Domain Reconnaissance and Discovery

This chapter will focus on domain enumeration. Even if the methodology looks obvious and straightforward, the process itself can seem daunting, and reconnaissance is a crucial stepping stone toward successful compromise. Moreover, it is important to reiterate enumeration after every move, as new paths may open up. Sometimes enumeration can lead to a direct compromise; for example, a compromised user could read Local Administrator Password Solution (LAPS) or Group Managed Service Accounts (gMSA) passwords or could have administrator privileges on the box with unconstrained delegation.

We will briefly refresh the reconnaissance methodology and start comprehensive enumeration in different ways. We will cover the usage of built-in PowerShell modules, Windows Management Instrumentation (WMI), and net.exe commands, and utilize LDAP search capabilities. As a next step, we will use the PowerView and BloodHound tools. We will finish our journey with service...