Attacking Active Directory & NTDS.dit
Last updated
Last updated
Once a Windows system is joined to a domain, it will no longer default to referencing the SAM database to validate logon requests.
This does not mean the SAM database can no longer be used.
to log on using a local account in the SAM database can still do so by
specifying the hostname of the device proceeded by the Username (Example: WS01/nameofuser)
or with direct access to the device then typing ./ at the logon UI in the Username field.
Launching the Attack with CrackMapExec
if the admins configured an account lockout policy, this attack could lock out the account that we are targeting
At the time of this note (January 2022), an account lockout policy is not enforced by default with the default group policies that apply to a Windows domain, meaning it is possible that we will come across environments vulnerable to this exact attack we are practicing.
NT Directory Services (NTDS) is the directory service used with AD to find & organize network resources.
the NTDS.dit file is stored at %systemroot%/ntds on the domain controllers in a . The .dit stands for .
This is the primary database file associated with AD and stores all domain usernames, password hashes, and other critical schema information
Checking Local Group Membership
Checking User Account Privileges including Domain
This account has both Administrators and Domain Administrator rights which means we can do just about anything we want, including making a copy of the NTDS.dit file.
Creating Shadow Copy of C:
When all the components support Volume Shadow Copy (VSS), you can use them to back up your application data without taking the applications offline
We can use vssadmin to create a Volume Shadow Copy (VSS) of the C: drive or whatever volume the admin chose when initially installing AD.
It is very likely that NTDS will be stored on C: as that is the default location selected at install, but it is possible to change the location.
Copying NTDS.dit from the VSS
What if we are unsuccessful in cracking a hash?
use