🪟Credentialed Enumeration from Windows
📋 Overview
After gaining valid domain credentials, enumeration from a Windows attack host provides access to powerful native tools and specialized AD enumeration frameworks. Windows-based enumeration offers deeper integration with AD infrastructure, access to PowerShell modules, and the ability to leverage tools that can provide comprehensive domain intelligence and attack path visualization.
🎯 Strategic Context
🎪 Windows vs Linux Enumeration Advantages
Native Integration: Direct access to AD PowerShell modules and cmdlets
Stealth Operations: Blend in with legitimate administrative activities
Comprehensive Data: More detailed attribute and permission enumeration
Visual Analysis: Advanced attack path visualization with BloodHound GUI
🛠️ Key Tools & Techniques
ActiveDirectory PowerShell Module: Native Microsoft AD administration cmdlets
PowerView: Advanced AD reconnaissance and analysis framework
SharpView: .NET port of PowerView for modern environments
Snaffler: Automated sensitive file discovery across domain shares
BloodHound: Attack path visualization and relationship analysis
🔧 ActiveDirectory PowerShell Module
📝 Overview
The ActiveDirectory PowerShell module contains 147+ cmdlets for comprehensive AD administration and enumeration. When available on domain-joined hosts (especially admin workstations), it provides native, stealth-friendly enumeration capabilities.
🔍 Module Discovery and Loading
Example Discovery Output:
🏰 Domain Information Gathering
Key Information Retrieved:
👥 User Enumeration
Example Kerberoastable User Output:
🔗 Trust Relationship Enumeration
Example Trust Output:
🏷️ Group Management
Example Group Analysis:
⚡ PowerView
📝 Overview
PowerView is an advanced PowerShell framework for AD reconnaissance and situational awareness. It provides comprehensive enumeration capabilities, relationship analysis, and attack path identification through extensive cmdlet collections.
📊 Core PowerView Functions
Category
Key Functions
Purpose
Domain/LDAP
Get-Domain, Get-DomainController, Get-DomainUser
Core domain enumeration
Groups
Get-DomainGroup, Get-DomainGroupMember
Group and membership analysis
Computers
Get-DomainComputer, Get-NetShare, Get-NetSession
Host and share enumeration
GPO
Get-DomainGPO, Get-DomainPolicy
Group Policy analysis
ACL
Find-InterestingDomainAcl
Permission and ACL enumeration
Trust
Get-DomainTrust, Get-ForestTrust
Trust relationship mapping
Meta
Find-DomainUserLocation, Find-LocalAdminAccess
Advanced discovery functions
👤 User Enumeration and Analysis
Example Detailed User Output:
🔄 Recursive Group Membership Analysis
Example Recursive Output:
🔗 Trust Relationship Mapping
Example Trust Mapping:
🔐 Administrative Access Testing
Example Admin Access Output:
🎫 Kerberoastable Account Discovery
Example SPN Output:
🔨 SharpView
📝 Overview
SharpView is a .NET port of PowerView, providing similar functionality while avoiding PowerShell detection mechanisms. It's particularly useful in environments with PowerShell restrictions or advanced monitoring.
🔍 Basic Usage
Example SharpView Help Output:
Example User Enumeration:
📁 Snaffler
📝 Overview
Snaffler automates the discovery of sensitive files across domain shares by enumerating hosts, shares, and readable directories, then hunting for files that could enhance our position in the assessment.
🚀 Basic Execution
Command Breakdown:
-s: Print results to console-d: Specify domain to search-o: Write results to log file-v data: Verbosity level (data = only display results)
🔍 Example Snaffler Output
🎯 Sensitive File Categories
Color Code
Risk Level
File Types
Examples
Red
High
Keys, configs, dumps
.key, .config, .sqldump, .mdf
Black
Medium
Encrypted stores
.kdb, .kwallet, .ppk, .psafe3
Green
Low
Shares discovered
Available network shares
🩸 BloodHound
📝 Overview
BloodHound provides visual analysis of AD attack paths by mapping relationships between users, computers, groups, and permissions. The SharpHound collector gathers comprehensive data for upload to the BloodHound GUI.
🔧 SharpHound Data Collection
Example SharpHound Execution:
📊 BloodHound GUI Analysis
🔍 Key BloodHound Queries
🎯 High-Impact Pre-built Queries
💎 Advanced Custom Queries
🎯 HTB Academy Lab Solutions
📝 Lab Questions & Solutions
🔍 Question 1: "Using Bloodhound, determine how many Kerberoastable accounts exist within the INLANEFREIGHT domain. (Submit the number as the answer)"
Solution Process:
Expected Answer Format: [number] (e.g., 13)
⚡ Question 2: "What PowerView function allows us to test if a user has administrative access to a local or remote host?"
Solution:
Expected Answer: Test-AdminAccess
📁 Question 3: "Run Snaffler and hunt for a readable web config file. What is the name of the user in the connection string within the file?"
Solution Process:
Expected Answer Format: [username] (e.g., sqlservice)
🔐 Question 4: "What is the password for the database user?"
Solution Process:
Expected Answer Format: [password] (e.g., MyV3ryStr0ngP@ssw0rd!)
🔧 Advanced Enumeration Techniques
🎯 Comprehensive User Analysis
🖥️ Computer and Service Analysis
🔐 Permission and ACL Analysis
⚡ Quick Reference Commands
🔧 Essential One-Liners
🔍 Data Analysis and Correlation
🔑 Key Takeaways
✅ Windows Enumeration Advantages
Native Tool Integration: Access to ActiveDirectory PowerShell module and built-in cmdlets
Stealth Operations: Blend in with legitimate administrative activities
Comprehensive Analysis: Deep attribute and relationship enumeration
Visual Intelligence: BloodHound provides unmatched attack path visualization
🎯 Strategic Priorities
Kerberoastable Accounts: Identify service accounts with SPNs for credential extraction
Administrative Rights: Map local admin access across domain systems
Sensitive File Discovery: Use Snaffler to find configuration files and credentials
Attack Path Analysis: Leverage BloodHound for relationship mapping and privilege escalation paths
Trust Relationships: Understand cross-domain attack opportunities
⚠️ Operational Considerations
Tool Placement: Document all tools transferred to domain systems
Artifact Cleanup: Remove tools and logs at engagement conclusion
Stealth vs Speed: Balance comprehensive enumeration with detection avoidance
Data Correlation: Cross-reference findings from multiple tools for accuracy
🚀 Next Steps After Enumeration
Kerberoasting: Extract and crack service account credentials
ASREPRoasting: Target accounts without Kerberos pre-authentication
Privilege Escalation: Exploit identified admin rights and permissions
Lateral Movement: Use discovered credentials and access rights for network traversal
Windows-based credentialed enumeration provides the deepest insight into Active Directory environments - leveraging native tools and comprehensive frameworks to map the entire domain landscape and identify critical attack paths.
Last updated