Using pywerview to Enumerate Active Directory and Identify Privilege Risks

Summary

An Active Directory enumeration walkthrough shows how pywerview queries can reveal privileged accounts, Kerberoastable service accounts, delegation settings, and group memberships that may enable privilege escalation.

Key points

The walkthrough uses authenticated pywerview LDAP queries with low-privileged credentials to enumerate users, groups, computers, delegation settings, and other domain data.
It identifies a Domain Admin account with adminCount=1.
A service account with an SPN and constrained delegation to WIN-SQL is described as a Kerberoasting and impersonation risk if its ticket can be cracked.
The exercise reports multiple computers configured for unconstrained delegation.
A Backup Operators member is identified; the article says this membership could be abused to obtain the domain controller's NTDS.dit database or registry hives.
Examples show pywerview filters for SPNs, admin-count, delegation, group membership, and full LDAP attributes.

Article Details

Topic: Authenticated pywerview enumeration of the ignite.local Active Directory domain, identifying privileged accounts and delegation misconfigurations.

MITRE ATT&CK

T1003.002 · Security Account ManagerThe article describes dumping registry hives, including SAM, to obtain credential material.T1003.003 · NTDSThe article states that Backup Operators membership could be abused to dump NTDS.dit and obtain domain password hashes.T1018 · Remote System DiscoveryThe article describes enumerating domain computers and servers.T1033 · System Owner/User DiscoveryThe article describes enumerating users logged onto local or remote machines.T1057 · Process DiscoveryThe article describes querying remote machines for running processes.T1069.001 · Local GroupsThe article describes enumerating local groups on a local or remote machine.T1069.002 · Domain GroupsThe enumeration listed domain groups and their membership, including Backup Operators and Domain Admins.T1087.002 · Domain AccountThe enumeration queried Active Directory user accounts, including accounts with SPNs and adminCount=1.T1135 · Network Share DiscoveryThe article describes querying a host for open network shares.T1482 · Domain Trust DiscoveryThe article describes enumerating domain trust relationships to identify potential pivot paths.T1558.003 · KerberoastingThe article identifies the SPN account kavish as Kerberoastable and describes cracking its Kerberos service ticket.

Products

Microsoft Active Directoryusing pywerview against ignite.local with low-privileged credentials (‘raj’) exposed extensive Active Directory information including users, computers, groups, delegation settings, and SPN-registered accounts.

Tools

PowerViewUsing pywerview, a Python-based port of the PowerView PowerShell module, an authenticated attacker with low-privileged credentials (raj / Password@1) was able to enumerate substantial information about the domain,PyWerViewAn authenticated enumeration using pywerview against ignite.local with low-privileged credentials (‘raj’) exposed extensive Active Directory information including users, computers, groups, delegation settings, and