AD – How to audit weak passwords?

Behind this catchy title is a real need. As a system administrator, it may be worthwhile to audit all of your organization’s Active Directory accounts to assess the level of security for user accounts. Let’s see how we do it!

Web resources and Methods:

• Audit weak passwords:
  • https://adamtheautomator.com/weak-ad-passwords/
• Part1: https://www.dionach.com/blog/active-directory-password-auditing

  • ntdsutil
    ntdsutil: activate instance ntds
    ntdsutil: ifm
    ifm: create full d:\audit
    ifm: quit
    ntdsutil: quit

• Part2: https://www.dionach.com/blog/active-directory-password-auditing-part-2-cracking-the-hashes
  • Ntdsaudit: https://github.com/Dionach/NtdsAudit/releases
  • Hashcat: https://hashcat.net/hashcat/
• How Attackers Pull the Active Directory Database (NTDS.dit) from a Domain Controller: https://adsecurity.org/?p=451
• Ntdsextract: https://github.com/csababarta/ntdsxtract
• L0phtcrack:
  • http://www.l0phtcrack.com/wp-content/uploads/2016/10/L0phtCrack-Password-Auditor-v7.pdf
• Using DSInternals PowerShell module and an adhoc script
  • http://flemmingriis.com/get-badpasswords/
  • https://www.dsinternals.com/en/
  • https://www.dsinternals.com/en/auditing-active-directory-password-quality/
    • https://github.com/MichaelGrafnetter/DSInternals
    • https://github.com/MichaelGrafnetter/DSInternals/wiki/Installation
  • http://woshub.com/auditing-users-password-strength-in-ad/
• Using a Linux computer: http://paulasitblog.blogspot.de/2016/03/auditing-active-directory-passwords.html
• Other ways to get passwords include:
  • John the Ripper (CPU based cracking tool)
  • John the Ripper GUI: https://openwall.info/wiki/john/johnny
  • Hashcat (GPU based cracking tool)
  • Cain and Abel: http://www.oxid.it/cain.html
  • fgdump: http://colesec.inventedtheinternet.com/tag/fgdump/
  • pwdump7: http://www.tarasco.org/security/pwdump_7/index.html   ; this does not work for ntds.dit
  • gsecdump from truesec:
  • and Ophcrack (Rainbow table password cracking tool).  Details on using those are beyond the scope of this article, but all 3 will crack NTLM passwords.  One neat thing about Ophcrack is if you have physical access to the machine, you can simply boot it to an Ophcrack Live CD, and let it find and crack the passwords automatically.  Of course if you already have physical access to a machine in a pentest, you can probably consider the engagement done with everything compromised already.An even better way to grab passwords is to do so in cleartext.
  • WCE (Windows Credential Editor).  Just running wce from the command line will also dump the hashes, but running it with the -w flag will grab the credentials in cleartext from memory.As you can see, the password clearly shown is asdf.  This won’t always grab all the passwords in the system, but it sure helps for the ones it does grab. Another tool that works in the same way as WCE (not in English, but less likely to be caught by anti-virus) is mimikatz.  You can try that tool as well.
• Using mimikatz dcsync:
  • http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
  • https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5
• Third party tools:
  • Specops password auditor: https://adamtheautomator.com/password-audit/ ; https://specopssoft.com/product/specops-password-auditor
  • https://thycotic.com/solutions/free-it-tools/weak-password-finder/weak-password-finder-thank-you/
  • https://www.knowbe4.com/weak-password-test
  • https://www.manageengine.com/products/free-windows-active-directory-tools/free-active-directory-weak-password-finder.html