*Evil-WinRM* PS C:\Users\Raven\Documents> upload /home/pak/Tools/Windows/AD/adPEAS.ps1
Info: Uploading /home/pak/Tools/Windows/AD/adPEAS.ps1 to C:\Users\Raven\Documents\adPEAS.ps1
Data: 4159704 bytes of 4159704 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\Raven\Documents> Import-Module .\adPEAS.ps1
*Evil-WinRM* PS C:\Users\Raven\Documents> Invoke-adPEAS
_ _____ ______ _____
| | __ \| ____| /\ / ____|
____ __| | |__) | |__ / \ | (___
/ _ |/ _ | ___/| __| / /\ \ \___ \
| (_| | (_| | | | |____ / ____ \ ____) |
\__,_|\__,_|_| |______/_/ \_\_____/
Version 0.8.13
Active Directory Enumeration
by @61106960
Legend
[?] Searching for juicy information
[!] Found a vulnerability which may can be exploited in some way
[+] Found some interesting information for further investigation
[*] Some kind of note
[#] Reserved
[?] +++++ Searching for Juicy Active Directory Information +++++
[?] +++++ Checking General Domain Information +++++
[+] Found general Active Directory domain information for domain 'manager.htb':
Domain Name: manager.htb
Domain SID: S-1-5-21-4078382237-1492182817-2568127209
Domain Functional Level: Windows 2016
Forest Name: manager.htb
Forest Children: No Subdomain[s] available
Domain Controller: dc01.manager.htb
[?] +++++ Checking Domain Policies +++++
[+] Found password policy of domain 'manager.htb':
Minimum Password Age: 1 days
Maximum Password Age: 42 days
[+] Minimum Password Length: 7 character
[!] Password Complexity: Disabled
[!] Lockout Account: Disabled
Reversible Encryption: Disabled
[+] Found Kerberos policy of domain 'manager.htb':
Maximum Age of TGT: 10 hours
Maximum Age of TGS: 600 minutes
Maximum Clock Time Difference: 5 minutes
Krbtgt Password Last Set: 07/27/2023 03:19:45
[?] +++++ Checking Domain Controller, Sites and Subnets +++++
[+] Found domain controller of domain 'manager.htb':
DC Host Name: dc01.manager.htb
DC Roles: SchemaRole,NamingRole,PdcRole,RidRole,InfrastructureRole
DC IP Address: ::1
Site Name: Default-First-Site-Name
[?] +++++ Checking Forest and Domain Trusts +++++
[?] +++++ Checking Juicy Permissions +++++
[?] +++++ Checking Add-Computer Permissions +++++
[+] Filtering found identities that can add a computer object to domain '':
[!] Every member of group 'Authenticated Users' can add a computer to domain ''
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=manager,DC=htb
objectSid: S-1-5-11
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=manager,DC=htb
CN=Certificate Service DCOM Access,CN=Builtin,DC=manager,DC=htb
CN=Users,CN=Builtin,DC=manager,DC=htb
[?] +++++ Checking DCSync Permissions +++++
[+] Filtering found identities that can perform DCSync in domain '':
[?] +++++ Checking LAPS Permissions +++++
[?] +++++ Searching for GPO local group membership Information +++++
[?] +++++ Searching for Active Directory Certificate Services Information +++++
[+] Found at least one available Active Directory Certificate Service
adPEAS does basic enumeration only, consider reading https://posts.specterops.io/certified-pre-owned-d95910965cd2
[+] Found Active Directory Certificate Services 'manager-DC01-CA':
CA Name: manager-DC01-CA
CA dnshostname: dc01.manager.htb
CA IP Address: 10.10.11.236
Date of Creation: 07/27/2023 10:31:05
DistinguishedName: CN=manager-DC01-CA,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
NTAuthCertificates: True
Available Templates: SubCA
DirectoryEmailReplication
DomainControllerAuthentication
KerberosAuthentication
EFSRecovery
EFS
DomainController
WebServer
Machine
User
Administrator
[?] +++++ Searching for Vulnerable Certificate Templates +++++
adPEAS does basic enumeration only, consider using https://github.com/GhostPack/Certify or https://github.com/ly4k/Certipy
[?] +++++ Checking Template 'SubCA' +++++
[!] Template 'SubCA' has Flag 'ENROLLEE_SUPPLIES_SUBJECT'
Template Name: SubCA
Template distinguishedname: CN=SubCA,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
Date of Creation: 07/27/2023 10:31:05
EnrollmentFlag: 0
[!] CertificateNameFlag: ENROLLEE_SUPPLIES_SUBJECT
[?] +++++ Checking Template 'DirectoryEmailReplication' +++++
[?] +++++ Checking Template 'DomainControllerAuthentication' +++++
[?] +++++ Checking Template 'KerberosAuthentication' +++++
[?] +++++ Checking Template 'EFSRecovery' +++++
[?] +++++ Checking Template 'EFS' +++++
[+] Identity 'MANAGER\Domain Users' has enrollment rights for template 'EFS'
Template Name: EFS
Template distinguishedname: CN=EFS,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
Date of Creation: 07/27/2023 10:31:05
Extended Key Usage: Encrypting File System
EnrollmentFlag: INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
CertificateNameFlag: SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH
[+] Enrollment allowed for: MANAGER\Domain Users
[?] +++++ Checking Template 'DomainController' +++++
[?] +++++ Checking Template 'WebServer' +++++
[!] Template 'WebServer' has Flag 'ENROLLEE_SUPPLIES_SUBJECT'
Template Name: WebServer
Template distinguishedname: CN=WebServer,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
Date of Creation: 07/27/2023 10:31:05
Extended Key Usage: Server Authentication
EnrollmentFlag: 0
[!] CertificateNameFlag: ENROLLEE_SUPPLIES_SUBJECT
[?] +++++ Checking Template 'Machine' +++++
[+] Identity 'MANAGER\Domain Computers' has enrollment rights for template 'Machine'
Template Name: Machine
Template distinguishedname: CN=Machine,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
Date of Creation: 07/27/2023 10:31:05
[+] Extended Key Usage: Client Authentication, Server Authentication
EnrollmentFlag: AUTO_ENROLLMENT
CertificateNameFlag: SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN
[+] Enrollment allowed for: MANAGER\Domain Computers
[?] +++++ Checking Template 'User' +++++
[+] Identity 'MANAGER\Domain Users' has enrollment rights for template 'User'
Template Name: User
Template distinguishedname: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=manager,DC=htb
Date of Creation: 07/27/2023 10:31:05
[+] Extended Key Usage: Encrypting File System, Secure E-mail, Client Authentication
EnrollmentFlag: INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
CertificateNameFlag: SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH
[+] Enrollment allowed for: MANAGER\Domain Users
[?] +++++ Checking Template 'Administrator' +++++
[?] +++++ Searching for Credentials Exposure +++++
[?] +++++ Searching for ASREProastable User +++++
[?] +++++ Searching for Kerberoastable User +++++
[?] +++++ Searching for User with 'Linux/Unix Password' attribute +++++
[?] +++++ Searching for Computer with enabled and readable LAPS attribute +++++
[?] +++++ Searching for Group Managed Service Account (gMSA) +++++
[?] +++++ Searching for Credentials in SYSVOL Group Policy Files +++++
[?] +++++ Searching for Sensitive Information in NETLOGON Share +++++
[?] +++++ Searching for Delegation Issues +++++
[?] +++++ Searching for Computer with Unconstrained Delegation Rights +++++
[?] +++++ Searching for Computer with Constrained Delegation Rights +++++
[?] +++++ Searching for Computer with Resource-Based Constrained Delegation Rights +++++
[?] +++++ Searching for User with Constrained Delegation Rights +++++
[?] +++++ Searching for User with Resource-Based Constrained Delegation Rights +++++
[?] +++++ Starting Account Enumeration +++++
[?] +++++ Searching for Azure AD Connect +++++
[?] +++++ Searching for Users in High Privileged Groups +++++
[+] Found members in group 'BUILTIN\Administrators':
GroupName: Enterprise Admins
distinguishedName: CN=Enterprise Admins,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-519
[+] description: Designated administrators of the enterprise
GroupName: Domain Admins
distinguishedName: CN=Domain Admins,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-512
[+] description: Designated administrators of the domain
sAMAccountName: Administrator
distinguishedName: CN=Administrator,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-500
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=manager,DC=htb
CN=Domain Admins,CN=Users,DC=manager,DC=htb
CN=Enterprise Admins,CN=Users,DC=manager,DC=htb
CN=Schema Admins,CN=Users,DC=manager,DC=htb
CN=Administrators,CN=Builtin,DC=manager,DC=htb
[+] description: Built-in account for administering the computer/domain
[*] accountexpires: This identity has been expired since 12/31/1600 16:00:00
pwdLastSet: 07/27/2023 08:24:35
lastLogonTimestamp: 02/20/2024 11:40:08
userAccountControl: NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, NOT_DELEGATED
[+] admincount: This identity is or was member of a high privileged admin group
[+] Found members in group 'MANAGER\Domain Admins':
sAMAccountName: Administrator
distinguishedName: CN=Administrator,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-500
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=manager,DC=htb
CN=Domain Admins,CN=Users,DC=manager,DC=htb
CN=Enterprise Admins,CN=Users,DC=manager,DC=htb
CN=Schema Admins,CN=Users,DC=manager,DC=htb
CN=Administrators,CN=Builtin,DC=manager,DC=htb
[+] description: Built-in account for administering the computer/domain
[*] accountexpires: This identity has been expired since 12/31/1600 16:00:00
pwdLastSet: 07/27/2023 08:24:35
lastLogonTimestamp: 02/20/2024 11:40:08
userAccountControl: NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, NOT_DELEGATED
[+] admincount: This identity is or was member of a high privileged admin group
[+] Found members in group 'MANAGER\Enterprise Admins':
sAMAccountName: Administrator
distinguishedName: CN=Administrator,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-500
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=manager,DC=htb
CN=Domain Admins,CN=Users,DC=manager,DC=htb
CN=Enterprise Admins,CN=Users,DC=manager,DC=htb
CN=Schema Admins,CN=Users,DC=manager,DC=htb
CN=Administrators,CN=Builtin,DC=manager,DC=htb
[+] description: Built-in account for administering the computer/domain
[*] accountexpires: This identity has been expired since 12/31/1600 16:00:00
pwdLastSet: 07/27/2023 08:24:35
lastLogonTimestamp: 02/20/2024 11:40:08
userAccountControl: NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, NOT_DELEGATED
[+] admincount: This identity is or was member of a high privileged admin group
[+] Found members in group 'MANAGER\Group Policy Creator Owners':
sAMAccountName: Administrator
distinguishedName: CN=Administrator,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-500
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=manager,DC=htb
CN=Domain Admins,CN=Users,DC=manager,DC=htb
CN=Enterprise Admins,CN=Users,DC=manager,DC=htb
CN=Schema Admins,CN=Users,DC=manager,DC=htb
CN=Administrators,CN=Builtin,DC=manager,DC=htb
[+] description: Built-in account for administering the computer/domain
[*] accountexpires: This identity has been expired since 12/31/1600 16:00:00
pwdLastSet: 07/27/2023 08:24:35
lastLogonTimestamp: 02/20/2024 11:40:08
userAccountControl: NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, NOT_DELEGATED
[+] admincount: This identity is or was member of a high privileged admin group
[+] Found members in group 'BUILTIN\Access Control Assistance Operators':
sAMAccountName: Raven
distinguishedName: CN=Raven,CN=Users,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-1116
memberOf: CN=Remote Management Users,CN=Builtin,DC=manager,DC=htb
pwdLastSet: 07/27/2023 08:23:10
lastLogonTimestamp: 02/22/2024 12:13:56
userAccountControl: NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
[+] Found members in group 'MANAGER\Cert Publishers':
sAMAccountName: DC01$
distinguishedName: CN=DC01,OU=Domain Controllers,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-1000
operatingsystem: Windows Server 2019 Standard
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=manager,DC=htb
CN=Cert Publishers,CN=Users,DC=manager,DC=htb
pwdLastSet: 10/16/2023 14:00:03
lastLogonTimestamp: 02/20/2024 11:39:17
[+] userAccountControl: SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
[?] +++++ Searching for High Privileged Users with a password older 5 years +++++
[?] +++++ Searching for High Privileged User which may not require a Password +++++
[?] +++++ Starting Computer Enumeration +++++
[?] +++++ Searching for Domain Controllers +++++
[+] Found Domain Controller 'DC01$':
sAMAccountName: DC01$
distinguishedName: CN=DC01,OU=Domain Controllers,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-1000
operatingsystem: Windows Server 2019 Standard
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=manager,DC=htb
CN=Cert Publishers,CN=Users,DC=manager,DC=htb
pwdLastSet: 10/16/2023 14:00:03
lastLogonTimestamp: 02/20/2024 11:39:17
[+] userAccountControl: SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
[?] +++++ Searching for Exchange Servers +++++
[?] +++++ Searching for ADCS Servers +++++
[+] Found ADCS Server 'DC01$':
sAMAccountName: DC01$
distinguishedName: CN=DC01,OU=Domain Controllers,DC=manager,DC=htb
objectSid: S-1-5-21-4078382237-1492182817-2568127209-1000
operatingsystem: Windows Server 2019 Standard
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=manager,DC=htb
CN=Cert Publishers,CN=Users,DC=manager,DC=htb
pwdLastSet: 10/16/2023 14:00:03
lastLogonTimestamp: 02/20/2024 11:39:17
[+] userAccountControl: SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
[?] +++++ Searching for Outdated Operating Systems +++++
[?] +++++ Searching for Detailed Active Directory Information with BloodHound +++++