StandIn

StandIn

StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation. However, StandIn quickly ballooned to include a number of comfort features.

I want to continue developing StandIn to teach myself more about Directory Services programming and to hopefully expand a tool which fits in to the AD post-exploitation toolchain.

Roadmap

Contributing

Contributions are most welcome. Please ensure pull requests include the following items: description of the functionality, brief technical explanation and sample output.

Do you have something you want to see added to StandIn but don't have a PR? Please open a ticket and describe the functionality as best as possible.

ToDo's

The following items are currently on the radar for implementation in subsequent versions of StandIn.

• Domain share enumeration. This can be split out into two parts, (1) finding and getting a unique list based on user home directories / script paths / profile paths and (2) querying fTDfs / msDFS-Linkv2 objects.
• Finding and parsing GPO's to map users to host local groups.
• GPO -> OU & OU -> GPO.
• Rewrite policy function probably.
• Adding optional JSON/XML output for some functions to help with scripting.
• Code needs a re-factor, better modularized functions and split out into different classes.

Subject References

• An ACE up the sleeve (by @_wald0 & @harmj0y) - here
• Kerberoasting (by @xpn) - here
• Roasting AS-REPs (by @harmj0y) - here
• Kerberos Unconstrained Delegation (by @spotheplanet) - here
• S4U2Pwnage (by @harmj0y) - here
• Resource-based Constrained Delegation (by @spotheplanet) - here
• Rubeus - here
• Powerview - here
• Powermad (by @kevin_robertson) - here
• SharpGPOAbuse (by @den_n1s & @pkb1s) - here
• adidnsdump (by @_dirkjan) - here
• Certified Pre-Owned (by @harmj0y & @tifkin_) - here

Index

• Help
• LDAP Object Operations
  • Raw LDAP
  • Get object
  • Get object access permissions
  • Grant object access permission
  • Set object password
  • Add ASREP to object flags
  • Remove ASREP from object flags
• SID
• ASREP
• PASSWD_NOTREQD
• SPN
  • SPN Collection
  • Set SPN
• Unconstrained / constrained / resource-based constrained delegation
• DC's
• Trust
• GPO Operations
  • List GPO's
  • GPO add local admin
  • GPO add user privilege
  • GPO add immediate task
  • GPO increase User / Computer version
• Policy
• DNS
• Groups Operations
  • List group membership
  • Add / remove user from group
• Machine Object Operations
  • Create machine object
  • Disable machine object
  • Delete machine object
  • Add msDS-AllowedToActOnBehalfOfOtherIdentity
  • Remove msDS-AllowedToActOnBehalfOfOtherIdentity
• Active Directory Certificate Services (ADCS)
  • List
  • Client Authentication
  • ENROLLEE_SUPPLIES_SUBJECT
  • PEND_ALL_REQUESTS
  • Change Owner
  • Add Write Permission
  • Add Certificate-Enrollment Permission
• Detection
• Special Thanks

Help

  __
 ( _/_   _//   ~b33f
__)/(//)(/(/)  v1.4

 >--~~--> Args? --~~--> Usage?  *Operationally, we may want to retrieve an array of AD object and optionally filter and/or limit the results and properties.*

#### Syntax

Get all properties of the resolved objects. Queries can be simple matches for a single property or complex LDAP filters. Optionally limit the results returned with `--limit`.

C:> StandIn.exe --ldap "(&(displayName=)(gpcfilesyspath=))" --filter "gpcfilesyspath,versionnumber"

[?] Using DC : m-w16-dc01.main.redhook.local [+] LDAP search result count : 3 |_ Result limit : 50

[?] Iterating result properties |_ Applying property filter => gpcfilesyspath,versionnumber

[?] Object : CN={6AC1786C-016F-11D2-945F-00C04fB984F9} Path : LDAP://CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=redhook,DC=local [+] versionnumber |_ User Version : 0 |_ Computer Version : 1 [+] gpcfilesyspath |_ \redhook.local\sysvol\redhook.local\Policies{6AC1786C-016F-11D2-945F-00C04fB984F9}

[?] Object : CN={31B2F340-016D-11D2-945F-00C04FB984F9} Path : LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=redhook,DC=local [+] versionnumber |_ User Version : 0 |_ Computer Version : 11 [+] gpcfilesyspath |_ \redhook.local\sysvol\redhook.local\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}

[?] Object : CN={58890948-8DE3-4A39-8C40-F68004186693} Path : LDAP://CN={58890948-8DE3-4A39-8C40-F68004186693},CN=Policies,CN=System,DC=redhook,DC=local [+] versionnumber |_ User Version : 2 |_ Computer Version : 4 [+] gpcfilesyspath |_ \redhook.local\SysVol\redhook.local\Policies{58890948-8DE3-4A39-8C40-F68004186693}

### Get object

#### Use Case

> *Operationally, we may want to look at all of the properties of a specific object in AD. A common example would be to look at what groups a user account is member of or when a user account last authenticated to the domain.*

#### Syntax

Return the resolved object. Queries can be simple matches for a single property or complex LDAP filters. Optionally filter the properties you wish to pull back with `--filter`.

C:> StandIn.exe --object samaccountname=m-10-1909-01$

[?] Using DC : m-w16-dc01.main.redhook.local [?] Object : CN=M-10-1909-01 Path : LDAP://CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local

[?] Iterating object properties

[+] logoncount |_ 360 [+] codepage |_ 0 [+] objectcategory |_ CN=Computer,CN=Schema,CN=Configuration,DC=main,DC=redhook,DC=local [+] iscriticalsystemobject |_ False [+] operatingsystem |_ Windows 10 Enterprise [+] usnchanged |_ 195797 [+] instancetype |_ 4 [+] name |_ M-10-1909-01 [+] badpasswordtime |_ 0x0 [+] pwdlastset |_ 10/9/2020 4:42:02 PM UTC [+] serviceprincipalname |_ TERMSRV/M-10-1909-01 |_ TERMSRV/m-10-1909-01.main.redhook.local |_ WSMAN/m-10-1909-01 |_ WSMAN/m-10-1909-01.main.redhook.local |_ RestrictedKrbHost/M-10-1909-01 |_ HOST/M-10-1909-01 |_ RestrictedKrbHost/m-10-1909-01.main.redhook.local |_ HOST/m-10-1909-01.main.redhook.local [+] objectclass |_ top |_ person |_ organizationalPerson |_ user |_ computer [+] badpwdcount |_ 0 [+] samaccounttype |_ SAM_MACHINE_ACCOUNT [+] lastlogontimestamp |_ 11/1/2020 7:40:09 PM UTC [+] usncreated |_ 31103 [+] objectguid |_ 17c80232-2ee6-47e1-9ab5-22c51c268cf0 [+] localpolicyflags |_ 0 [+] whencreated |_ 7/9/2020 4:59:55 PM [+] adspath |_ LDAP://CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local [+] useraccountcontrol |_ WORKSTATION_TRUST_ACCOUNT [+] cn |_ M-10-1909-01 [+] countrycode |_ 0 [+] primarygroupid |_ 515 [+] whenchanged |_ 11/2/2020 7:59:32 PM [+] operatingsystemversion |_ 10.0 (18363) [+] dnshostname |_ m-10-1909-01.main.redhook.local [+] dscorepropagationdata |_ 10/30/2020 6:56:30 PM |_ 10/25/2020 1:28:32 AM |_ 7/16/2020 2:15:26 PM |_ 7/15/2020 8:54:17 PM |_ 1/1/1601 12:04:17 AM [+] lastlogon |_ 11/3/2020 10:21:11 AM UTC [+] distinguishedname |_ CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local [+] msds-supportedencryptiontypes |_ RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 [+] samaccountname |_ M-10-1909-01$ [+] objectsid |_ S-1-5-21-1293271031-3053586410-2290657902-1126 [+] lastlogoff |_ 0 [+] accountexpires |_ 0x7FFFFFFFFFFFFFFF

…

C:>StandIn.exe --object samaccountname=m-10-1909-01$ --access

[?] Using DC : m-w19-dc01.main.redhook.local [?] Object : CN=M-10-1909-01 Path : LDAP://CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local

[+] Object properties |_ Owner : MAIN\domainjoiner |_ Group : MAIN\Domain Join

[+] Object access rules

[+] Identity --> NT AUTHORITY\SELF |_ Type : Allow |_ Permission : CreateChild, DeleteChild |_ Object : ANY

[+] Identity --> NT AUTHORITY\Authenticated Users |_ Type : Allow |_ Permission : GenericRead |_ Object : ANY

[... Snip ...]

C:> StandIn.exe --object samaccountname=m-10-1909-01$ --access --ntaccount "MAIN\domainjoiner"

[?] Using DC : m-w19-dc01.main.redhook.local [?] Object : CN=M-10-1909-01 Path : LDAP://CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local

[+] Object properties |_ Owner : MAIN\domainjoiner |_ Group : MAIN\Domain Join

[+] Object access rules

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : DeleteTree, ExtendedRight, Delete, GenericRead |_ Object : ANY

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : WriteProperty |_ Object : User-Account-Restrictions

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : Self |_ Object : servicePrincipalName

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : Self |_ Object : dNSHostName

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : WriteProperty |_ Object : sAMAccountName

[+] Identity --> MAIN\domainjoiner |_ Type : Allow |_ Permission : WriteProperty |_ Object : displayName

[+] Identity --> MAIN\domainjoiner |