> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/group-enumeration-remotely.md). # Group Enumeration Remotely ## Enumeration via LDAP ### Enumeration with NetExec To enumerate all groups with `nxc` over LDAP ```bash nxc ldap $TARGET_IP -u '' -p '' --groups ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ nxc ldap $TARGET_IP -u 'stephanie' -p 'LegmanTeamBenzoin!!' --groups [*] Initializing LDAP protocol database LDAP 192.168.210.70 389 DC1 [*] Windows Server 2022 Build 20348 (name:DC1) (domain:corp.com) (signing:None) (channel binding:No TLS cert) LDAP 192.168.210.70 389 DC1 [+] corp.com\stephanie:LegmanTeamBenzoin!! LDAP 192.168.210.70 389 DC1 -Group- -Members- -Description- LDAP 192.168.210.70 389 DC1 Administrators 4 Administrators have complete and unrestricted access to the computer/domain LDAP 192.168.210.70 389 DC1 Users 3 Users are prevented from making accidental or intentional system-wide changes and can run most applications LDAP 192.168.210.70 389 DC1 Guests 2 Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted LDAP 192.168.210.70 389 DC1 Print Operators 0 Members can administer printers installed on domain controllers LDAP 192.168.210.70 389 DC1 Backup Operators 0 Backup Operators can override security restrictions for the sole purpose of backing up or restoring files LDAP 192.168.210.70 389 DC1 Replicator 0 Supports file replication in a domain LDAP 192.168.210.70 389 DC1 Remote Desktop Users 0 Members in this group are granted the right to logon remotely LDAP 192.168.210.70 389 DC1 Network Configuration Operators 0 Members in this group can have some administrative privileges to manage configuration of networking features LDAP 192.168.210.70 389 DC1 Performance Monitor Users 0 Members of this group can access performance counter data locally and remotely LDAP 192.168.210.70 389 DC1 Performance Log Users 0 Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer LDAP 192.168.210.70 389 DC1 Distributed COM Users 0 Members are allowed to launch, activate and use Distributed COM objects on this machine. LDAP 192.168.210.70 389 DC1 IIS_IUSRS 1 Built-in group used by Internet Information Services. LDAP 192.168.210.70 389 DC1 Cryptographic Operators 0 Members are authorized to perform cryptographic operations. LDAP 192.168.210.70 389 DC1 Event Log Readers 0 Members of this group can read event logs from local machine LDAP 192.168.210.70 389 DC1 Certificate Service DCOM Access 0 Members of this group are allowed to connect to Certification Authorities in the enterprise LDAP 192.168.210.70 389 DC1 RDS Remote Access Servers 0 Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group. LDAP 192.168.210.70 389 DC1 RDS Endpoint Servers 0 Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group. LDAP 192.168.210.70 389 DC1 RDS Management Servers 0 Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group. LDAP 192.168.210.70 389 DC1 Hyper-V Administrators 0 Members of this group have complete and unrestricted access to all features of Hyper-V. LDAP 192.168.210.70 389 DC1 Access Control Assistance Operators 0 Members of this group can remotely query authorization attributes and permissions for resources on this computer. LDAP 192.168.210.70 389 DC1 Remote Management Users 0 Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user. LDAP 192.168.210.70 389 DC1 Storage Replica Administrators 0 Members of this group have complete and unrestricted access to all features of Storage Replica. LDAP 192.168.210.70 389 DC1 Domain Computers 0 All workstations and servers joined to the domain LDAP 192.168.210.70 389 DC1 Domain Controllers 0 All domain controllers in the domain LDAP 192.168.210.70 389 DC1 Schema Admins 1 Designated administrators of the schema LDAP 192.168.210.70 389 DC1 Enterprise Admins 1 Designated administrators of the enterprise LDAP 192.168.210.70 389 DC1 Cert Publishers 0 Members of this group are permitted to publish certificates to the directory LDAP 192.168.210.70 389 DC1 Domain Admins 2 Designated administrators of the domain LDAP 192.168.210.70 389 DC1 Domain Users 0 All domain users LDAP 192.168.210.70 389 DC1 Domain Guests 0 All domain guests LDAP 192.168.210.70 389 DC1 Group Policy Creator Owners 1 Members in this group can modify group policy for the domain LDAP 192.168.210.70 389 DC1 RAS and IAS Servers 0 Servers in this group can access remote access properties of users LDAP 192.168.210.70 389 DC1 Server Operators 0 Members can administer domain servers LDAP 192.168.210.70 389 DC1 Account Operators 0 Members can administer domain user and group accounts LDAP 192.168.210.70 389 DC1 Pre-Windows 2000 Compatible Access 1 A backward compatibility group which allows read access on all users and groups in the domain LDAP 192.168.210.70 389 DC1 Incoming Forest Trust Builders 0 Members of this group can create incoming, one-way trusts to this forest LDAP 192.168.210.70 389 DC1 Windows Authorization Access Group 1 Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects LDAP 192.168.210.70 389 DC1 Terminal Server License Servers 0 Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage LDAP 192.168.210.70 389 DC1 Allowed RODC Password Replication Group 0 Members in this group can have their passwords replicated to all read-only domain controllers in the domain LDAP 192.168.210.70 389 DC1 Denied RODC Password Replication Group 8 Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain LDAP 192.168.210.70 389 DC1 Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the domain LDAP 192.168.210.70 389 DC1 Enterprise Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the enterprise LDAP 192.168.210.70 389 DC1 Cloneable Domain Controllers 0 Members of this group that are domain controllers may be cloned. LDAP 192.168.210.70 389 DC1 Protected Users 0 Members of this group are afforded additional protections against authentication security threats. See http://go.microsoft.com/fwlink/?LinkId=298939 for more information. LDAP 192.168.210.70 389 DC1 Key Admins 0 Members of this group can perform administrative actions on key objects within the domain. LDAP 192.168.210.70 389 DC1 Enterprise Key Admins 0 Members of this group can perform administrative actions on key objects within the forest. LDAP 192.168.210.70 389 DC1 DnsAdmins 0 DNS Administrators Group LDAP 192.168.210.70 389 DC1 DnsUpdateProxy 0 DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers). LDAP 192.168.210.70 389 DC1 Sales Department 3 LDAP 192.168.210.70 389 DC1 Management Department 1 LDAP 192.168.210.70 389 DC1 Development Department 3 LDAP 192.168.210.70 389 DC1 Debug 0 LDAP 192.168.210.70 389 DC1 Billing 0 LDAP 192.168.210.70 389 DC1 Customer support 0 LDAP 192.168.210.70 389 DC1 Operators 0 LDAP 192.168.210.70 389 DC1 IT Service Desk 0 LDAP 192.168.210.70 389 DC1 OS{4260975db0ff61c496eb9e6207608a06} 0 LDAP 192.168.210.70 389 DC1 Service Personnel 0 ```
To enumerate a members of a specific group, such as `Domain Admins` ```bash nxc ldap $TARGET_IP -u '' -p '' --groups "Domain Admins" ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ nxc ldap $TARGET_IP -u 'stephanie' -p 'LegmanTeamBenzoin!!' --groups "Domain Admins" LDAP 192.168.210.70 389 DC1 [*] Windows Server 2022 Build 20348 (name:DC1) (domain:corp.com) (signing:None) (channel binding:No TLS cert) LDAP 192.168.210.70 389 DC1 [+] corp.com\stephanie:LegmanTeamBenzoin!! LDAP 192.168.210.70 389 DC1 Administrator LDAP 192.168.210.70 389 DC1 jeffadmin ```
## Enumeration via SMB and RPC/DCE ### Enumeration with Impacket #### Enumeration with lookupsid.py To enumerate domain users and groups with [lookupsid.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/lookupsid.py). The enumeration is done by RID brute forcing. As Guest user ```bash impacket-lookupsid Guest:@$TARGET_IP -no-pass ``` With credentials ```bash impacket-lookupsid 'stephanie:LegmanTeamBenzoin!!'@$TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ impacket-lookupsid 'stephanie:LegmanTeamBenzoin!!'@$TARGET_IP Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Brute forcing SIDs at 192.168.210.70 [*] StringBinding ncacn_np:192.168.210.70[\pipe\lsarpc] [*] Domain SID is: S-1-5-21-1987370270-658905905-1781884369 498: CORP\Enterprise Read-only Domain Controllers (SidTypeGroup) 500: CORP\Administrator (SidTypeUser) 501: CORP\Guest (SidTypeUser) 502: CORP\krbtgt (SidTypeUser) 512: CORP\Domain Admins (SidTypeGroup) 513: CORP\Domain Users (SidTypeGroup) 514: CORP\Domain Guests (SidTypeGroup) 515: CORP\Domain Computers (SidTypeGroup) 516: CORP\Domain Controllers (SidTypeGroup) 517: CORP\Cert Publishers (SidTypeAlias) 518: CORP\Schema Admins (SidTypeGroup) 519: CORP\Enterprise Admins (SidTypeGroup) 520: CORP\Group Policy Creator Owners (SidTypeGroup) 521: CORP\Read-only Domain Controllers (SidTypeGroup) 522: CORP\Cloneable Domain Controllers (SidTypeGroup) 525: CORP\Protected Users (SidTypeGroup) 526: CORP\Key Admins (SidTypeGroup) 527: CORP\Enterprise Key Admins (SidTypeGroup) 553: CORP\RAS and IAS Servers (SidTypeAlias) 571: CORP\Allowed RODC Password Replication Group (SidTypeAlias) 572: CORP\Denied RODC Password Replication Group (SidTypeAlias) 1000: CORP\DC1$ (SidTypeUser) 1101: CORP\DnsAdmins (SidTypeAlias) 1102: CORP\DnsUpdateProxy (SidTypeGroup) 1103: CORP\dave (SidTypeUser) 1104: CORP\stephanie (SidTypeUser) 1105: CORP\jeff (SidTypeUser) 1106: CORP\jeffadmin (SidTypeUser) 1109: CORP\iis_service (SidTypeUser) 1112: CORP\WEB04$ (SidTypeUser) 1118: CORP\FILES04$ (SidTypeUser) 1121: CORP\CLIENT74$ (SidTypeUser) 1122: CORP\CLIENT75$ (SidTypeUser) 1123: CORP\pete (SidTypeUser) 1124: CORP\jen (SidTypeUser) 1125: CORP\Sales Department (SidTypeGroup) 1126: CORP\Management Department (SidTypeGroup) 1127: CORP\Development Department (SidTypeGroup) 1128: CORP\Debug (SidTypeGroup) 1129: CORP\CLIENT76$ (SidTypeUser) ```
#### Enumeration with net.py [net.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/net.py) is an Impacket alternative for windows net.exe commandline utility. Thanks to RPC protocol, this tool is making net.exe functionalities available from remote computer. To enumerate all domain groups ```bash impacket-net domain.local/user:password@$TARGET_IP group ``` To enumerate all local groups ```bash impacket-net domain.local/user:password@$TARGET_IP localgroup ``` ### Enumeration with net from Samba To list domain groups via DCE/RPC ```bash net rpc group -U domain.local/user%'Password' -S $TARGET_IP ``` Note that `%` is used as delimiter instead of `:` as in Impacket!
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ net rpc group -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP Cloneable Domain Controllers Debug Development Department DnsUpdateProxy Domain Admins Domain Computers Domain Controllers Domain Guests Domain Users Enterprise Admins Enterprise Key Admins Enterprise Read-only Domain Controllers Group Policy Creator Owners Key Admins Management Department Protected Users Read-only Domain Controllers Sales Department Schema Admins Cert Publishers RAS and IAS Servers Allowed RODC Password Replication Group Denied RODC Password Replication Group DnsAdmins Server Operators Account Operators Pre-Windows 2000 Compatible Access Incoming Forest Trust Builders Windows Authorization Access Group Terminal Server License Servers Administrators Users Guests Print Operators Backup Operators Replicator Remote Desktop Users Network Configuration Operators Performance Monitor Users Performance Log Users Distributed COM Users IIS_IUSRS Cryptographic Operators Event Log Readers Certificate Service DCOM Access RDS Remote Access Servers RDS Endpoint Servers RDS Management Servers Hyper-V Administrators Access Control Assistance Operators Remote Management Users Storage Replica Administrators ```
#### Usage information
net help group ```bash ┌──(kali㉿kali)-[~] └─$ net help group net [] group [misc. options] [targets] List user groups net rpc group LIST [global|local|builtin]* [misc. options] List specific user groups net [] group DELETE [misc. options] [targets] Delete specified group net [] group ADD [-C comment] [-c container] [misc. options] [targets] Create specified group net rpc group MEMBERS List Group Members net rpc group ADDMEM Add Group Members net rpc group DELMEM Delete Group Members Valid methods: (auto-detected if not specified) ads Active Directory (LDAP/Kerberos) rpc DCE-RPC rap RAP (older systems) Valid targets: choose one (none defaults to localhost) -S|--server= server name -I|--ipaddress= address of target server -w|--target-workgroup= target workgroup or domain Valid misc options are: -p|--port= connection port on target --myname= client name --long Display full information Valid common options are: -d|--debuglevel= debug level (0-10) --debug-stdout Send debug output to standard output --configfile= pathname of smb.conf file --option=name=value Set smb.conf option from command line -l|--log-basename=LOGFILEBASE Basename for log/debug files --leak-report enable talloc leak reporting on exit --leak-report-full enable full talloc leak reporting on exit -V|--version Print samba version information Valid connection options are: -R|--name-resolve=NAME-RESOLVE-ORDER Use these name resolution services only -O|--socket-options=SOCKETOPTIONS socket options to use -m|--max-protocol=MAXPROTOCOL Set max protocol level -n|--netbiosname=NETBIOSNAME Primary netbios name --netbios-scope=SCOPE Use this Netbios scope -W|--workgroup=WORKGROUP Set the workgroup name --realm=REALM Set the realm name Valid credential options are: -U|--user=[DOMAIN/]USERNAME[%PASSWORD] Set the network username -N|--no-pass Don't ask for a password --password=STRING Set a password --pw-nt-hash The supplied password is the NT hash -A|--authentication-file=FILE Get the credentials from a file -P|--machine-pass Use stored machine account password --simple-bind-dn=DN DN to use for a simple bind --use-kerberos=desired|required|off Use kerberos authentication --use-krb5-ccache=CCACHE Credentials cache location for Kerberos --use-winbind-ccache Use the winbind ccache for authentication --client-protection=sign|encrypt|off Configure used protection for client connections -C or --comment= descriptive comment (for add only) -c or --container= LDAP container, defaults to cn=Users (for add in ADS only) -L or --localgroup When adding groups, create a local group (alias) ```
### Enumeration with rpcclient To enumerate domain users via [SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380) ```bash rpcclient -U '' --password='' $TARGET_IP -c enumdomgroups ```
Example run ```bash ┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200] └─$ rpcclient -U 'stephanie' --password='LegmanTeamBenzoin!!' $TARGET_IP -c enumdomgroups group:[Enterprise Read-only Domain Controllers] rid:[0x1f2] group:[Domain Admins] rid:[0x200] group:[Domain Users] rid:[0x201] group:[Domain Guests] rid:[0x202] group:[Domain Computers] rid:[0x203] group:[Domain Controllers] rid:[0x204] group:[Schema Admins] rid:[0x206] group:[Enterprise Admins] rid:[0x207] group:[Group Policy Creator Owners] rid:[0x208] group:[Read-only Domain Controllers] rid:[0x209] group:[Cloneable Domain Controllers] rid:[0x20a] group:[Protected Users] rid:[0x20d] group:[Key Admins] rid:[0x20e] group:[Enterprise Key Admins] rid:[0x20f] group:[DnsUpdateProxy] rid:[0x44e] group:[Sales Department] rid:[0x465] group:[Management Department] rid:[0x466] group:[Development Department] rid:[0x467] group:[Debug] rid:[0x468] group:[Billing] rid:[0x5658] group:[Customer support] rid:[0x5659] group:[Operators] rid:[0x565a] group:[IT Service Desk] rid:[0x565b] group:[OS{4260975db0ff61c496eb9e6207608a06}] rid:[0x565c] group:[Service Personnel] rid:[0x565d] ```
## Resources Active Directory - Enumeration - Internal All The Things: **net** - Kali Tools: **NetExec** - GitHub: **NetExec** - Kali Tools: **NetExec** - Wiki: **rpcclient** - Kali Tools: **rpcclient** - Linux manual page: