38. Active Directory Attacks and Defence
38.3 Enumeration of AD
Foothold nantar (lab user password tumhi set kela) attacker directory map karto – users, groups, computers, sessions, ACLs.
NetExec (nxc) LDAP / SMB – modern Swiss army (lab):
# After you created lab user shahrukh (password YOU set) – lab only
nxc ldap 192.168.56.30 -u shahrukh -p 'YourLabPass!' --users
nxc smb 192.168.56.30 -u shahrukh -p 'YourLabPass!' --shares
Impacket basics (Kali often has impacket-* scripts):
# List domain users via LDAP-oriented helper (lab creds only)
GetADUsers.py sahyadri.lab/shahrukh:'YourLabPass!'@192.168.56.30 -all
# Secrets on DC need DA-level rights – do NOT run secretsdump until YOUR lab DA lab step
# secretsdump.py is Chapter theme in 38.5 – only on systems you own
BloodHound collectors: SharpHound (Windows) / bloodhound-python (from Kali) collect relationships into a zip for neo4j UI. Concept: who can admin what, who has sessions where. Run collectors only in lab with lab creds.
Defence: monitor LDAP enumeration patterns; protect privileged groups; no unnecessary nested groups; LAPS for local admin; tiering. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
nxc ldap / GetADUsers.py / BloodHound collect after any valid user |
Alert on mass LDAP queries; UEBA; restrict who can read sensitive attributes |
Looks for Domain Admins, AdminSDHolder, SPN accounts |
Privileged group change auditing (4728/4732); periodic BloodHound as Blue |
| Enumerates shares for creds files | Share auditing; block plaintext password files; DLP |
Ravindra Bagale's Tip
Students BloodHound GUI baghun "hack zhala" mhantat. Collection = map; path still abuse karaycha. Blue pan BloodHound vaprun paths kam karto – he interview gold aahe. Tool attacker-only nahi.
Lab
Lab user ne nxc ldap 192.168.56.30 -u shahrukh -p '...' --users chalaa. User count note kara. Mag bloodhound-python / SharpHound lab DC/client against collect (docs on Kali). Import zip → find shortest path from shahrukh to Domain Admins (path nahi asel tar changla!). Screenshot.
Real incident: NotPetya lateral era (2017)
NotPetya (reported widely by national CERTs and major outlets) spread inside networks using stolen credentials and SMB-based lateral movement patterns after initial foothold – identity and file-share trust became the highway. Defence theme: credential hygiene, SMB hardening, segmentation, rapid isolation. Source: national CERT advisories and contemporary major news analyses (verify).