enum_domain.md

Vulnerable Application

This module identifies the primary Active Directory domain name and domain controller.

Verification Steps

1. Start msfconsole

2. Get a session on a Windows target on a domain

3. Do: use post/windows/gather/enum_domain

4. Do: set session [#]

5. Do: run

6. You should receive Active Directory domain information

Options

Scenarios

Windows 2016 with Windows 2008 SP1 DC

msf post(windows/gather/enum_domain) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : WIN-7V3NGVNQTJ1
OS              : Windows 2016+ (10.0 Build 14393).
Architecture    : x64
System Language : en_US
Domain          : CORP
Logged On Users : 4
Meterpreter     : x64/windows
meterpreter > background
[*] Backgrounding session 1...

msf post(windows/gather/enum_domain) > use post/windows/gather/enum_domain
msf post(windows/gather/enum_domain) > set session 1
session => 1
msf post(windows/gather/enum_domain) > run

[+] Domain FQDN: corp.local
[+] Domain NetBIOS Name: CORP
[+] Domain Controller: WIN-17B09RRRJTG.corp.local (IP: 192.168.200.218)
[*] Post module execution completed