Active Directory Enumeration and Abuse with Samba’s net rpc

Summary

A practical walkthrough demonstrates how Samba’s net rpc can enumerate and modify Active Directory accounts, groups, privileges and registry settings, and explains the risks of misconfigured ACLs and defenses for domain controllers.

Key points

The walkthrough uses net rpc with valid credentials to enumerate example domain users, groups, shares and Windows user rights.
It explains how misconfigured ForceChangePassword and AddMember ACLs could let a standard user change another account’s password or gain Domain Admin membership.
It describes how assigning rights such as SeBackupPrivilege or SeImpersonatePrivilege can enable powerful access or persistence outside Domain Admin group membership.
A remote registry example changes fDenyTSConnections to enable RDP on a domain controller; the article recommends alerting on registry changes and unexpected RDP connections.
Recommended defenses include auditing ACLs and user-right assignments, restricting privileged accounts and RDP, monitoring relevant Windows events, and reviewing SYSVOL for GPP cPassword fields.

Article Details

Topic: Demonstration of Active Directory enumeration, account and group manipulation, privilege assignment, and remote registry changes using net rpc against a lab domain, with defensive mitigations.

MITRE ATT&CK

T1021.001 · Remote Desktop ProtocolDescribes using RDP for interactive access to the domain controller after enabling it.T1069.002 · Domain GroupsEnumerates domain groups and lists members of the Domain Admins group.T1087.002 · Domain AccountEnumerates domain user accounts using net rpc.T1098 · Account ManipulationDemonstrates changing another domain user's password through a misconfigured ForceChangePassword permission.T1098.007 · Additional Local or Domain GroupsDemonstrates adding a user to the Domain Admins group through a misconfigured AddMember permission.T1112 · Modify RegistryModifies a remote registry value to enable RDP on the domain controller.T1135 · Network Share DiscoveryEnumerates network shares hosted on the domain controller.T1136.002 · Domain AccountDemonstrates creating a new domain user account.

Products

Microsoft Active DirectoryThis article demonstrates how net rpc (Samba) can be used to perform reconnaissance, privilege escalation, and persistence against the ignite.local Active Directory domain controller at 192.168.1.11.SambaThis article demonstrates how net rpc (Samba) can be used to perform reconnaissance, privilege escalation, and persistence against the ignite.local Active Directory domain controller at 192.168.1.11.

Tools

net rpcThis article demonstrates how net rpc (Samba) can be used to perform reconnaissance, privilege escalation, and persistence against the ignite.local Active Directory domain controller at 192.168.1.11.