WEBVTT 00:00:01.940 --> 00:00:03.620 Hey there, welcome to Pluralsight. 00:00:03.630 --> 00:00:04.420 In this course, 00:00:04.430 --> 00:00:06.990 you'll learn how to gather valuable information from your 00:00:06.990 --> 00:00:10.160 target Active Directory using the ADRecon tool. 00:00:11.840 --> 00:00:12.650 But you may be wondering, 00:00:12.660 --> 00:00:14.660 why is the information in Active Directory so 00:00:14.660 --> 00:00:16.160 important for a red team engagement. 00:00:16.740 --> 00:00:20.900 Well, the AD is the central source of information for an IT department. 00:00:20.910 --> 00:00:22.770 A lot of information is stored in there. 00:00:23.340 --> 00:00:26.510 What most people don't know is that any user in the domain can 00:00:26.510 --> 00:00:29.270 request tons of valuable information from the AD, 00:00:29.280 --> 00:00:31.600 such as the list of all users in the company, 00:00:31.630 --> 00:00:34.620 the list of all the admins, the list of all computers, 00:00:34.630 --> 00:00:37.560 server security policies, and even some Kerberos tickets. 00:00:38.340 --> 00:00:40.500 And again, any user can request information. 00:00:40.510 --> 00:00:44.170 You don't need to be a domain admin for that. Now, imagine what 00:00:44.170 --> 00:00:45.870 a hacker could do with all this information. 00:00:46.540 --> 00:00:50.080 For example, having the list of all the users and the password policy, 00:00:50.090 --> 00:00:53.890 an attacker can start a password spray attack, and this attack 00:00:53.900 --> 00:00:56.690 consists of looking at the password policy and creating a list 00:00:56.690 --> 00:00:58.260 of our most probable passwords. 00:00:58.640 --> 00:01:01.290 And then, since we have a list of all the users in the domain, 00:01:01.300 --> 00:01:04.120 we can test those most probable passwords against all the 00:01:04.120 --> 00:01:06.260 users to see if we can get any credentials. 00:01:06.740 --> 00:01:07.550 Pretty cool, right? 00:01:07.940 --> 00:01:10.400 Also, imagine the attacker gets access to the list 00:01:10.400 --> 00:01:11.750 of administrators in the company. 00:01:12.640 --> 00:01:16.150 Then the attacker could use this list to perform some target phishing attacks. 00:01:16.540 --> 00:01:20.320 And not only that, if an attacker gets access to the Kerberos service tickets, 00:01:20.330 --> 00:01:24.130 he can perform a very common attack called Kerberoasting, which 00:01:24.130 --> 00:01:26.770 would give the attacker the credentials for the service accounts in 00:01:26.770 --> 00:01:29.990 the domain. Now you can imagine why gathering information from 00:01:29.990 --> 00:01:31.560 Active Directory is so important. 00:01:33.740 --> 00:01:36.510 Although all those information requests can be done manually, 00:01:36.520 --> 00:01:39.610 the best way of gathering information from your Active Directory is 00:01:39.610 --> 00:01:43.420 using the ADRecon tool, which automates the data collection and put 00:01:43.420 --> 00:01:44.960 it in a really nice format for us. 00:01:46.440 --> 00:01:50.260 The ADRecon tool was developed by Prashant Mahajan, and thanks to 00:01:50.260 --> 00:01:53.370 him, our job as a red team specialist is way easier. 00:01:53.940 --> 00:01:55.720 If you're interested in offensive security, 00:01:55.730 --> 00:01:57.870 you should check his Twitter and his other tools. 00:01:59.040 --> 00:02:02.210 The formal definition of the ADRecon is that it's a tool that 00:02:02.210 --> 00:02:04.830 gathers information about the Active Directory and generates a 00:02:04.830 --> 00:02:06.870 report of the current state of your AD. 00:02:07.640 --> 00:02:10.910 This tool was actually developed for IT admins so they can 00:02:10.910 --> 00:02:12.650 get statistics about the environment. 00:02:13.340 --> 00:02:13.930 However, 00:02:13.940 --> 00:02:17.570 since it contains a lot of valuable information, a lot of red team specialists 00:02:17.580 --> 00:02:20.060 use this tool to get sensitive information from the domain. 00:02:22.040 --> 00:02:24.460 What I love about this tool is that it's an open 00:02:24.460 --> 00:02:27.340 source tool under the GNU version 3.0, 00:02:27.350 --> 00:02:30.640 which means that you can download it and edit the source code to customize 00:02:30.640 --> 00:02:34.170 the tool. You can download the ADRecon from this GitHub. 00:02:34.640 --> 00:02:37.300 Also, if your client has Azure Active Directory, 00:02:37.310 --> 00:02:41.380 you can find the ADRecon for Azure on this GitHub. It is 00:02:41.380 --> 00:02:43.490 basically the same tool, but instead of extracting 00:02:43.490 --> 00:02:45.580 information from local Activity Directory, 00:02:45.590 --> 00:02:49.060 it extracts the data from the Active Directory on the Azure cloud. 00:02:50.240 --> 00:02:51.980 Another thing that I love about this tool is that 00:02:51.980 --> 00:02:54.190 because it is widely used by IT admins, 00:02:54.240 --> 00:02:57.470 most of the anti‑virus solutions do not flag this as malicious. 00:02:58.140 --> 00:02:58.630 Of course, 00:02:58.640 --> 00:03:01.140 you should always test this tool in your own lab to make sure that the 00:03:01.140 --> 00:03:04.940 anti‑virus of your client will not detect this, but from my experience, most of 00:03:04.940 --> 00:03:07.470 the time you can use this tool without being detected. 00:03:08.940 --> 00:03:10.890 Also, as I mentioned at the beginning of this course, 00:03:10.900 --> 00:03:14.370 you don't need the admin privilege to run this tool, so even if you 00:03:14.370 --> 00:03:16.860 have just a low privilege account this will work. 00:03:18.140 --> 00:03:20.620 Also this tool provides you with a lot of interesting 00:03:20.620 --> 00:03:23.810 information such as user accounts, service accounts, 00:03:24.040 --> 00:03:27.170 security policies, computers, and much more. 00:03:28.340 --> 00:03:29.020 In our demos, 00:03:29.030 --> 00:03:32.270 you see that you can get a really complete report about the Active Directory. 00:03:34.540 --> 00:03:37.220 If you're familiar with the red team kill chain, it can map the 00:03:37.230 --> 00:03:40.060 ADRecon tool right after the exploitation phase. 00:03:40.640 --> 00:03:42.930 And this means that to use the ADRecon, 00:03:42.940 --> 00:03:46.260 you do need credentials of one user in the domain and also 00:03:46.260 --> 00:03:48.170 access to a Windows machine on the network, 00:03:48.740 --> 00:03:51.380 which you may have done by exploiting _____ or even 00:03:51.380 --> 00:03:52.850 phishing some credentials via email. 00:03:54.240 --> 00:03:55.310 Once you're in the network, 00:03:55.320 --> 00:03:58.940 you can use ADRecon to get information about the environment and use this 00:03:58.940 --> 00:04:01.650 information to escalate privileges and move laterally. 00:04:02.440 --> 00:04:06.100 The idea is that with ADRecon you're able to extract crucial 00:04:06.100 --> 00:04:07.780 information from the Active Directory, 00:04:08.010 --> 00:04:10.420 and this will allow you to get access to another user 00:04:10.420 --> 00:04:12.250 account or even service account. 00:04:14.440 --> 00:04:16.680 If we map the techniques that we learned in this 00:04:16.680 --> 00:04:18.640 course to the MITRE ATT&CK framework, 00:04:18.649 --> 00:04:21.290 you see that in here we focus on three main areas, 00:04:21.300 --> 00:04:24.460 which are discovery, collection, and credential access. 00:04:25.740 --> 00:04:28.350 Inside of discovery, we covered three main techniques. 00:04:28.740 --> 00:04:32.400 The T1201, which is password policy discovery, 00:04:32.450 --> 00:04:34.520 in which we are able to get information about the password 00:04:34.520 --> 00:04:37.450 policy for the company, so then we can run advanced attacks 00:04:37.460 --> 00:04:38.550 such as password spraying. 00:04:40.440 --> 00:04:40.870 Also, 00:04:40.880 --> 00:04:46.540 we covered the T1069, which is permission group discovery. And also 00:04:46.550 --> 00:04:50.460 we covered the T1087, which is account discovery, 00:04:50.480 --> 00:04:53.470 which will provide us with a list of all the accounts in the domain. 00:04:55.240 --> 00:04:58.930 Although ADRecon is mostly a discovery tool, it can also be used for 00:04:58.930 --> 00:05:01.750 attacks in the credential access and collection areas. 00:05:02.340 --> 00:05:06.890 For example, with the ADRecon we can steal or forge Kerberos tickets, 00:05:06.990 --> 00:05:13.150 which is the technique T1558 in the MITRE ATT&CK framework. And more specific, 00:05:13.160 --> 00:05:19.020 we covered a sub‑technique called Kerberoasting. Also, with ADRecon we can 00:05:19.020 --> 00:05:21.260 collect a lot of data from the Active Directory, 00:05:21.270 --> 00:05:23.970 which is described on the technique T1213. 00:05:24.640 --> 00:05:27.470 As you can see, with ADRecon we can perform several 00:05:27.470 --> 00:05:29.170 techniques with just one tool. 00:05:31.340 --> 00:05:34.150 But before getting to the technical part of this course, I want you to 00:05:34.150 --> 00:05:37.730 keep in mind that performing this attack without authorization is illegal 00:05:37.730 --> 00:05:41.270 in most of the countries, and this means that if you use this attack in a 00:05:41.270 --> 00:05:43.970 company without their authorization, you may go to jail, 00:05:44.440 --> 00:05:48.560 especially for the Kerberoasting attack, so it is really important to 00:05:48.560 --> 00:05:52.140 stay legal. First, if you're working a red team project, 00:05:52.150 --> 00:05:54.420 make sure you have a letter of engagement from the client 00:05:54.480 --> 00:05:57.490 detailing the dates and the tasks that will be executed, as 00:05:57.490 --> 00:05:59.150 well as the types of attacks and scope. 00:06:00.140 --> 00:06:00.680 Also, 00:06:00.690 --> 00:06:04.030 it is really important to have a formal document signed by the client 00:06:04.040 --> 00:06:06.470 detailing and authorizing the attacks that you'll be performing. 00:06:06.940 --> 00:06:09.490 And this is the document that differentiates a criminal from 00:06:09.490 --> 00:06:12.240 a professional red team specialist. And, 00:06:12.240 --> 00:06:13.420 as a personal recommendation, 00:06:13.430 --> 00:06:15.700 always consult the client before executing any 00:06:15.700 --> 00:06:17.260 attack that may impact the network. 00:06:17.840 --> 00:06:18.880 So, bottom line, 00:06:19.020 --> 00:06:23.640 don't be a criminal. Before we go to our demo, let's have a 00:06:23.640 --> 00:06:25.650 quick recap on how this attack works. 00:06:26.340 --> 00:06:28.450 Let's say you're working on a red team engagement in a 00:06:28.450 --> 00:06:31.830 specific client. In the beginning of the engagement, using 00:06:31.830 --> 00:06:35.750 malware in a phishing email, you're able to get access to someone's laptop, 00:06:36.140 --> 00:06:38.950 and this means that now you have remote access to their Windows 00:06:38.950 --> 00:06:41.060 machine and their machine is in the domain. 00:06:42.340 --> 00:06:46.250 So then, you download the ADRecon tool on that machine or you 00:06:46.250 --> 00:06:48.250 simply run it from memory using PowerShell. 00:06:49.340 --> 00:06:52.950 Then with ADRecon you'll be able to query the Active Directory, 00:06:52.960 --> 00:06:55.160 which you would then return as a detailed report 00:06:55.160 --> 00:06:56.660 with a lot of useful information. 00:06:57.840 --> 00:07:02.040 Then we can extract this information to our attacking machine, and then use 00:07:02.040 --> 00:07:06.200 this data to plan another attack such as password sprays or the Kerberoasting 00:07:06.200 --> 00:07:10.610 attack. Even though this looks like a really simple attack, you've seen our 00:07:10.610 --> 00:07:12.460 demos how effective this attack is. 00:07:14.340 --> 00:07:16.080 If you want to get the most out of this course, 00:07:16.190 --> 00:07:19.800 I do recommend you creating a small lab environment so you can practice this 00:07:19.800 --> 00:07:24.080 attack. In here, I'm using a simple Windows 2016 domain, 00:07:24.090 --> 00:07:28.360 which includes a Windows 2016 domain controller and a Windows workstation. 00:07:28.940 --> 00:07:32.150 Or, in other words, all you need is a laptop connected to a domain. 00:07:33.440 --> 00:07:34.400 In addition to this, 00:07:34.410 --> 00:07:38.570 I'll use a Kali Linux virtual machine as my attacker machine. And 00:07:38.570 --> 00:07:41.820 this machine is totally optional, but I will use this Kali Linux to 00:07:41.820 --> 00:07:43.750 remote desktop into the Windows machines. 00:07:44.540 --> 00:07:45.920 So, enough with talking, 00:07:45.930 --> 00:07:49.070 let's go to our demo and see how to harvest information from the Active 00:07:49.070 --> 00:07:51.650 Directory, and how to use this information in some attacks.