LDAP Reconnaissance

The adversary uses the compromised credentials to authenticate to the VPN and gain network access, and then uses those same credentials to query Active Directory. They can enumerate Active Directory using the ActiveDirectory PowerShell module, or automate the discovery using tools like BloodHound and PowerSploit. In this example, the adversary uses PowerShell to look for possible passwords in users’ description attributes:

PS> Import-Module ActiveDirectory
PS> Get-ADObject -LDAPFilter "(&(objectClass=user)(description=*pass*))" -property * | Select-Object SAMAccountName, Description, DistinguishedName
 
SAMAccountName Description                 DistinguishedName
-------------- -----------                 -----------------
Alice          Password: P@ssw0rd123!      CN=Alice,OU=Users,DC=domain,DC=com
 
PS> 

Using the credentials they have found, the adversary conducts further internal reconnaissance using tools like BloodHound and SharpHound, which assist with untangling complex webs of permissions. Using this information, the adversary can map out pathways to objectives, such as domain dominance.

The graphic below illustrates an example. Suppose an attacker gains the credentials for the user account Alice. That account has WriteDACL and WriteOwner permissions to the user Eve, which means Alice can grant herself access to Eve’s account. Eve has rights to reset the password of the account Bob, and Bob has permissions (granted through AdminSDHolder propagation) to modify the Domain Admins group. Therefore, finding Alice’s password was very valuable the adversary!

Result

After collecting data with SharpHound.exe -C All the adversary can load the data set into BloodHound to explore pathways to domain dominance.