> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/get-group-information-remotely.md).

# Get Group Information Remotely

## Get Group Information

### Get group info with Impacket

#### Get group info with net.py

[net.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/net.py) is an Impacket alternative for windows net.exe commandline utility. Thanks to RPC protocol, this tool is making net.exe functionalities available from remote computer.

To get information on a specific domain group

```bash
impacket-net domain.local/user:password@$TARGET_IP group -name "<dom_group>"
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ impacket-net corp.com/jeff:'HenchmanPutridBonbon11'@$TARGET_IP group -name "Domain Admins"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

  1. Administrator
  2. jeffadmin

```

</details>

To get information on a specific local group

```bash
impacket-net domain.local/user:password@$TARGET_IP localgroup -name "<local_group>"
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ impacket-net corp.com/jeff:'HenchmanPutridBonbon11'@$TARGET_IP localgroup -name "Administrators"
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

  1. Administrator
  2. Enterprise Admins
  3. Domain Admins
  4. jeffadmin

```

</details>

### Enumeration with net from Samba

To list members of a domain groups via DCE/RPC

```bash
net rpc group members "<group>" -U domain.local/user%'Password' -S $TARGET_IP
```

Note that `%` is used as delimiter instead of `:` as in Impacket!

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ net rpc group members "Domain Admins" -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP
CORP\Administrator
CORP\jeffadmin
```

</details>

#### Usage information

<details>

<summary>net help group</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ net help group                                             
net [<method>] group [misc. options] [targets]
        List user groups

net rpc group LIST [global|local|builtin]* [misc. options]
        List specific user groups

net [<method>] group DELETE <name> [misc. options] [targets]
        Delete specified group

net [<method>] group ADD <name> [-C comment] [-c container] [misc. options] [targets]
        Create specified group

net rpc group MEMBERS <name>
        List Group Members


net rpc group ADDMEM <group> <member>
        Add Group Members


net rpc group DELMEM <group> <member>
        Delete Group Members

Valid methods: (auto-detected if not specified)
        ads                             Active Directory (LDAP/Kerberos)
        rpc                             DCE-RPC
        rap                             RAP (older systems)

Valid targets: choose one (none defaults to localhost)
        -S|--server=<server>                    server name
        -I|--ipaddress=<ipaddr>                 address of target server
        -w|--target-workgroup=<wg>              target workgroup or domain

Valid misc options are:
        -p|--port=<port>                        connection port on target
        --myname=<name>                         client name
        --long                                  Display full information

Valid common options are:
        -d|--debuglevel=<level>                 debug level (0-10)
        --debug-stdout                          Send debug output to standard output
        --configfile=<path>                     pathname of smb.conf file
        --option=name=value                     Set smb.conf option from command line
        -l|--log-basename=LOGFILEBASE           Basename for log/debug files
        --leak-report                           enable talloc leak reporting on exit
        --leak-report-full                      enable full talloc leak reporting on exit
        -V|--version                            Print samba version information

Valid connection options are:
        -R|--name-resolve=NAME-RESOLVE-ORDER    Use these name resolution services only
        -O|--socket-options=SOCKETOPTIONS       socket options to use
        -m|--max-protocol=MAXPROTOCOL           Set max protocol level
        -n|--netbiosname=NETBIOSNAME            Primary netbios name
        --netbios-scope=SCOPE                   Use this Netbios scope
        -W|--workgroup=WORKGROUP                Set the workgroup name
        --realm=REALM                           Set the realm name

Valid credential options are:
        -U|--user=[DOMAIN/]USERNAME[%PASSWORD]  Set the network username
        -N|--no-pass                            Don't ask for a password
        --password=STRING                       Set a password
        --pw-nt-hash                            The supplied password is the NT hash
        -A|--authentication-file=FILE           Get the credentials from a file
        -P|--machine-pass                       Use stored machine account password
        --simple-bind-dn=DN                     DN to use for a simple bind
        --use-kerberos=desired|required|off     Use kerberos authentication
        --use-krb5-ccache=CCACHE                Credentials cache location for Kerberos
        --use-winbind-ccache                    Use the winbind ccache for authentication
        --client-protection=sign|encrypt|off    Configure used protection for client connections
        -C or --comment=<comment>       descriptive comment (for add only)
        -c or --container=<container>   LDAP container, defaults to cn=Users (for add in ADS only)
        -L or --localgroup              When adding groups, create a local group (alias)

```

</details>

## Resources

**Impacket** - GitHub: <https://github.com/fortra/impacket>

**Impacket** - Homepage: <https://www.coresecurity.com/core-labs/impacket>

**Impacket** - Kali Tools: <https://www.kali.org/tools/impacket/>

**Impacket-scripts** - Kali Tools: <https://www.kali.org/tools/impacket-scripts/>