38. Active Directory Attacks and Defence
38.3 Enumeration of AD
Foothold nantar (lab user password tumhi set kela) attacker directory map karto – users, groups, computers, sessions, ACLs.
NetExec (nxc) LDAP / SMB – modern Swiss army (lab):
# After you created lab user shahrukh (password YOU set) – lab only
nxc ldap 192.168.56.30 -u shahrukh -p 'YourLabPass!' --users
nxc smb 192.168.56.30 -u shahrukh -p 'YourLabPass!' --shares
Impacket basics (Kali often has impacket-* scripts):
# List domain users via LDAP-oriented helper (lab creds only)
GetADUsers.py sahyadri.lab/shahrukh:'YourLabPass!'@192.168.56.30 -all
# Secrets on DC need DA-level rights – do NOT run secretsdump until YOUR lab DA lab step
# secretsdump.py is Chapter theme in 38.5 – only on systems you own
BloodHound collectors: SharpHound (Windows) / bloodhound-python (from Kali) collect relationships into a zip for neo4j UI. Concept: who can admin what, who has sessions where. Run collectors only in lab with lab creds.
Defence: monitor LDAP enumeration patterns; protect privileged groups; no unnecessary nested groups; LAPS for local admin; tiering. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
nxc ldap / GetADUsers.py / BloodHound collect after any valid user |
Alert on mass LDAP queries; UEBA; restrict who can read sensitive attributes |
Looks for Domain Admins, AdminSDHolder, SPN accounts |
Privileged group change auditing (4728/4732); periodic BloodHound as Blue |
| Enumerates shares for creds files | Share auditing; block plaintext password files; DLP |
Ravindra Bagale's Tip
Students see the BloodHound GUI and say "hacked". Collection is just the map; the path still has to be abused. The Blue team also uses BloodHound to reduce paths – that is interview gold. The tool is not for attackers only.
Ravindra Bagale's Tip – मराठी
Students BloodHound GUI बघून "hack झाला" म्हणतात. Collection = map; path अजून abuse करायचा आहे. Blue पण BloodHound वापरून paths कमी करतो – हे interview gold आहे. Tool फक्त attacker साठी नाही.
Ravindra Bagale's Tip – हिंदी
Students BloodHound GUI देखकर कहते हैं "hack हो गया". Collection = map; path अभी abuse करना बाकी है. Blue भी BloodHound इस्तेमाल करके paths कम करता है – यह interview gold है. Tool सिर्फ़ attacker के लिए नहीं है.
Lab
Lab user ne nxc ldap 192.168.56.30 -u shahrukh -p '...' --users chalaa. User count note kara. Mag bloodhound-python / SharpHound lab DC/client against collect (docs on Kali). Import zip → find shortest path from shahrukh to Domain Admins (path nahi asel tar changla!). Screenshot.
Real incident: NotPetya lateral era (2017)
NotPetya (reported widely by national CERTs and major outlets) spread inside networks using stolen credentials and SMB-based lateral movement patterns after initial foothold – identity and file-share trust became the highway. Defence theme: credential hygiene, SMB hardening, segmentation, rapid isolation. Source: national CERT advisories and contemporary major news analyses (verify).