Password Policies

FROM LINUX

CrackMapExec:

With valid domain credentials, the password policy can be obtained remotely using tools like CrackMapExec or rpcclient.

crackmapexec smb 13.13.13.13 -u rio -p rio@123 --pass-pol

SMB NULL Sessions

An SMB NULL session may allow an attacker to retrieve domain information without authentication.

Using rpcclient:

rpcclient -U "" -N 13.13.13.13
rpcclient $> querydominfo
rpcclient $> getdompwinfo

Using enum4linux:

enum4linux -P 13.13.13.13

Using enum4linux-ng:

enum4linux-ng -P 13.13.13.13 -oA riotech
cat riotech.json

LDAP Anonymous Bind

Using ldapsearch:

ldapsearch -h 13.13.13.13 -x -b "DC=CORP,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

FROM WINDOWS

net.exe

C:\> net accounts

PowerView

PS C:\> import-module .\PowerView.ps1
PS C:\> Get-DomainPolicy