In the last skill we were taking a look at understanding Active Directory as far as the
actual structure and some of the network traffic going on behind the scenes for authentication
purposes. Now that's taking a look at it from the inside of the network and how the network traffic
goes to and from, but we still want to continue our learning into how Active Directory performs
and what information we can get from it through the process of enumeration. Now this is going
to be broken down into two skills. We're going to be doing manual enumeration first as that's
the tongue twister for us on this portion, and then we'll be getting into automating the process.
Now I want to go through manual first because there's a lot of different ways to do this
and we're only going to be hitting like the classics. And the reason for this is,
is that it reinforces our understanding of not only Active Directory altogether,
but built out a tool set just in case we're unable to automate some of the scripts inside
of things like Metasploit. Now there are many different ways to do this as I just mentioned,
so don't think that what we go through in this skill is the only way to do enumeration inside
of an Active Directory environment or any environment for that matter. You could always
add to this and you can even take away some things that you don't like about this, but the point
behind all of it is to have the building blocks together for us and the basic understanding of
what some of these services and devices are. Now as we go through this skill, there's
the key point areas that we want to take a look at, and especially when we're pulling data out
of that domain environment. Now we want to look for servers and computers because we want to be
able to identify specific services, roles, and features like DNS, HTTP servers, databases,
you know, all sorts of different things. And those tie into the importance of what data we can get
and what security protocols are put in place by the actual security and defense teams.
The different computers we get into because we may find that there's like a marketing team
and we want to test and see if there's PII on their desktop and if it's not
properly secured. Now are we getting that deep into this skill and the others? No, but there's
something I do want you to remember moving forward because what we do in the upcoming skills to start
closing out our course together ties into very tightly the rules and procedures set forth in
the actual pentesting guidelines along with what we're actually pentesting for. It's based on the
organization's standard of security and also regulatory compliance depending on the organization
that we're dealing with. Let's say like a bank or something like that or a medical where we have to
deal with HIPAA. So that organization is not only asking us to come in and pentest to see if we can
break in for basic security, but they're also going to be asking us to come in and pentest against
regulatory defenses that should be put into place. So we shouldn't be able to go to a user's
workstation and find patient information in that healthcare environment on their desktop in an
unencrypted form. So if we do, that's definitely something that we have to take a note of and start
moving forward. So as we start closing the course out, do remember not only do we hit on the scope
and the rules of engagement and everything like that, but we also need to consider some of the
rules and procedures and policies that are in place by the organization and what specific things
that we're starting to look for. This also ties into users and groups on the domain as well,
because different users have different levels of permissions and rights and points of access,
along with the groups as well, because we know that we can make a domain administrator group
called something other than domain administrators. We could have the old school power users going
back to those Windows Server 2000, 2003 days when it started getting hip to categorize groups like
that. But we also could have, let's say, a group of users that has access to patient data. We'll
call it patient advocacy for the actual group name, and those folks will have access to different
resources based on the rights and permissions granted to them through the actual security policy
through group policy, and also the different file shares and permissions for individual folders,
et cetera, et cetera. And this, again, ties into not only being able to break into something,
but break into something with purpose of testing the defenses of both technical and administrative
security controls in mind for the overall structure of the organization.
Now, I already alluded on policy, and that's because we're going to be looking inside of this
skill to enumerate the actual group policy information. And the reason this becomes
important, we'll expand on this here in a little bit, but group policy is the overall end-all,
be-all policy in how servers, workstations, other types of computers within the organization,
users, groups, data, networking, everything. It's the registry without being the registry,
and it applies all the security templates down to the most lowest level within that
Active Directory structure. It is the implementation that crosses the bridge from
administrative control to technical control. And it will overwrite local security policy
if there is a stronger, secure, or more complex method to do things. For instance,
if a workstation has a password requirement that only has a minimum length, but no complexity
requirements, and group policy does include complexity requirements, but nothing about the
length, the length will stay, but the complexity requirements will be added to that workstation's
local security policy as an overwrite. So, if we're able to enumerate the group policy settings,
we get a base understanding of what it is that we're fighting against, instead of just going
in blind and looking for vulnerabilities to exploit. Now, last, we're going to be looking
at the actual network information, because we've stated before that there are different
segments of networks, a lot of folks VLAN, a lot of folks have a geo-dislocation going on
within their organization for a cloud infrastructure, or even a hybrid environment.
So, it's good to know where all those different places are, where all the systems sit inside of
the organization, and it definitely ties into understanding the scope that we're allowed to
play with. Because if, let's say, we have a very finite scope of systems that we're not allowed to
touch, and it's not just, let's say, a subnet, it's one or two systems within different portions
of the networking segments, that's something we might want to pay attention to, and we can't just
go out and do like an NMAC sweep of a full subnet if there's one in there. Or, if they just come back
and say, and I've seen this actually happen inside of a scope statement inside of a rules of engagement,
they say, you can mess with everything except for site X. And for site X, they don't give us
any IP addresses because that was a classification even above what I needed to know. So, as long as
the actual system was not included in that site, we were good. How did we know? Well, that's where
we got into Active Directory Sites and Services, and we will be touching on that because that does
fall within the actual network enumeration process of Active Directory. So, without further ado,
let's go ahead and start up our manual enumeration, and we'll be using things like PowerShell and LDAP.