Active Directory

Ports

Kerberos: 88 TCP and UDP
DNS: 53 UDP or TCP if size > 512 B or communication fails
LDAP: 389
LDAPS: 636

The relationship between AD and LDAP can be compared to Apache and HTTP. The same way Apache is a web server that uses the HTTP protocol, Active Directory is a directory server that uses the LDAP protocol.

Machine account (NT AUTHORITY\SYSTEM) in AD: Has almost same rights as standard domain user account.
Do not always need valid creds of individual user account to begin enumeration
Will allow read access to much of the data within the domain
May obtain SYSTEM level access to domain-joined windows host through RCE or privesc on a host

Abuse privileges:
https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens.html
Reference for AD cmdlets: https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2022-ps

Manage

Users

New User

New-ADUser -Name "Orion Starchaser" -Accountpassword (ConvertTo-SecureString -AsPlainText (Read-Host "Enter a secure password") -Force ) -Enabled $true -samAccountName "ostarchaser" -Surname "Starchaser" -UserPrincipalName "[email protected]" -Path "OU=Interns,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL"

Remove User

Remove-ADUser -Identity pvalencia

Unlock User
Unlock-ADAccount -Identity amasters

Change passoword of a user
Set-ADAccountPassword -Identity 'amasters' -Reset -NewPassword (Read-Host -AsSecureString -Prompt "NewP@ssw0rdReset!" -Force)
Force Password Change
Set-ADUser -Identity amasters -ChangePasswordAtLogon $true

Manage OUs and groups

New OU

New-ADOrganizationalUnit -Name "Security Analysts" -Path "OU=IT,OU=HQ-NYC,OU=Employees,OU=CORP,DC=INLANEFREIGHT,DC=LOCAL"

New group

New-ADGroup -Name "Security Analysts" -SamAccountName analysts -GroupCategory Security -GroupScope Global -DisplayName "Security Analysts" -Path "OU=Security Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL" -Description "Members of this group are Security Analysts under the IT OU"

Add users to a group

Add-ADGroupMember -Identity analysts -Members acepheus,ostarchaser,acallisto

Manage Group policy and Objects

Copying group policy between domains

Copy-GPO -SourceName "Logon Banner" -TargetName "Security Analysts Control"
New-GPLink -Name "Security Analysts Control" -Target "ou=Security Analysts,ou=IT,OU=HQ-NYC,OU=Employees,OU=Corp,dc=INLANEFREIGHT,dc=LOCAL" -LinkEnabled Yes

Manage group policies in:

Group Policy Management Editor

Manage computers:

Add computers to a domain:
Add-Computer -DomainName INLANEFREIGHT.LOCAL -Credential INLANEFREIGHT\HTB-student_adm -Restart
https://academy.hackthebox.com/app/module/74/section/1393