Active Directory auditing with Python: ldap3 and impacket
In an authorised lab domain you write tools with ldap3 and impacket that audit accounts, groups, policies and risky configurations.
Level 401 · 15 lessons · 12 practice labs
Lessons
Connecting to the directory
- Authorisation, scope and footprint in AD auditing
- Binding securely with ldap3 and LDAPS
- LDAP filters and paged searches
- Short task: list every privileged group member, nested groups included
Account risks
- Stale accounts and passwords that never expire
- Decoding userAccountControl flags
- Accounts with SPNs and with pre-authentication disabled
- Auditing delegation settings
- Short task: rank the ten riskiest accounts in the domain with reasons
Policies and permissions
- Reading the password policy and fine-grained policies
- Parsing object ACLs to find dangerous rights
- Checking SMB signing and shares with impacket
- Short task: find and close the permission path from a normal user to admin
Wrap-up
- Turning the audit into a management report
- Capstone: a repeatable AD security audit tool
Practice labs
- A secure bind over LDAPS: Write an ldap3 script that binds to the lab domain over LDAPS with the audit account and lists enabled users, and show the connection is encrypted.
- A directory query that gets cut off: Fix an inventory script that misses some users because it hits the result size limit by using paged searches, and show the total matches the real count in the directory.
- Hidden admins in nested groups: Write a script that resolves the members of privileged groups in the Pinecrest Bank lab domain, including nested groups and circular memberships, and show the path by which each account gets its rights.
- Accounts unused for a long time: Write an audit script that lists separately the enabled accounts in the lab domain with no logon for over ninety days and those whose passwords never expire.
- Decode userAccountControl flags: Write a function that turns each account’s userAccountControl value into readable flags, and report accounts that need no password or have pre-authentication disabled.
- The ten riskiest accounts: Write an audit script that scores SPN, delegation, password age, privileged membership and flag findings, and ranks the ten riskiest accounts in the lab domain with reasons.
- Is the password policy good enough: Write an ldap3 script that reads the lab domain’s default password policy, compares it with the given company standard and lists settings below it.
- Accounts the fine-grained policy misses: Read the fine-grained password policies and the groups they apply to, find admin accounts left outside the strict policy and show which policy is in effect for them.
- A repeatable AD audit: Combine the account, policy, ACL and share checks into one tool, compare results with the previous run and produce a manager report showing only new and closed findings.
- Is SMB signing required: Write an impacket script that checks whether SMB signing is required on the lab servers and lists the machines where it is not.
- Dangerous object permissions: Parse the ACL entries of the admin group and several service accounts, and report full-control, change-owner and password-reset rights granted to ordinary users.
- A permission path from user to admin: Within the authorised audit, derive the permission chain from an ordinary user to the admin group in the lab domain from ACL and membership data, remove the wrong right and re-run to show the path is closed.
About this course
In an authorised lab domain you write tools with ldap3 and impacket that audit accounts, groups, policies and risky configurations.
What you will learn
- Connecting to the directory
- Account risks
- Policies and permissions
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.