# AD\_Post-Compromise\_Enumeration

* We have compromised a user account as we get FrankCastle user and it’s hash ( with Responder) and crack it and get on Machines using SMB relay **without getting the hash** and we able to **dump SAM file and collect hashes in that way after we have compromise the next it to enumerate the network using compromises .**
* **PowerView tool (Power shell tool) :** allows us to look at the network and to enumerate basically the domain controller , domain policy and etc.
* **Bloodhound tool :** visualize what is going in the network and where we can find sensitive user that might be log in and where we can find **shortest path to get the domain admin.**

### **PowerView**

*   **Download the tool :**

    [PowerView-3.0 tips and tricks](https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993)
*   **Useful Resource for powerview :**

    [Active Directory Enumeration With PowerView](https://www.youtube.com/watch?v=n3Ow_LKanMo)
* Running powerview from directly any windows machine we have , for attacker situation if he has access to a shell then we ‘ll use that shell and **we ‘re going to load powershell.**
*   **Bypass execution policy using powershell - Ready for executing scripts :**

    ![198.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-6581df9c39a4aba6739b9d031b58a59112593c1e%2F198.jpg?alt=media)
*   **Up powerview to enumerating the domain :**

    ![199.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-ee226379ff309dce3cf5940ee2eef7dab49c74c5%2F199.jpg?alt=media)
*   **Get information about the domain ( where are domain controllers and much more) :**

    ![200.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-acd1cc413ced8db25a67b41476db34781599ffd9%2F200.jpg?alt=media)
*   **Get information about domain controllers ( Name , ip and much more) :**

    ![201.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-6533e4027fa53532aee2b26b849c53bb67108ee5%2F201.jpg?alt=media)
*   **Get the domain policy :**

    ![202.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-4c8fe5382150c711268e5670c42ece2f1f3dd92b%2F202.jpg?alt=media)
*   **Get detailed information about system access of the policy** ( Note the Minimum password length and how to use this information or password complexity all these information open ways for hacker) :

    ![203.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-97fc9286980998c421de42937e9cc5831c2c68be%2F203.jpg?alt=media)
*   Get net users ( **Get data about users in domains , you can find interesting description with passwords sometimes** ) :

    ![204.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-a98c8fd320e71a972baeb7970865112cfe808d33%2F204.jpg?alt=media)

    ![205.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-6aa666a1f6c233a355054eedfb3dcab03d482f4e%2F205.jpg?alt=media)

    * Filtering outputs to do it more easily.
*   **Get the property the user might have :**

    ![206.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-ad34e300a5679d4e01dbbe6cf43771b23a039432%2F206.jpg?alt=media)

    ![207.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-3a8179b48f736e0309052392f2cf57b199f97277%2F207.jpg?alt=media)

    * Get a specific property of item we want ( like password last list).

    ![208.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-57d578baa8e2204c1d07f4b44583c88e3567ea1a%2F208.jpg?alt=media)

    * logoncount property which can identify **honeybot accounts.**

    ![209.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-47d875521cdc1fba854523585b1c7c31b6d2f6bc%2F209.jpg?alt=media)

    * Get how many bad password to see if any of **these accounts is under attack ( many trials on it ).**
*   **List all computers on the domain :**

    ![210.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-51384978b815f92057d1d7700bcc44bea655f095%2F210.jpg?alt=media)

    ![211.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-20062da96a2801a90efa9847a5cca2a8052b8ac9%2F211.jpg?alt=media)

    * for more information and as before you select specific property like OperatingSysetm ( Greb feature).
*   **Get information about groups :**

    ![212.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-a0f66bb708b0bad9cde405e626770139388e8883%2F212.jpg?alt=media)

    ![213.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-b6212be66d144cfc1f73d505ec6a41c3e1cfea8a%2F213.jpg?alt=media)

    ![214.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-e46c2e645ef7d87c76709764eef57e8c53f72beb%2F214.jpg?alt=media)

    ```
                                          **Get all admin groups using wild card.**
    ```

    ![215.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-fbaad01f016f2ae986ccaf5930fc6f315d859c0d%2F215.jpg?alt=media)

    * Get information about specific member in the group.
*   **Get all SMB sharing in the network :**

    ![217.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-da816ba3404d22194e8bfe14de8022fb1b63d3c8%2F217.jpg?alt=media)
*   **Get all group policy :**

    ![218.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-8ec84d4742ed28ea460e6790a6ad5fa8c5e53a05%2F218.jpg?alt=media)

    ![219.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-59b08817549a318d76bddbe5efaade9b04a71857%2F219.jpg?alt=media)

### **Bloodhound**

*   **Download Invoke-Bloodhound :**

    [powershell/SharpHound.ps1 at master · puckiestyle/powershell](https://github.com/puckiestyle/powershell/blob/master/SharpHound.ps1)
* Download a data of AD ( when we are on a machine or network ) and visualize data on the graph.
*   Run a tool called neo4j and we should to set it up - change default credentials- Go to local host to change default password for more security :

    ![220.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-8cfef1b5867e439aefc7f64e0a000ac767d92672%2F220.jpg?alt=media)
* **Invoke-Bloodhound :** power shell tool using for grabbing data - Downloading this file on Windows 10 machines ( which you get access from previous stage).
  *   **To be able to use scripts :**

      ![221.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-1b21d8a25dbb5d04d8dfa366431032867ce0d95e%2F221.jpg?alt=media)
  *   **Running sharphound :**

      ![22.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-d67cdda060e0dfd4ea68703e5148bdf6d3b8dfd3%2F22.jpg?alt=media)
  *   **Running the script to get data collection from specific domain - Get this file copied to kali machine :**

      ![222.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-a80896d18605b88ed563d9d28ebe14a5d5efe8a5%2F222.jpg?alt=media)
*   Now we have our data transferred from our windows machine ( we get in the last phase) to Bloodhound - Processing all json file :

    ![223.jpg](https://3568755323-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9UnXftTvxZq0DhdYyH5k%2Fuploads%2Fgit-blob-a142072dbd18377b78a292477f86bd8880dca4ba%2F223.jpg?alt=media)

    * Here we find out the shortest path to Domain admins . Here , we should have session on the punisher machine **which has it local admin and this will lead us to DOMAIN ADMINS @MARVEL.LOCAL ( our domain admin) + Have session now unlike spiderman machine. \[ Token impersenation ] .**
* We always do enumeration after each step and ask what information is here for us after we got access we enumerate and still in this cycle as every step you do , you have more information to know about.
* After compromising one account what can we do with that account?
