x3 rdp which is my personal preference so i'll just open up my terminal here and you know i can say x3 rdp and we can then specify the actual domain uh and the domain in this case let me just make sure i have all the details controller all right so we'll say controller and we then need to specify the user which is done or can be done using the u option here and the user in this case is administrator and then we specified the target ip address using the v option here so i'll just paste in the target ip and let me just copy the password all right so i've copied the password and we'll just hit enter and hopefully we're able to get a session uh one thing i want to do is change the resolution here so i'm just going to use the size option to do that so i'm going to say size is going to be we can you know utilize maybe 1920 by 1080 but let's try 1280 by 720 so we we have some you know some a good resolution to begin with uh we hit enter it's going to ask us to whether we trust the above certificate i'm going to yes password i'll paste in the password there and we'll give that a couple of seconds to actually initiate the rdp session there we are so uh we get access to the windows target and of course our access is via the administrator user on the domain controller itself right so i'll just wait for this to start up all right so the rdp session is started up and is running so you can see we have server manager already opened here server manager in this context essentially is a really just a utility or a management that you know console that allows you to uh manage your you know your domain uh you know all computers that part of the domain uh your dns configuration etc etc it's essentially used to manage your active directory uh environment right and of course this is on the domain controller itself um so if we take a look at the actual questions here or rather the actual enumeration section we can see that this is what windows server manager will look when you first open it up the main tabs will be the most interesting are the tools and the manage tabs and the tools tab is where you'll find most of the information such as users groups trusts computers etc all right so it tells us not to worry about adcs addds and dns or files file and storage services these are set up for exploitation of the active directory and don't have much use for post exploitation okay so if we head back over into server manager and i'm just going to expand that uh you can see that you have adcs right and we're currently on the dashboard so adcs essentially allows you to manage your certificate services adds stands for you know your active directory domain services and then of course you have dns so if i click on dns this will allow you to essentially you know list out the servers as well as the events um so if i just scroll down here you can see you have your servers events services as well as the best practices analyzer performance etc if we go back to the dashboard and we take a look at adds you can see this will tell us our you know the current servers online and this is our domain controller uh the events for the domain controller the services whether they are running or rather their status so you know for example you can see that netlogon is currently running we have kerberos at the cobraski distribution center is running and you know so on and so forth so that's just in regards to managing an active directory environment and we'll be taking a look at this uh when we'll be exploring uh the process of setting up your own active directory lab for now i just wanted to give you an introduction to that so it looks like we get some windows updates that's always something uh that you typically expect all right so now that we've gained access um again we as it says we can prime the two primary um aspects that they want us to focus on are the manage uh menu as well as the tools menu so again within manage you can add roles and features you can remove roles and features add servers etc and of course you have your server manager properties and if we take a look at tools we have act uh you know we have access to the active directory administrative center to the domains and trusts uh we also have the sites and services and users and computers so let's click on that and i'm just going to give that a couple of seconds to open up and if we take a look at the actual questions you can see we've already done that it'll say that this will pull up a list of values on the domain that is correct so what tool allows us to view the event logs that's very easy on windows that's always going to be the event viewer so let me just type that in event viewer yeah that is correct so let's take a look at the event view as well so i'm just going to click on tools and we scroll down here we should have the event viewer there we are so that will allow you to view the you know events on a windows system so i'll just open that up and again windows events are fairly simple to understand if i click on the windows logs they're sorted into three main categories you have applications security and system so application essentially gives you the logs you know based or primarily for applications and you know the any errors they may experience uh when they were started when they were shut down you know so you can get information like that as for security you'll probably get you know the authentication or you know uh you know yeah the authentication logs uh and any other you know security based uh events that have been logged here and then of course for system this will track information like system reboot system shutdowns any issues with the kernel etc etc so let me just minimize event viewer and let's take a look at um the actual active directory users and computers so the second question is what is the sql service password right so the sql service password let's open up rdp here and we have the sql service password we'll click on that um so we have the ability here to again manage the account but from this perspective you can see that under the description it says that the password is my password one two three now um you know you typically will have access to the target system through some form of shell whether it be a command shell you know it could be ps exec or you could be using a lateral movement tool as we explored previously in the red theme series but in this case you know it's provided to us here and of course i don't recommend changing user passwords although you can do that but for this case we'll just say or paste in the password there so that's fairly simple all right so we've essentially completed that it's very easy to do this when you have access to the target via rdp but let's set up the stage for the next section which is maintaining access and within this section i really didn't like the way they went about doing this because again i'm not really a fan of transferring payloads onto the target system um so again yeah that's not really what i'm interested in what we can do is get a powershell session on the target system and then upgrade that to a meterpreter session and we can then you know gain our access uh through materpreta and then after that we can take a look at the various windows persistence techniques uh that we can perform with metasploit as well as some local persistence techniques all right so what i'm going to do is i'm just going to open up a new tab here so i'm currently using tmux and i'll say sudo msf console and let me just type in my password there okay we'll give that a couple of seconds and that should be that should start up msf console for me and we'll use the web delivery payload or the web delivery module if you will so i'm going to just search for it here so search web delivery and there we are this will allow us to deliver a payload or some uh you know a powershell command uh that we can execute on the target system and the payload is then uh stored or hosted on a web server are on the kali linux system on my kali linux system so as you can see this is script web delivery and you can use this module for you know various environments in this case we're using windows so i'll say use we are not using python because the windows target doesn't have python installed so we really can't execute uh python scripts or python code so i'm gonna set the payload to uh we're gonna use a non-staged payload we're just gonna say set payload to windows and this is powershell reverse tcp there we are if we show the options for this module you can see we need to set up the server host because we're currently accessing the target through a vpn connection so i need to explicitly uh set that up the server port is port 8080 which is fine we don't want to set up an ssl certificate that may be useful if you're trying to make it you know legitimate and the uri path will leave it to the random options here um as for the payload options we need to set up the lhost option so let's uh do that right now so i'll say ifconfig and we'll set that to the actual tunnel 0 interface ip so we're going to say set lhost there we are and if we show the options again we can set the l port option but in this case i'm not going to do that do we want to load any partial modules no the exploit target is currently set to python we need to change that so i'm going to say set target and in this case we are using powershell so we can either use powershell or partial binary let's try let's use the partial binary exploit target option so i'm going to say powershell binary hit enter show options again do we need to configure anything else yeah we need to configure the actual server host so i'm going to say set server host your current ip and once we're good to go um i'm sure that this module if i say show advanced uh this module will encode the powershell code um i'm not really sure let's just hit show advanced there and we can see that powershell um there we are that's what i'm looking for encoded command is set to true as well as the ams i bypass option that's also set to yes or to true so this will request amsi sbl bypass before the stage here uh in this case we're not using a staged uh module um because we're not using meterpreter so we really don't need to set that uh we'll just let we'll actually just use the encode option or set that to true and i'll just hit run uh so it's going to run the job as or you know run it as a background job and it should give us the powershell uh code here to execute so we can execute this on the target system through the command prompt so i'll just open up the command prompt here on the target system and i'll say you know cmd and i'll give that a couple of seconds to open up uh you know this is running uh you know in the cloud so we need to be cognizant of that so i'll just paste that in there and this will close or will actually terminate the command prompt session after it's executed but let's just hit enter all right so once we hit enter we should say we should see that it's sending the stage in this case uh let's see whether it's actually doing that i don't see any uh any information being displayed no sessions as for the jobs if we say jobs well actually stopped all the jobs but we can run that again i'm pretty sure i need to set the actual powershell encode option to false although i'm not really sure so let's say set psh and we'll set the we're looking for the encoded command to false right and if we now hit run the code is now again not encoded in base64 so again we can just open that up in a command prompt here so cmd we can also run it as administrator and we what i'll do is i'll get rid of the hidden option there the hidden flag so that this is not going to be hidden once i hit execute so there we are and i'll just hit enter there we go there we are so web delivery delivering the payload that opens up windows powershell and it should execute that and give us a partial session um in this case uh probably isn't working because the airway it actually is working so we get a powershell session open so if i type in dir uh sorry sessions there we are sessions one if i say dir and i hit enter looks like we're not getting any output but let's give that a couple of seconds there we are it looks like it's working so we have you know we have access to the target system via a powershell command session so i can put this in the background and i can upgrade this session to a meterpreter session by saying sessions uh upgrade one uh let's see whether this will work otherwise we'll have to use the module uh the actual shelton interpreter module manually to configure it sessions nothing there yeah it looks like we'll have to use it so i will have to use it manually so i'm just going to copy that there say use show options we'll set the lhost option to need to get the target ip again so let me just copy this here that's the actual connection so i'll say set l host to this ip here set the session to one let's see whether we're able to get a meterpreter session is it being used by another process we list out our jobs yeah it is being used by another process so it's going to stop exploit multi handler let's set the l port then to 4422 and i'll hit run and uh let's see whether we get a interpreter session if not we'll have to again you know transfer the payload manually because for some reason yeah it looks like it's sending the stage uh let's see whether we get it so sessions still nothing so it's sending the stage it doesn't look like the stage is being executed so we may have to use a a non-stage meterpreter payload um let's just see whether i get yeah there we are so we get a meterpreter session that took a while so sessions two there we are sis info nothing displayed there that's weird uh probably executed really slowly i'm not really sure why it's not giving us any output uh yeah so it looks like it's kind of slow the connection to the target is uh you know has some lag so i'm just going to wait for this to actually output what we typed in so i'm just going to type in cis info again there we are so that's working out fine now so again we've gained access to the target system via um you know via a meterpreter payload or you know powershell command session and we did that using the actual web delivery module which is much better than transferring a payload manually then executing it and of course there's a few artifacts that are on the disk when we use this particular technique all right so get use id and there we are so if we load incognito now i just want to test something here so load incognito and let's list all the tokens because i logged in using a an interactive session through rdp we should have some delegate tokens available so a list tokens uh you yeah so we have the delegate tokens available and we can of course elevate to anti-authority system or impersonate or you know that particular access token so i'm going to say impersonate token and i'll just paste that in there there we are so you know get use id we now have anti-authority system privileges all right so again all that i wanted to cover in this video is enumeration with server manager and how we can gain access to the target system uh if you if you're accessing the target via rdp this is a you know really easy way of gaining access to the target system through a powershell command session and then of course how to upgrade that to a meterpreter session and now that we've gained access again we can now take a look at how to establish persistence and of course we're going to bypass this entire uh process here of you know transferring it onto the target uh you know etc etc so uh yeah that's gonna be it for this video and uh i'll be seeing you in the next video a huge thank you to all of our patreons your support is greatly appreciated and this is a formal thank you so thank you shamir douglas ryan carr sandor michael busby sids up doozy defean barry dustin empress and michael hubbard your support is greatly appreciated and you keep us making even more high quality content for you guys so thank you [Music]