Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0 votes
0 answers
92 views

Impossible NTLMv2 hash format with Responder lm option

While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
Joy's user avatar
  • 1
0 votes
1 answer
63 views

How lssas.exe store users hash?

Does lssas.exe store local and domain account user hashs and if lssas.exe store hash on memory, when I reboot computer attacker could not get older login user hashs right? But when I dump lssas.exe ...
Firat's user avatar
  • 13
0 votes
0 answers
57 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
rominator007's user avatar
0 votes
1 answer
124 views

It is possible to receive ntlm response with ipv6. What about ipv4?

I performed ntlm relay attack with mitm6 and ntlmrelayx. I used mitm6 for dns spoofing. When the victim sent a query containing where the DHCP is located, I identified myself as the DHCP server. Then ...
Firat's user avatar
  • 13
0 votes
1 answer
135 views

How does the Pass-The-Ticket attack work?

Generally, for a TGS request, we are required to have the corresponding TGT ticket, the user blob encrypted with TGT session key, and SPN service. It means that the attacker should know the TGT ...
Huseyn Aghazada's user avatar
1 vote
1 answer
90 views

How to prevent AD object information export by a LDAP Export tool from workgroup computer

I have a question regarding Active Directory Security. I can export Active Directory Object information by any 3rd party LDAP Export tool from any workgroup computer which is connected in my network. ...
Md. Rubiat Haque's user avatar
1 vote
0 answers
74 views

Hashed Password Kerberos PKDF2 AES - ActiveDirectory [closed]

I know that in Active Directory environments passwords are stored in the form of hashes depending on encryption types used in the environment. I understand also that when using AES as a symmetric ...
Matías Huartamendía's user avatar
2 votes
0 answers
57 views

Requesting an user-specific certificate in a tiered domain

Environment: A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers. Microsoft's Certificate Services (CS). Let's say the CA tier ...
Ramil's user avatar
  • 21
2 votes
1 answer
540 views

Using Hydra on a NTLM authentication

I'm learning Active Directory attacks and in one of the labs we are given the example of gaining the initial foothold in an AD system via NetNTLM by performing a password spraying attack. For the ...
user2334659's user avatar
0 votes
0 answers
114 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
2 votes
0 answers
214 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
0 votes
1 answer
151 views

Shadow Credentials attack with TGT and TGS

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to: Use Whisker to create a new certificate on behalf of DC (successful): Whisker.exe add /...
Teodor Cristian's user avatar
1 vote
1 answer
231 views

Oracle Kerberos authentication on Linux host with SSSD

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication. NOTE: this is not purely about ...
ibre5041's user avatar
1 vote
1 answer
277 views

What information is contained in the local SAM in an Active Directory network

I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine? I understand (and correct me if I'm wrong) that when logging in to ...
user2334659's user avatar
3 votes
2 answers
1k views

Kerberos - NTLM Password Hashes - Questions!

I have worked as a system administrator mainly on Widnows Server for some years now. Over the course of time I've always had a hard time trying to fully understand how Kerberos work. For about 3 weeks ...
Matías Huartamendía's user avatar
0 votes
0 answers
78 views

Surreptitiously surveil a logged out laptop AD workstation's keyboard with temporary physical access?

I can think of multiple ways to surveil a logged out computer with temporary physical access. The first is installing a hardware keylogger which would enable one to get all the keystrokes from it; ...
Seci Pedia's user avatar
0 votes
1 answer
930 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
0 votes
0 answers
136 views

Get exhaustive domain user rights on domain with Powerview/Powersploit

I am connected to a Windows workstation with a basic domain user account. I have downloaded and installed Powersploit. I have also tried with Powerview. There is a command called Get-DomainObjectAcl. ...
Bob5421's user avatar
  • 49
0 votes
0 answers
201 views

Sharphound / Bloodhound full enumeration

I am working with Sharphound / Bloodhound tools to create a "map" of my active directory domain. It works fine. I have now a complex environment. There are multiple domains/forests. There is ...
Bob5421's user avatar
  • 49
0 votes
0 answers
79 views

simulating a domain user logon on machine startup

I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
s1gsegv's user avatar
0 votes
0 answers
776 views

Encryption of NTDS.dit (BOOTKEY)

Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
lara400's user avatar
  • 153
2 votes
1 answer
121 views

Can you use AD CS to generate certificates for service users with the computer name in the certificate details?

I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
AJ Henderson's user avatar
  • 42.1k
1 vote
0 answers
247 views

Pass the hash/ pass the ticket TO a linux machine

I'm studying how to attack AD, but so far I have seen how to use pass the hash and pass the ticket to get access to Windows machines. How does one attack Linux machines joined to the domain using the ...
jagghy's user avatar
  • 11
2 votes
0 answers
92 views

kerberoasting on a standard user domain account

Kerberoasting is an attack against domain service accounts. I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory ...
Bob5421's user avatar
  • 49
0 votes
1 answer
583 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
thomas's user avatar
  • 101
1 vote
1 answer
3k views

Renewing Enterprise CA certificate

I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate. My setup is the Root CA is offline with online issuing CA server. When I do the renewal nothing ...
Julian Haines's user avatar
1 vote
1 answer
1k views

Why do I see LM hashes stored in Active Directory?

I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command: lsadump::dcsync /user:mimikatz The user's password is Pa55w.rd. The output is ... Credentials:...
Daniel's user avatar
  • 364
2 votes
0 answers
477 views

Active Directory and External Email Accounts

In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. [email protected] Within the same AD we also have '...
TheOrdinaryGeek's user avatar
2 votes
0 answers
1k views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
Vera Fodor's user avatar
3 votes
0 answers
292 views

Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?

When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
purple-explorer's user avatar
1 vote
1 answer
126 views

Web app architecture- set a new password for a on-premises AD setup

I need to implement a web app for a self-service change password use case for on-premise Active Directory users, which is accessible over the internet. The service must allow the users to set a new ...
frhack's user avatar
  • 111
0 votes
2 answers
161 views

Granting Local Admin permissions on domain workstations

We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
RonMidwest's user avatar
0 votes
1 answer
76 views

How to prevent a user retaining file access with an open handle on Windows?

Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group. Then, the user stops being a member of the group. Since access checks are ...
Quitting Due To Antisemitism's user avatar
4 votes
1 answer
592 views

Why did Microsoft publish the CPassword AES key ca. 2012?

As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more. ...
Al Longley's user avatar
0 votes
1 answer
264 views

Should a standard user in a AD domain be able to open cmd prompt as Administrator?

I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
sxmad's user avatar
  • 115
1 vote
0 answers
772 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
John's user avatar
  • 11
0 votes
0 answers
63 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
NRA's user avatar
  • 1
1 vote
0 answers
232 views

Intercept API calls of powershell module

I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
LucaBonadia's user avatar
1 vote
1 answer
1k views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user10433098's user avatar
3 votes
0 answers
100 views

Active directory configuration on a shared remote workplace environment

Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
Geert Bellekens's user avatar
1 vote
3 answers
3k views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
TheGreyShadow's user avatar
0 votes
1 answer
711 views

Why AD Kerberos uses password hash and not session key for tickets?

There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/ I ask TGS for ticket to access some SPN Part of this ticket is encrypted with ...
user996142's user avatar
2 votes
1 answer
2k views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
Bob's user avatar
  • 99
0 votes
1 answer
125 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
Dan's user avatar
  • 101
0 votes
1 answer
630 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
Manny's user avatar
  • 101
0 votes
0 answers
463 views

EFS-encrypted files not lost when domain admin resets password

There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user. I tried: Logged on as user (Domain User) with password 54321 ...
TomS's user avatar
  • 101
5 votes
1 answer
4k views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
dcom-launch's user avatar
1 vote
1 answer
2k views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
skiriakidis's user avatar
0 votes
0 answers
400 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
Vojtěch Dohnal's user avatar
0 votes
1 answer
278 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
kudlatiger's user avatar

1
2 3 4 5 6