Now inside of our lab, I'm on the client VM here inside of Active Directory. I want to show you real quick that on the desktop there is a folder on the right side.
I'll zoom in here for you right there called AD Scripts. I'm sure you can see it right over there.
And inside of that AD Scripts folder are four scripts that I have. Description, Group Member, Site, and Stale.
And we're going to be taking a look at them inside of Windows PowerShell ISE. Now there's a couple of reasons for this.
One, I want to show you the code and the results at the same time. And I also want to make sure that you can see that there's nothing up my sleeve as we're running these.
And side note, it allows me to make any corrections behind the scenes in case I goof something up here.
Because for those that have been keeping score, I have been using my Red Team Field Manual to be able to do this.
And I referenced that earlier on in the course itself. And so I would highly recommend you either take the notes out of this or start building up your own manual.
You don't necessarily have to buy anything out there. There are plenty of things in this skill and many others across CBT Nuggets that you can fill your notes out on.
Stuff just like what we're seeing here.
Now the first one that we're taking a look at I call description. And I'm going to go ahead and hit the play button and show you here real quick.
What this is doing is it's querying the Active Directory LDAP and looking at basically users on the Active Directory and their description.
Now I know that there's not very many users on here. In fact, there's only four.
And one of them is locked out. But you have Administrator Guest and that's the locked out one.
KRBTGT, we'll definitely come back to that account later. It's a hidden account.
But there's also Eric. And you can see there that I put description test in there inside of Active Directory Users and Computers.
And that was just to make sure that this script ran and I was actually on the right track here.
Now this is basically a way for you to be able to go through and not only get a quick listing of all users within Active Directory.
Because this goes from the top base DN of DC equals Texas comma DC equals local.
And even though it's not in the PowerShell script.
Back over to the beginning of that real quick.
What it does is it actually goes through and does an LDAP search using ADSI.
And that's a tool we may come back to later on because there is some good info in there.
It's kind of like the group policy of group policy inside the domain itself.
Now that being said, you could see that we're looking for object class user and the object category of person.
So I don't want any groups in this. I don't want any wonky users like service accounts.
Well, yes, service accounts will come up, but basically I don't want groups.
And this will go through and allow me to see if there's any user in there that's unaccounted for.
Let's say that you have a description that says test admin.
That would be a target along with the fact that you go ahead and get a list of all users in the domain.
And since it's at the top level, being that it's at the top force level, you will get everybody to include sub-OUs down below.
Now this is just telling you who's there and who's on the server.
And hopefully if the organization is doing their job correctly in the help desk office, they're putting in proper descriptions.
Now if we move on over to stale, this one's a little bit more complicated of a script.
And I'm trying to put notes in here the best I can as far as the comments are concerned.
But the really big note about this one is this tells you if there is an account that's old and stale.
Meaning nobody has logged on to it in quite some time.
And the threshold for this one is 90 days.
And when you run it, nobody comes up with this.
Now you may be thinking to yourself, well Eric, that's not fair because this lab hasn't been up long and therefore nobody's logged in.
Or hasn't had the ability to not log in in 90 days.
Well, I'm glad you said that because in line five of this, I'm going to change this to zero just for a second.
And show you that when it does run, yep, it's going to save.
It does show you that every account that hasn't logged in in more than zero days.
So everybody.
And you can see that the administrator and Eric, as I zoom in for you here, have their name and the last logon time.
Now why is this important?
Well, knowing that there are accounts that are stale that haven't been deleted may indicate that those accounts are vulnerable to attack.
And they are flying under the radar.
Because generally, if a SOP is done correctly, and this is where pen testers help validate that standard operating procedure,
a user account that has been stale for longer than 90 days typically goes into a deletion cycle.
And the administrators there are bound by their SOP or how their organization does stuff to follow that.
And so if you see an account that's been there longer, it could indicate a couple things.
One, the user is on a very long leave of absence for whatever reason, and their account is still there.
Or two, the admins just forgot about it.
And if you find an administrator account, based on what your descriptions are showing,
that might be a target to look at because it's going to be something that shouldn't come up in their radar.
Now I'm going to change this back to 90 because these scripts are still saved to the desktop here.
And then that way, when you run it, it will act accordingly.
And then we have group membership.
And this is where we take those user accounts and their staleness and tie it to what group are they in.
Now when you run this one, I have this one at the top level as well.
And basically I'm looking for domain admins.
Now I'm going to zoom in and show you what I'm talking about here because this can be modified.
And I'm only doing this for one per group.
What's highlighted is domain admins.
If you find that there, let's say you want to look for users, and we'll run that here in a second.
But this right here shows you just who's in the domain admins group.
And so you can take a user, such as administrator, and it shows you where in the OU or structure of Active Directory it's at.
And if it's stale, you can try to attack it.
I mean, try to attack it anyway, but if it's stale, then that's a tip-off that that might be an account that's weaker in nature.
Now if I change this to domain users, based on the default configuration of our Active Directory,
because an administrator may change that to domain wizards before admins or whatever, and then you have to search for wizards all of a sudden.
If I go ahead and search that and save it, you'll see that Eric comes up.
Oh, nobody's a member of domain admins.
It just says that's the right host, members of domain admin.
Did I spell it correctly, or did I mess something up?
Let's take a look in here.
You can see that we have domain users, and I have Eric and administrator in there as well, so it should come up.
Why didn't it?
I may have mistyped something. Give me one second.
And as it turns out, all I have to do is learn how to type.
I even made a fake group or a test group called test group inside of Active Directory.
You can see it right here, and I added Eric to it.
And inside of my script, I just modified the name of the group that I'm searching for, test group.
And as you can see, I'll run it again so you can see.
Right there, you can see that Eric is a member of that group.
Now I know it says members of domain admins, but that's again modifying the right host stuff.
Now I'll change that back to domain admins for you, but I'm going to move on to sites real quick.
And this one right here is just a simple one-liner that basically gives us all the sites and services on the actual domain itself.
And I'm going to get into that here momentarily.