SharpADWS - Active Directory reconnaissance and exploitation f

项目说明

SharpADWS

中文文档

Acti reconnaissance and exploitation for Red Teams via the Acti Web Services (ADWS).

O

SharpADWS is an Acti reconnaissance and exploitation tool for Red Teams that collects and modifies Acti data via the Acti Web Services (ADWS) protocol.

Typically, enumeration or manipulation of Acti occurs through the LDAP protocol. SharpADWS has the ability to extract or modify Acti data without communicating directly with the LDAP server. Under ADWS, LDAP queries are wrapped in a series of SOAP messages and then sent to the ADWS ser a NET TCP Binding encrypted channel. The ADWS server then unpacks the LDAP query locally and forwards it to the LDAP ser on the same domain controller.

Acti Web Services (ADWS) is automatically turned on when Acti Domain Services (ADDS) is installed, making SharpADWS uni across all domain en.

Good Point

One of the main benefits of using ADWS for LDAP post-exploitation is that it is relatively unknown, and since LDAP traffic is not sent over the network, it is not easily detected by common monitoring tools. ADWS runs a completely different service than LDAP, is a on TCP port 9389, and uses the SOAP protocol as its interface.

While researching ADWS, we noticed that since it is a SOAP web service, the actual execution of the LDAP query is done locally on the domain controller. This provides a number of interesting side effects that turn out to be beneficial. For example, when analyzing LDAP queries on a domain controller, you may notice that the queries originate from 127.0.0.1 logs, which in many cases will be ignored.

A secondary benefit of this is that the activity does not show up in De under the LDAPSearch action type, which means very little telemetry data is a.

Protocol Implementation

SharpADWS implements MS-ADDM, MS-WSTIM and MS-WSDS protocol, you can use the source code of this project to easily implement the following operations on Acti Web Services:

Enumerate：Creates a context that maps to the specified search query filter.

Pull：Retrieve the result object in the context of a specific enumeration.

Renew：Updates the expiration time of the specified enumeration context.

GetStatus：Gets the expiration time of the specified enumeration context.

Release：Releases the specified enumeration context.

Delete：Delete existing objects.

Get：Retrieve one or more properties from an object.

Put：Modify the contents of one or more properties on an object.

- Add：Adds the specified property value to the specified property's value set, or creates the property if it does not already exist on the target object.
- Replace：Replaces the set of in the specified property with the specified in the operation, or creates the property if it does not already exist on the target object. If no value is specified in the operation, all on the currently specified attribute will be deleted.
- Delete：Removes the specified attribute value from the specified attribute. If no value is specified, all will be deleted. If the specified property does not exist on the target object, the PUT request fails.

Create：Create a new object.

Usage

The command line argument -h can be used to display the following usage information:

Cache

When SharpADWS enumerates the ACL, in order not to perform additional ADWS requests for each unknown trustee object, it is necessary to create a complete cache of all account objects in advance through the cache method and save it to a file, thereby a a large number of (unnecessary) flow. The cache contains a mapping of each account object name within the current domain to its objectSid.

Acl

The Acl method can enumerate the DACL of the object specifying -dn, and supports filtering the enumerated DACL through the -trustee, -right and -rid parameters. For example, we want to enumerate all Domain Controller objects and filter out the DACL whose trustee is Marcus, as follows:

For another example, we want to enumerate all User objects and filter out DACLs with GenericWrite permissions and trustee RID greater than 1000, as shown below:

In addition, the Acl method also supports enumeration of specific objects:

It should be noted that the use of Acl Method must rely on the mapping cache that has been established through Cache method.

DCSync

The list action of the DCSync method can query all accounts that have been granted the DS-Replication-Get-Changes, DS-Replication-Get-Changes-All and DS-Replication-Get-Changes-In-Filtered-Set permissions, as follows Show:

It should be noted that the list action of DCSync Method must rely on the mapping cache that has been established through Cache method.

Additionally, gi permissions, you can grant DCSync permissions to an account via write to establish a domain persistence backdoor:

DontReqPreAuth

The list action of the DontReqPreAuth method can find all accounts with the "Do not require kerberos preauthentication" option set, as shown below:

Additionally, you can abuse WriteProperty permissions on the target account's userAccountControl property by enabling the "Do not require kerberos preauthentication" option for that account via write action to perform an AS-REP Roasting attack:

Kerberoastable

The list action of the Kerberoastable method can find all accounts with SPN set up, as shown below:

Additionally, you can abuse WriteProperty permissions on the target account's ser property to perform a Kerberoasting attack by adding an SPN to that account (user accounts only) via write action:

AddComputer

The AddComputer method allows you to create a new computer account within the scope of the ms-DS-MachineAccountQuota attribute value, which can be used in subsequent RBCD attacks.

RBCD

The read action of the RBCD method can read the msDS-AllowedToActOnBehalfOfOtherIdentity attribute value of the specified account object to check who has the right to resources delegate to the account, as shown below:

The write action of the RBCD method can write to the msDS-AllowedToActOnBehalfOfOtherIdentity property of the target account object for Resource-Based Constrained Delegation attacks. As shown below, we first create a new extreme account PENTEST$ using the AddComputer method, and then we can execute the following command to write the SID of PENTEST$ into the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of DC01$:

In addition, the SID added in write action can be removed from the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of the target object through remove action:

Certify

The find action of the Certify method can enumerate the data in ADCS, including all certificate authorities and certificate templates, just like Certify:

In addition, find action supports the -enrolleeSuppliesSubject and -clientAuth options, which can filter out all certificate templates that have the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag turned on and support Client Authentication:

It should be noted that the find of Certify Method must rely on the mapping cache that has been established through Cache Method.

The modify action of the Certify method allows you to modify the properties of the certificate template, such as turning on the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag or enabling Client Authentication, if you ha access to the target template:

Whisker

The Whisker method is able to perform the lifecycle of a ShadowCredentials attack just like Whisker.

The list action of the Whisker method can list the msDS-KeyCredentialLink attribute value of the target account object:

The Whisker method's add action allows you to add a Key to the target account's msDS-KeyCredentialLink property to perform a ShadowCredentials attack if you ha access:

Additionally, with remove action you can provide -de to remove the specified Key from the msDS-KeyCredentialLink property of the target object:

FindDelegation

The FindDelegation method can enumerate all delegation relationships in the current domain. This method has no redundant options or parameters:

Say it at the end

This project is completed by me independently, and there will ine be some bugs. Contributors are very welcome to submit issues to report bugs or propose new ideas to jointly improve the project!

项目信息

开发语言：C#

Star 数：605

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。