6

On a penetration test going in blind for an organization, meaning no knowledge of network topology of design, no idea what the domain(s) might be, and domain controller is not apparent in DNS...how can it be determined what the Domain Controller is?

Assuming a dedicated DNS server instead of the DC handling DNS

Is there any way to determine what the domain controller is in this scenario?

  • 1
    sniff the wire? clients communicate with the DC pretty regularly in predictable ways – schroeder Jan 30 '15 at 23:15
  • @schroeder That's where I lack familiarity. What kind of traffic on what ports am I looking for that would indicate traffic to a DC, as opposed to another windows machine? – Jobe Woodmere Jan 30 '15 at 23:23
  • 1
    The ports for ldap (389 and 636) and kerberos (88) seem like they should be indicators. – Gordon Davisson Feb 7 '15 at 5:35
3

Jumping on the NMAP bandwagon: also look for machines that have TCP port 389 (LDAP), 636 (LDAPS), 3268 (LDAP Global Catalog), or 3269 (LDAPS Global Catalog). The last two are particularly juicy, since only a DC can be a Global Catalog server.

1

Sniff for TCP or UDP 88 (Kerberos), amongst others

Or if you have an account on the domain (just in case), from the command prompt run nltest /dclist:yourdomain.com

1

Look for NetBIOS over TCP broadcasts, NBT

https://technet.microsoft.com/en-us/library/cc940063.aspx

Look for Group Names with 1C , as this indicates the Domain Controllers. I would expect this name to be broadcasted on the same subnet, and be queried on a per machine basis by using NBTSTAT -A IP.

1

Depending on where the pentest is being launched, one should be able to determine the DC by querying the SRV records for LDAP, Kerberos, GC, etc.

This Microsoft TechNet link has some examples.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.