Demo of ADRecon presented on 08th and 12th August at BlackHat USA 2018 Arsenal and DEF CON 26 Demo Labs.
https://www.blackhat.com/us-18/arsenal/schedule/index.html#adrecon-active-directory-recon-11912
https://www.defcon.org/html/defcon-26/dc-26-demolabs.html
ADRecon BH USA 2018 : Arsenal and DEF CON 26 Demo Labs Presentation
1. Sydney
Level 8, 59 Goulburn Street
Sydney NSW 2000
Melbourne
Level 15, 401 Docklands Drive
Docklands VIC 3008
Tel. 1300 922 923
Intl. +61 2 9290 4444
www.senseofsecurity.com.au
Sense of Security Pty Ltd
ABN 14 098 237 908
@ITSecurityAU
Compliance, Protection & Business Confidence
08 & 11 August 18
ADRecon
https://github.com/sense-of-security/adrecon
BlackHat USA 2018 – Arsenal and DEF CON 26 Demo Labs
2. What is ADRecon ?
08 & 11 August 18
• ADRecon provides a holistic picture of the current state of AD environment.
• Extracts & combines various artefacts from an Active Directory environment
• The information is presented in specially formatted Excel report (optional)
• Summary views with metrics to facilitate analysis (Excel Only)
• Can be run by normal unprivileged domain user* using
• a domain-member or
• a standalone workstation
* some features require privileged user.
Sense of Security - 2018
4. • Blue Team
• Purple Team
• Red Team
• System administrators
• Security professionals
Friendly plug
• BloodHound 2.0, LogonTracer, PowerUpSQL: A PowerShell Toolkit for
Attacking SQL Servers in Enterprise Environments at BlackHat USA 2018
- Arsenal
• ADVANCED INFRASTRUCTURE HACKING - 2018 EDITION Training –
NotSoSecure at BlackHat Europe 2018 (3 - 6 December)
08 & 11 August 18Sense of Security - 2018
Who uses ADRecon ?
5. 1. User credentials and access to a Windows host with network access to
the Domain Controller
• TCP 9389 for ADWS or
• TCP 389 for LDAP
2. Windows Host Prerequisites
• .NET Framework 3.0 or later (Windows 7 includes 3.0)
• PowerShell 2.0 or later (Windows 7 includes 2.0)
3. Optional
• Microsoft Excel (to generate the report)
• Remote Server Administration Tools (RSAT):
• Windows 10 (https://www.microsoft.com/en-au/download/details.aspx?id=45520)
• Windows 7 (https://www.microsoft.com/en-au/download/details.aspx?id=7887)
08 & 11 August 18Sense of Security - 2018
Prerequisites
6. 08 & 11 August 18Sense of Security - 2018
Modules
• Forest, Domains, Sites, Subnets, Trusts
• Default and Fine Grained* Password Policy
• Domain Controllers, SMB versions, whether SMB Signing is supported and FSMO
roles
• Users and their attributes
• Service Principal Names (SPNs)
• Groups and their members
• Organizational Units (OU)
• ACLs for the Domain, OUs, Root Containers and GroupPolicy objects
• Group Policy Object (GPO) details and GPOReport (requires RSAT)
• DNS Zones and Records
• Printers
• Computers and their attributes
• LAPS passwords*
• BitLocker Recovery Keys*
• Password Attributes (experimental)
• Kerberoast
* if implemented; require privileged user account
7. 08 & 11 August 18Sense of Security - 2018
Parameters
• -Protocol <String>
• Which protocol to use; ADWS (default) or LDAP
• -DomainController <String>
• Domain Controller IP Address or Domain FQDN.
• -Credential <PSCredential>
• Domain Credentials.
• -GenExcel <String>
• Path for ADRecon output folder containing the CSV files to
generate the ADRecon-Report.xlsx. Use it to generate the
ADRecon-Report.xlsx when Microsoft Excel is not installed
on the host used to run ADRecon.
• -OutputDir <String>
• Path for ADRecon output folder to save the
CSV/XML/JSON/HTML files and the ADRecon-Report.xlsx.
(The folder specified will be created if it doesn't exist)
(Default pwd)
• -Collect <String>
• Which modules to run (Comma separated; e.g
Forest,Domain. Default all)
• Valid values include: Forest, Domain, Trusts, Sites,
Subnets, PasswordPolicy, FineGrainedPasswordPolicy,
DomainControllers, Users, UserSPNs, Groups,
GroupMembers, OUs, ACLs, GPOs, GPOReport, DNSZones,
Printers, Computers, ComputerSPNs, LAPS, BitLocker.
• -OutputType <String>
• Output Type; Comma seperated; e.g CSV,STDOUT,Excel
(Default STDOUT with -Collect parameter, else CSV and
Excel).
• Valid values include: STDOUT, CSV, XML, JSON, HTML,
Excel, All (excludes STDOUT).
• -DormantTimeSpan <Int>
• Timespan for Dormant accounts. (Default 90 days)
• -PassMaxAge <Int>
• Maximum machine account password age. (Default 30
days)
• - ResolveSIDs <Bool>
• Whether to resolve SIDs in the ACLs module. (Default
False)
• -PageSize <Int>
• The PageSize to set for the LDAP searcher object. (Default
200)
• -Threads <Int>
• The number of threads to use during processing objects
(Default 10)
• -Log <Switch>
• Create ADRecon Log using Start-Transcript
8. 08 & 11 August 18Sense of Security - 2018
ADRecon Execution
9. 08 & 11 August 18Sense of Security - 2018
ADRecon Execution
• When Excel is not installed, the Excel Report can be
generated from the CSV files on another host with Excel
installed.
10. 08 & 11 August 18Sense of Security - 2018
ADRecon Execution
11. 08 & 11 August 18Sense of Security - 2018
Forest
12. 08 & 11 August 18Sense of Security - 2018
Domain
13. 08 & 11 August 18Sense of Security - 2018
Trusts
14. 08 & 11 August 18Sense of Security - 2018
Sites
15. 08 & 11 August 18Sense of Security - 2018
Subnets
16. 08 & 11 August 18Sense of Security - 2018
PasswordPolicy
17. 08 & 11 August 18Sense of Security - 2018
FineGrainedPasswordPolicy
18. 08 & 11 August 18Sense of Security - 2018
DomainControllers
19. 08 & 11 August 18Sense of Security - 2018
Users
20. 08 & 11 August 18Sense of Security - 2018
UserSPNs
21. 08 & 11 August 18Sense of Security - 2018
Groups
22. 08 & 11 August 18Sense of Security - 2018
GroupMembers
24. 08 & 11 August 18Sense of Security - 2018
ACLs
25. 08 & 11 August 18Sense of Security - 2018
GPOs
26. • You can generate the GPO report using the following command*:
./ADRecon –Collect GPOReport
• This command will generate html and xml GPOReports using the Get-
GPOReport PowerShell module.
• The xml file can be analysed using Grouper by Mike Loss
(https://github.com/l0ss/Grouper)
* can be executed from a standalone workstation by
executing ADRecon using RUNAS
runas /user:<Domain FQDN><Username> /netonly
powershell.exe
08 & 11 August 18Sense of Security - 2018
GPOReport
27. 08 & 11 August 18Sense of Security - 2018
DNS Zones and Records
28. 08 & 11 August 18Sense of Security - 2018
DNS Zones and Records
29. 08 & 11 August 18Sense of Security - 2018
Computers
30. 08 & 11 August 18Sense of Security - 2018
ComputerSPNs
31. 08 & 11 August 18Sense of Security - 2018
LAPS
32. 08 & 11 August 18Sense of Security - 2018
BitLocker
33. 08 & 11 August 18Sense of Security - 2018
Kerberoast
34. 08 & 11 August 18Sense of Security - 2018
Excel Report – User Stats
35. 08 & 11 August 18Sense of Security - 2018
Excel Report – Computer Stats
36. 08 & 11 August 18Sense of Security - 2018
Excel Report – Privileged Group Stats
37. 08 & 11 August 18Sense of Security - 2018
Excel Report – Computer Role Stats
38. 08 & 11 August 18Sense of Security - 2018
Excel Report – Operating System Stats
39. • Replace System.DirectoryServices.DirectorySearch with
System.DirectoryServices.Protocols and add support for LDAP STARTTLS
and LDAPS (TCP port 636).
• Add option to filter default ACLs.
• Gather ACLs for other objects such as Users, Group, etc.
• Additional export and storage option: export to SQLite.
• Use the EPPlus library for Excel Report generation and remove the
dependency on MS Excel.
• List issues identified and provide recommended remediation advice
based on analysis of the data.
• Add PowerShell Core support.
08 & 11 August 18Sense of Security - 2018
Future Plans
40. • Test the tool, suggest changes, improvements, enhancements, etc.
• Add / Promote / Write about the tool
• Report / track / suggest / fix issues
Pull requests are always welcome J
Issue tracker (https://github.com/sense-of-security/ADRecon/issues)
08 & 11 August 18Sense of Security - 2018
How to contribute ?
41. 08 & 11 August 18Sense of Security - 2018
Github: https://github.com/sense-of-security/ADRecon
Twitter: ADRecon @ad_recon Author: @prashant3535
42. Sydney
Level 8, 59 Goulburn Street
Sydney NSW 2000
Melbourne
Level 15, 401 Docklands Drive
Docklands VIC 3008
Tel. 1300 922 923
Intl. +61 2 9290 4444
www.senseofsecurity.com.au
Sense of Security Pty Ltd
ABN 14 098 237 908
@ITSecurityAU
Security, it’s all we do. Knowledge, Experience & Trust.
Questions?
Github:
https://github.com/sense-of-security/ADRecon
Twitter:
ADRecon @ad_recon
Author: @prashant3535
44. • BitLocker module updated to include Recovery Key ID, Creation Date, TPM Recovery Password, etc.
• Renamed DCs module to DomainControllers and updated with enumeration of SMB versions and SMB signing support.
• Added support for output formats: XML, JSON, HTML. (Use -OutputType parameter).
• Added FineGrainedPasswordPolicy module as a separate module after being separated from PasswordPolicy module.
• User module updated to include Delegation enumeration (Unconstrained/Constrained with the list of servers and protocol),
supported kerberos encryption algorithms (DES, RC4, AES) and include other attributes such as Account Expiration, Delegation
Permitted, homeDirectory, Email, ScriptPath and SmartcardLogonRequired.
• Computer module updated in include Delegation enumeration (Unconstrained/Constrained with the list of servers and protocol).
• Computer module (LDAP) updated to perform DNS lookup to populate IPv4Address column.
• DomainControllers module (ADWS) updated concatenate OperatingSystemHotfix, OperatingSystemServicePack and
OperatingSystemVersion attributes in Operating Version column.
• Computer module updated to include OperatingSystemHotfix, OperatingSystemServicePack and OperatingSystemVersion attributes
concatenated in Operating Version column.
• Added Sites, Subnets , Trusts and PasswordAttributes modules.
• Added Computer Stats sheet in the Excel report.
• Updated User Statistics sheet in the Excel report to cover the added attributes.
• Use Pivot Tables for calculation of count in the stats sheets in the Excel Report.
• Use excel formulae for count calculation in the user and computer stats sheets in the Excel Report.
• Updated UserSPNs module to include Enabled and Memberof attribute.
• Renamed OUPermissions module to ACLs and updated to enumerate ACLs for Domain, OUs, Root Containers and GroupPolicy
objects.
08 & 11 August 18Sense of Security - 2018
Changelog since BlackHat Asia 2018
45. References
• What Are Active Directory Functional Levels? (https://technet.microsoft.com/en-us/library/cc787290(v=ws.10).aspx)
• The KRBTGT Account – What is it ? (https://blogs.technet.microsoft.com/janelewis/2006/12/19/the-krbtgt-account-what-is-it/)
• Active Directory Service Principal Names (SPNs) Descriptions (https://adsecurity.org/?page_id=183)
• Privileged Accounts and Groups in Active Directory
(https://github.com/MicrosoftDocs/windowsserverdocs/blob/master/WindowsServerDocs/identity/ad-ds/plan/security-best-
practices/Appendix-B--Privileged-Accounts-and-Groups-in-Active-Directory.md)
• How to use the UserAccountControl flags to manipulate user account properties (https://support.microsoft.com/en-
au/kb/305144)
• All Active Directory Attributes (https://msdn.microsoft.com/en-us/library/ms675090(v=vs.85).aspx)
• Infrastructure FSMO Role (https://msdn.microsoft.com/en-us/library/cc223753.aspx)
• Active Directory: Password Policies (https://social.technet.microsoft.com/wiki/contents/articles/24159.active-directory-
password-policies.aspx)
• Active Directory-Integrated DNS Zone (https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-
integrated-dns-zones)
• PowerView (https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerView)
• BloodHound (https://github.com/BloodHoundAD/BloodHound)
• Grouper (https://github.com/l0ss/Grouper)
• Get-LAPSPasswords (https://github.com/kfosaaen/Get-LAPSPasswords/blob/master/Get-LAPSPasswords.ps1)
• PowerShell Code: ADSI Convert Domain Distinguished Name to Fully Qualified Domain Name (https://adsecurity.org/?p=440)
• Active Directory OU Permissions Report (https://gallery.technet.microsoft.com/Active-Directory-OU-1d09f989)
• Active Directory password attribute selection
(https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/com.ibm.aix.security/ad_password_attribute_selection.htm)
• unicodePwd (https://msdn.microsoft.com/en-us/library/cc223248.aspx)
• userPassword (https://msdn.microsoft.com/en-us/library/cc223249.aspx)
46. • Building an Effective Active Directory Lab Environment for Testing
(https://adsecurity.org/?p=2653)
• Setting up an Active Directory Lab
(https://www.psattack.com/articles/20160718/setting-up-an-active-
directory-lab-part-1/)
• Detection Lab (https://github.com/clong/DetectionLab)
• AutomatedLab (https://github.com/AutomatedLab/AutomatedLab)
• Invoke-ADLabDeployer (https://github.com/outflanknl/Invoke-
ADLabDeployer)
• Creating Real Looking User Accounts in AD Lab
(https://www.darkoperator.com/blog/2016/7/30/creating-real-looking-
user-accounts-in-ad-lab)
• Create Lab User Accounts 2.0
(https://gallery.technet.microsoft.com/Create-Lab-User-Accounts-
844f7ba1)
08 & 11 August 18Sense of Security - 2018
Building your own AD Lab