oscp/Necronomicon/Enumeration/Active Directory.md

• Note; a lot of this info is also contained in the "Windows" and "PowerShell" sections; this is for miscellaneous AD enum

• Enumerate all nested members of a group or all nested groups of a user with a raw LDAP query using OID

  • net ads search -k -s ad. local '(CN=Domain Admins)' memberof
    • Get groups of which "Domain Admins" is a member, without OID
  • net ads search -k -5 ad. local '(member:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn
    • Use OID to walk the nested groups and find out that Domain Admins is actually a member of more groups
  • net ads search -k -s ad. local '(CN=Domain Admins)' member
    • Find members of Domain Admins group without OID
  • net ads search -k -5 ad.local '(memberof:1.2.840.113556.1.4.1941: =CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn
    • Use OID to walk nested groups and get ALL effective members of Domain Admins