Conquering Active Directory for OSCP+: Essential Techniques and Strategies — Part 2

This is the second of a series of short articles written to assist with the Active Directory (AD) portion of the new OSCP+ exam format. The steps and suggestions here are just the tip of the iceberg. Please expand beyond these articles and utilize the PEN-200 material for a more comprehensive review. Practice in a secure lab environment. “Hands-on” is the only way to truly learn all of this.

In the first article of this series, we discussed how to enumerate Active Directory (AD) users — a crucial first step for obtaining valid credentials. Let’s check how we can obtain some valid credentials .

In a recent blog post I compared nxc and DomainPasswordSpray, the latter being a Windows-based tool. Today, we will take a deeper look at the following tools:

• Kerbrute
• cewl

Kerbrute: A Stealthy Method for Credential Discovery

In the first article of this series, we covered how to use Kerbrute. Below is an example of its typical output, sourced from an HTB Academy module.

Any hash obtained through this method can potentially be cracked. While success isn’t guaranteed, attempting to crack the hash is worthwhile. If the password is weak, it can be cracked. Tools such as hashcat or john are well-suited for this purpose. Here is how to use john:

john hash --wordlist=/usr/share/wordlist/rockyou.txt

The rockyou wordlist is my go-to choice for password cracking. However, this list can be customized or even replaced with one tailored to the specific target asset. This is precisely what we will explore next.

cewl: Creating Custom Wordlists for Better Results

Finding users is not always achievable; there are scenarios where it’s not so straightforward — especially when there isn’t an assumed breach. In such cases, manual enumeration or tools like cewl can help gather information to create a potential wordlist for credential acquisition. Here’s the standard syntax for cewl:

cewl --lowercase http://server.local/ | grep -v CeWL > custom-wordlist.txt

cewl will go and inspect the webpage and generate a custom word list for us.

If there’s an authentication portal, this custom wordlist can be paired with a user list, such as one from SecLists, to attempt brute-force attacks. For Active Directory environments, a similar approach can be taken with nxc:

sudo nxc smb [ip] -u [list from seclist] -p custom-wordlist.txt| grep +

To quickly review available usernames, you can use the tree command to explore SecLists:

There are many additional methods to obtain valid credentials when pentesting Active Directory or web applications. I recommend exploring tools such as enum4linux, rpcclient, and nmap with the ldap-search script to expand your approach to enumeration.

In my next blog post, I will delve deeper into advanced techniques for Active Directory enumeration, leveraging the credentials we have collected.

Support my work by:

1. Clapping.
2. Leaving a comment with your thoughts
3. Highlighting your favorite part of the story