4

Is there a way to determine which machine on an active directory network is the domain controller, if on a computer not logged on to the domain? This is for a penetration test, going in blind.

I've tried looking up the domain (which I know the name of) in nslookup, after setting type to all and running _ldap._tcp.dc._msdcs.Active_Directory_domain_name

I also tried dsdomroleinfo and enumdomains with rpcclient on machines that allowed null sessions.

Is there any easy way to look this up without resorting to sniffing?

Improve this question
1
  • Afaik most smb client can say this with a simple ask. Linux, samba are your keywords. smbclient -N -L a.b.c.d
    – peterh
    Dec 19, 2014 at 18:07

2 Answers 2

Reset to default
5

Try type "any" or "SRV"

Did you query for the "any" DNS resource record (wildcard/pseudo) type? (Otherwise the default is to simple query for A records. And the records in question are in fact SRV RRs.)

(Also: you said you used type "all", I don't know if there is such a thing. What any does is translate to a query for resource record type 0x00FF, decimal 255. I checked with Wireshark. This translation is done by your client. I don't know all clients, but I can tell you that dig does NOT know of "type all" and NOT "type *" either and will give you an error. But dig will work nicely if you say "-t any".)

Using dig (if "example.com" is your Active Directory domain name):

dig _ldap._tcp.dc._msdcs.EXAMPLE.COM -t any
dig _ldap._tcp.dc._msdcs.EXAMPLE.COM -t srv

Using the WINDOWS version of nslookup, the type MUST go as first parameter like so:

nslookup -type=any _ldap._tcp.dc._msdcs.EXAMPLE.COM
nslookup -type=srv _ldap._tcp.dc._msdcs.EXAMPLE.COM

Also try just the regular "A" type

Also you can simply dig/nslookup the Active_Directory_DNS_domain_name and this will give you DC-IPs. (Because there's actually A records at that level.)

Improve this answer
2

If you are inside the network, then most likely the DNS server that DHCP assigned to you is a domain controller. If you are using nslookup from outside the network, then you should not be able to look up the domain controller; that information should be only available internally.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .