Enumerating AD Users
Username Generation
In Part 1, we found a list of employee names on the website: Greg Shields, Sarah J. Honen, Jack Dowand, and Laney Moore. To use these against Active Directory, we need to convert them into standard corporate username formats (e.g., first.last, flast, firstl).
Process:
Save the names into a comma-separated text file (e.g.,
users.csv).Use a generation tool. While tools like
username-anarchyare standard, simple Python scripts can also parse a CSV of first/last names and output a wordlist of common AD naming conventions.Save the output to a new file:
ad_users.txt.
Get these users in a file
Kerbrute - Internal AD Username Enumeration
Kerbrute can be a stealthier option for domain account enumeration. It takes advantage of the fact that Kerberos pre-authentication failures often will not trigger logs or alerts. We will use Kerbrute in conjunction with the jsmith.txt or jsmith2.txt user lists from Insidetrust. This repository contains many different user lists that can be extremely useful when attempting to enumerate users when starting from an unauthenticated perspective. We can point Kerbrute at the DC we found earlier and feed it a wordlist. The tool is quick, and we will be provided with results letting us know if the accounts found are valid or not, which is a great starting point for launching attacks such as password spraying, which we will cover in-depth later in this module.
To get started with Kerbrute, we can download precompiled binaries for the tool for testing from Linux, Windows, and Mac, or we can compile it ourselves. This is generally the best practice for any tool we introduce into a client environment. To compile the binaries to use on the system of our choosing, we first clone the repo:
Cloning Kerbrute GitHub Repo
Initial Enumeration of the Domain
Typing make help will show us the compiling options available.
Listing Compiling Options
Initial Enumeration of the Domain
We can choose to compile just one binary or type make all and compile one each for use on Linux, Windows, and Mac systems (an x86 and x64 version for each).
Compiling for Multiple Platforms and Architectures
Initial Enumeration of the Domain
The newly created dist directory will contain our compiled binaries.
Listing the Compiled Binaries in dist
Initial Enumeration of the Domain
We can then test out the binary to make sure it works properly. We will be using the x64 version on the supplied Parrot Linux attack host in the target environment.
Testing the kerbrute_linux_amd64 Binary
Initial Enumeration of the Domain
We can add the tool to our PATH to make it easily accessible from anywhere on the host.
Adding the Tool to our Path
Initial Enumeration of the Domain
Moving the Binary
Initial Enumeration of the Domain
We can now type kerbrute from any location on the system and will be able to access the tool. Feel free to follow along on your system and practice the above steps. Now let's run through an example of using the tool to gather an initial username list.
Enumerating Users with Kerbrute
Initial Enumeration of the Domain
We can see from our output that we validated 56 users in the INLANEFREIGHT.LOCAL domain and it took only a few seconds to do so. Now we can take these results and build a list for use in targeted password spraying attacks.
Identifying Valid Users with Netexec (Without users list)
But here's the problem... if we are starting with no credentials, how do we get a list of domain users?
Well, we have to rely on misconfigurations. We can test the Domain Controller to see if it will talk to us without forcing us to authenticate.
Explaining why this works is out-of-scope for this Guided Lab, but we'll make another one soon on initial access.
If any of these methods succeed, you now have a full list of usernames. Save those to a text file (i.e. usernames.txt or users.txt). They should have ONLY the usernames.
Last updated