This post looks into the various methods which are available to do the enumeration such as rpclient, enum4linux, nltest, netdom, powerview, bloodhound, adexplorer, Jexplorer, Remote Server Administration Tools, Microsoft Active Directory Topology Diagrammer, reconnaissance using powershell etc. Once, we have access to credentials of a domain user of windows domain, we can utilize the credentials to do windows active directory enumeration such as figuring out the domain controllers, users, machines, trust etc. Active Directory Reconnaissance with Domain User rights.Infrastructure PenTest Series : Part 3 - Exploitation ¶Īfter vulnerability analysis probably, we would have compromised a machine to have domain user credentials or administrative credentials. Add / remove a local user to administrator group.DCOM applications via MMC Application Class (MMC20.Application).

Windows Resource Kit Local/ Global executable.View machines affected by GPP vulnerability.

Define username, password, Domain, etc.Identifying the Groups with Local Admin Rights to windows machines.Discovering the Computers and Domain Controllers without scanning the network.Find all registered SQL Servers, Dcom, dnscache etc.Enterprise Services without scanning of Network.

Microsoft Active Directory Topology Diagrammer.

Determine the PDC emulator for a domain.

Enumerate specific User/ computer information by RID.

Enum Group Information and Group Membership.

Infrastructure PenTest Series : Part 3 - Exploitation.

Pentest box for windows 10