DΛΣMӨП

Catalog WADComs

WAD · Tool

PwshADmodule

2 techniques WindowsWADComs GPL-3.0

PwshADmodule-DelegationAttack-Enum

Enumeration Windows

Having imported the pwsh AD module referenced in the project, we can begin to use it to enumerate for potential points of exploit one of the prime being kerberos delegation attacks. The following 4 line commands will enumerate the entire AD forest for RBCD, Constrained and Unconstrained delegation attacks. Note that we will also factor in protocol trainsiton as those change the attack vector slightly. See references below 

# 1. Unconstrained (turned on for all Domain controllers by default)
(Get-ADForest).Domains | % { Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Server $_ | select Name,DNSHostName; Get-ADUser -Filter {TrustedForDelegation -eq $true} -Server $_ | select Name,SamAccountName }


# 2. Constrained (with protocol transition check)
(Get-ADForest).Domains | % { Get-ADComputer -Filter {msDS-AllowedToDelegateTo -like "*"} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation -Server $_ | select Name,TrustedToAuthForDelegation,msDS-AllowedToDelegateTo; Get-ADUser -Filter {msDS-AllowedToDelegateTo -like "*"} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation -Server $_ | select Name,TrustedToAuthForDelegation,msDS-AllowedToDelegateTo }

# 3. RBCD (which object is already configured)
(Get-ADForest).Domains | % { Get-ADComputer -Filter * -Properties msDS-AllowedToActOnBehalfOfOtherIdentity -Server $_ | ? {$_."msDS-AllowedToActOnBehalfOfOtherIdentity"} | select Name,DNSHostName }

# 4. RBCD (which object can configure it - write access)
(Get-ADForest).Domains | % { Get-ADComputer -Filter * -Properties nTSecurityDescriptor -Server $_ | ? {$_.nTSecurityDescriptor.Access | ? {$_.ActiveDirectoryRights -match "GenericWrite|WriteProperty" -and $_.IdentityReference -notmatch "SYSTEM|Domain Admins"}} | select Name }
Native
Enumeration
Requires
PowerShell

PwshADmodule-Initial-Enum

Enumeration Windows

These commands provide a quick refernece for using the AD module to get situational awerness of the AD environment. Note that to get more commands that you can run, use the get command cmdlet, e.g. `Get-Command -Module ActiveDirectory` But Thes are the standard commands that will get you standard. Feel free to replace the first pipe with the -server "your domain" if you dont want to enumarate the entire forest. For more info on using the AD module, please check out our discussion on the AD module in WADCOMs. 

#Getting all DCs in the forest
(Get-ADForest).Domains | % { Get-ADDomainController -DomainName $_ -Discover }

#Getting all users in the forest
(Get-ADForest).Domains | % { Get-ADUser -Filter * -Server $_ }

#Getting all computers in the forest
(Get-ADForest).Domains | % { Get-ADComputer -Filter * -Server $_ }

#Mapping out entire trust relationships
Get-ADTrust -Filter '(intraForest -ne $True) -and (ForestTransitive -ne $True)' | Select-Object Source,Target,Name

#Getting all groups in a domain. Note that the select statement will limit the output to only the matching fields the object contains
Get-ADGroup -Filter * | Select-Object SamAccountName, GroupScope, DistinguishedName
Native
Enumeration