In this lesson,
we're going to cover how to automate active directory
or AD searches using PowerShell scripts.
As a penetration tester,
being able to officially gather information
from active directory is crucial,
especially when you're working in environments
where active directory is the backbone
of the network's authentication
and authorization infrastructure.
I encourage you to pause the screen
as we go through this lesson,
and focus on the structure of the script snippets.
You do not need to know how to write these scripts yourself
for the exam,
but you will be required to show you can identify
and potentially modify similar scripts using PowerShell.
Now let's break down the basics of using PowerShell
for AD searches.
PowerShell with its rich set of cmdlets
is a powerful tool for automating task
in Windows environments.
And when it comes to active directory,
it has specific cmdlets designed to interact directly
with AD.
These cmdlets allow us to curate and manipulate AD objects
such as users, groups, and computers,
which are essential during the reconnaissance phase
of a penetration test.
The most basic cmdlet you'll be using for AD searches
is the Get-ADUser cmdlet.
This cmdlet allows you to retrieve information
about user accounts in AD.
For example, if you wanted to find all users
in a specific organizational unit (OU),
you could use a command like the following.
Get-ADUser -Filter * -SearchBase
"OU=Sales, DC=Diontraining, DC=com".
Now here, the -Filter * means that you're not filtering out
any users,
and -SearchBase specifies the starting point
in the directory where the search should be performed.
If you want to narrow down your search
to find specific users,
perhaps by their job title or department,
you can modify the filter.
For instance, Get-ADUser -Filter {Title -like "*Manager*"}
Properties Title.
Now this command returns all users
with the word manager in their title.
In many scenarios, you might need more information
than what the default properties provide.
For this, you can use the -Properties parameter
to retrieve additional attributes.
Suppose you're interested in finding users
who have never logged in.
You could run the following command.
Get-ADUser -Filter * -Properties LastLogonDate
| Where-Object { $_.LastLogonDate - eq $null }.
Now let's break this command down.
The Get-ADUser -Filter * -Properties LastLogonDate command
retrieves all of the active directory users
along with their last login date property.
The | symbol passes the output of the first command,
which is a collection of user objects,
to the next command.
Now, let's break down the second half.
Where-Object is a command that filters the user objects.
The $_ within the Where-Object's script block
represents each object as it flows through the pipe line,
that just represents each individual user.
The .LastLogonDate accesses the property
of the current user object,
again, that's identified with the $_ symbol.
We have the -eq $null portion.
This checks if the last log on date is null,
meaning that the user has never logged on.
Automation becomes really powerful
when you combine multiple cmdlets and logic
to perform more complex tasks.
For example, let's say you want to generate a report
of all users in active directory
who are part of a specific group
and export this to a CSV file.
You could use the following command.
Get-ADGroupMember -Identity "Domain Admins"
| Get-ADUser -Properties DisplayName,
EmailAddress | Select-Object DisplayName,
Email Address | Export-Csv -Path.
Then we have the path to the report, -NoTypeInformation.
This script gets all the members of the Domain Admins group
and retrieves their display names and emails,
and just simply exports the results to a CSV file.
For more advanced automation,
you might want to loop through multiple OUs
or perform actions based on certain conditions.
For instance, you can create a script
to find all disabled user accounts across all OUs.
Here's what that command will look like.
$OUs = Get-ADOrganizationalUnit - Filter
*foreach ($OU in $OUs) {
Get-ADUser -Filter {Enabled -eq $false}
SearchBase $OU.DistinguishedName | Select-Object Name,
DistinguishedName.
This script iterates through each OU
and finds all disabled user accounts within it.
PowerShell also allows you to schedule these scripts
to run at regular intervals,
automating the process entirely.
This can be particularly useful for ongoing monitoring tasks
such as identifying accounts that haven't been used
in a certain period,
flagging potential stale accounts
that could be leveraged by an attacker.
So remember, automating AD searches with PowerShell
isn't just about saving time-
it's about being able to consistently
and accurately gather the information you need
for effective penetration testing.
By mastering these PowerShell cmdlets and scripts,
you'll enhance your ability to quickly identify
and exploit weaknesses in active directory environments,
making you a more efficient and effective pentester.