cyber.hendryadrian.com
Security Insights · hackingarticles.in

Using Impacket-Net to Enumerate and Modify Active Directory

· Original article ↗

Summary

A lab walkthrough shows how Impacket-Net uses NTLM hashes, Kerberos tickets, and AES keys to enumerate and modify Active Directory users, groups, and computers, then outlines hardening and monitoring measures.

Key points

  • Impacket-Net supports Active Directory authentication with NTLM hashes (Pass-the-Hash), cached Kerberos tickets, and AES keys.
  • The walkthrough demonstrates enumerating users, groups, and computers, including how low-privileged credentials can access directory information.
  • It shows account creation, disabling, deletion, and group-membership changes that could enable persistence or privilege escalation.
  • The article explains how creating machine accounts can support techniques such as Resource-Based Constrained Delegation and Shadow Credentials.
  • Recommended defenses include setting ms-DS-MachineAccountQuota to zero, enforcing LDAP signing and channel binding, and limiting privileges.
  • For detection, it recommends monitoring directory-change events and unusual SAMR or LDAP activity.

Article Details

Topic
Using impacket-net for Active Directory enumeration, account and group modification, and credential-based authentication

MITRE ATT&CK

T1003.001 · LSASS MemoryThe article describes extracting AES keys by harvesting them from LSASS.T1003.003 · NTDSThe article describes extracting credentials from the NTDS database.T1069.001 · Local GroupsEnumerating built-in local groups and their members.T1069.002 · Domain GroupsEnumerating domain groups and their members.T1087.002 · Domain AccountEnumerating domain user accounts through SAMR and LDAP.T1098.007 · Additional Local or Domain GroupsAdding users to privileged domain or local groups to elevate privileges.T1136.002 · Domain AccountCreating domain user accounts and computer accounts for persistence or attack operations.T1550.002 · Pass the HashAuthenticating with an NTLM hash using Pass-the-Hash.T1550.003 · Pass the TicketUsing a cached Kerberos ticket to authenticate.

Vendors

FortraThe Impacket framework—a suite of Python classes maintained by Fortra—serves as an industry-standard “Swiss Army knife” for offensive security research and network protocol manipulation.

Products

Microsoft Active Directorypaths—NTLM hash (Pass-the-Hash), Kerberos tickets, and AES keys—to enumerate and modify Active Directory objects against a domain controller in the ignite.local lab.

Tools

ImpacketThis article demonstrates how impacket-net uses three authentication paths—NTLM hash (Pass-the-Hash), Kerberos tickets, and AES keys—to enumerate and modify Active Directory objects against a domain controller in theimpacket-netThis article demonstrates how impacket-net uses three authentication paths—NTLM hash (Pass-the-Hash), Kerberos tickets, and AES keys—to enumerate and modify Active Directory objects against a domain controller in the

Related Articles