Active Directory: Post-Compromise Enumeration

Question 1

When using a powershell script like PowerView, what command do we have to run to ensure the correct execution of the script? Explain it.

Answer 1

powershell -ep bypass

The -ep flag stands for Execution Policy and it is used to avoid executing scripts by accident, so the bypass policy enables the execution of ps1 scripts.

Question 2

Using PowerView

What command can be used to see a Domain Policy in more detail?

Answer 2

Get-DomainPolicy."policy name"

Question 3

Using PowerView

What command can be used to see logon counter for domain accounts? Why should you avoid attacking accounts with a 0 counter value?

Answer 3

Get-UserProperty -Properties logoncount

Accounts with a zeroed logon counter might be a honeypot account.

Question 4

What are the commands used to set Bloodhound up?

Answer 4

$ neo4j console && bloodhound

Question 5

Using Bloodhound

What kind of tool is used to grab AD data?

Answer 5

An ingestor like SharpHound.

Question 6

What can be done with Bloodhound?
1 - Look for Domain Admin accounts.
2 - Identify high-value targets in the domain.
3 - Ensure persistent access to the domain.

Answer 6

1 and 2.