Domain Groups
Sub-technique of T1069 Permission Groups Discovery ↗
Enumerating domain groups, members and permissions, usually with BloodHound.
How it shows up on Hack The Box
Collect with bloodhound-python or NetExec, mark what you control as owned and look for the shortest path to Domain Admins. Almost every AD box is solved by following that graph.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Active Directory enumeration: users, LDAP, BloodHound and password spraying 4 min read What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Active Directory
Collect data for BloodHound
bloodhound-python -u 'usuario' -p 'Password123!' -d box.htb -ns 10.10.11.20 -c All --zipActive Directory in depth › BloodHound
Remote collector in Python (CE)
Attacker
bloodhound-ce-python -u usuario -p 'Password123!' -d box.htb -ns 10.10.11.20 -dc dc01.box.htb -c All --zip
With NetExec, nothing else to install
Attacker
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --bloodhound -c All --dns-server 10.10.11.20
SharpHound from the Windows target
Target
.\SharpHound.exe -c All --zipfilename datos
High-value user sessions (where to grab credentials)
MATCH (u:User)-[:MemberOf*1..]->(g:Group) WHERE g.highvalue=true MATCH (c:Computer)-[:HasSession]->(u) RETURN c.name, u.nameBloodHound › Collectors
SharpHound with just fast-changing data (sessions)
Target
.\SharpHound.exe -c Session --loop --loopduration 00:10:00NetExec (nxc) › Enumeration
Domain groups
nxc ldap 10.10.11.20 -u usuario -p 'Password123!' --groupsNo command matches.