# DC-Sonar | Analyzing AD Domains For Security Risks Related To User Accounts

**URL:** <https://onehack.st/t/dc-sonar-analyzing-ad-domains-for-security-risks-related-to-user-accounts/232219>\
**Category:** Tools & Scripts\
**Tags:** learning, tools, freebies, windows\
**Created:** [January 29, 2023, 9:42pm UTC](https://onehack.st/t/dc-sonar-analyzing-ad-domains-for-security-risks-related-to-user-accounts/232219 "2023-01-29T21:42:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [January 29, 2023, 9:42pm UTC](https://onehack.st/t/dc-sonar-analyzing-ad-domains-for-security-risks-related-to-user-accounts/232219/1 "2023-01-29T21:42:41Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/8/6/86dbdda1b6a6218cdb44261f0fec5eb47c3cc0b0.png)

# DC Sonar Community

## Repositories

The project consists of repositories:

- [dc-sonar-frontend](https://github.com/ST1LLY/dc-sonar-frontend)
- [dc-sonar-user-layer](https://github.com/ST1LLY/dc-sonar-user-layer)
- [dc-sonar-workers-layer](https://github.com/ST1LLY/dc-sonar-workers-layer)
- [ntlm-scrutinizer](https://github.com/ST1LLY/ntlm-scrutinizer)

## Disclaimer

It’s only for education purposes.

Avoid using it on the production Active Directory (AD) domain.

Neither contributor incur any responsibility for any using it.

## Social media

Check out our Red Team community [Telegram channel](https://t.me/RedTeambro)

## Content

1. [Description](https://github.com/ST1LLY/dc-sonar#description)
2. [Architecture](https://github.com/ST1LLY/dc-sonar#architecture)
3. [Functionallity](https://github.com/ST1LLY/dc-sonar#functionallity)
4. [Installation](https://github.com/ST1LLY/dc-sonar#installation)
5. [Docker](https://github.com/ST1LLY/dc-sonar#docker)
6. [Manually using dpkg](https://github.com/ST1LLY/dc-sonar#manually-using-dpkg)
7. [Style guide](https://github.com/ST1LLY/dc-sonar#style-guide)
8. [Deployment for development](https://github.com/ST1LLY/dc-sonar#deployment-for-development)
9. [Docker](https://github.com/ST1LLY/dc-sonar#docker-1)
10. [Manually using Windows host and Ubuntu Server guest](https://github.com/ST1LLY/dc-sonar#manually-using-windows-host-and-ubuntu-server-guest)  
1. [Set up the virtual machine](https://github.com/ST1LLY/dc-sonar#set-up-the-virtual-machine)  
2. [Config Window](https://github.com/ST1LLY/dc-sonar#config-window)  
3. [Set shared folders](https://github.com/ST1LLY/dc-sonar#set-shared-folders)  
4. [Config Ubuntu Server](https://github.com/ST1LLY/dc-sonar#config-ubuntu-server)  
5. [Layers](https://github.com/ST1LLY/dc-sonar#layers)

## Description

### Architecture

For the visual descriptions, open the [diagram files](https://github.com/ST1LLY/dc-sonar/tree/main/diagrams) using the [diagrams.net](https://www.diagrams.net/) tool.

The app consists of:

- The [dc-sonar-frontend](https://github.com/ST1LLY/dc-sonar-frontend) is the fronted part of the user web interface bases on:
  - [Angular](https://angular.io/)
  - [Angular Material](https://material.angular.io/)

- The [dc-sonar-user-layer](https://github.com/ST1LLY/dc-sonar-user-layer) is the backend part of the web app bases on:
  - [Python 3.10](https://www.python.org/downloads/)
  - [Django](https://www.djangoproject.com/)
  - [Django ORM](https://docs.djangoproject.com/en/4.0/topics/db/queries/)
  - [Django REST framework](https://www.django-rest-framework.org/)
  - [Celery](https://docs.celeryq.dev/en/latest/changelog.html)
  - [RabbitMQ](https://www.rabbitmq.com/)
  - [PostgreSQL](https://www.postgresql.org/)

- The [dc-sonar-workers-layer](https://github.com/ST1LLY/dc-sonar-workers-layer) is the logic layer that performs and runs analyzing processes which base on:
  - [Python 3.10](https://www.python.org/downloads/)
  - [SQLAlchemy](https://www.sqlalchemy.org/)
  - [Alembic](https://alembic.sqlalchemy.org/en/latest/tutorial.html)
  - [APScheduler](https://apscheduler.readthedocs.io/en/3.x/)
  - [RabbitMQ](https://www.rabbitmq.com/)
  - [PostgreSQL](https://www.postgresql.org/)

- The [ntlm-scrutinizer](https://github.com/ST1LLY/ntlm-scrutinizer) is the NTLM hashes performer with REST API based on:
  - [Python 3.10](https://www.python.org/downloads/)
  - [FastAPI](https://fastapi.tiangolo.com/)
  - [hashcat](https://github.com/hashcat/hashcat)
  - [impacket](https://github.com/SecureAuthCorp/impacket)

### Functionallity

The DC Sonar Community provides functionality for analyzing AD domains for security risks related to accounts:

- Register analyzing AD domain in the app[![register_ad](https://github.com/ST1LLY/dc-sonar/raw/f7b2d6fc7b9f7b9ff83485cb8c969cfca2a72b88/py_charms_settings_scrs/register_ad.png?raw=true)](https://github.com/ST1LLY/dc-sonar/blob/f7b2d6fc7b9f7b9ff83485cb8c969cfca2a72b88/py_charms_settings_scrs/register_ad.png?raw=true)
- See the statuses of domain analyzing processes[![domains_analyze_statuses](https://github.com/ST1LLY/dc-sonar/raw/main/py_charms_settings_scrs/domains_analyze_statuses.png?raw=true)](https://github.com/ST1LLY/dc-sonar/blob/main/py_charms_settings_scrs/domains_analyze_statuses.png?raw=true)
- Dump and brute NTLM hashes from set AD domains to list accounts with weak and vulnerable passwords[![weak_passwords](https://github.com/ST1LLY/dc-sonar/raw/main/py_charms_settings_scrs/weak_passwords.png?raw=true)](https://github.com/ST1LLY/dc-sonar/blob/main/py_charms_settings_scrs/weak_passwords.png?raw=true)
- Analyze AD domain accounts to list ones with never expire passwords[![no_expired_passwords](https://github.com/ST1LLY/dc-sonar/raw/main/py_charms_settings_scrs/no_expired_passwords.png?raw=true)](https://github.com/ST1LLY/dc-sonar/blob/main/py_charms_settings_scrs/no_expired_passwords.png?raw=true)
- Analyze AD domain accounts by their NTLM password hashes to determine accounts and domains where passwords repeat[![reused_passwords](https://github.com/ST1LLY/dc-sonar/raw/main/py_charms_settings_scrs/reused_passwords.png?raw=true)](https://github.com/ST1LLY/dc-sonar/blob/main/py_charms_settings_scrs/reused_passwords.png?raw=true)

## Installation

### Docker

In progress …

### Manually using dpkg

It is assumed that you have a clean [Ubuntu Server 22.04](https://ubuntu.com/download/server) and account with the username “user”.

The app will install to `/home/user/dc-sonar`.

The next releases maybe will have a more flexible installation.

Download dc\_sonar\_NNNN.N.NN-N\_amd64.tar.gz from the [last distributive](https://github.com/ST1LLY/dc-sonar/releases) to the server.

Create a folder for extracting files:

mkdir dc\_sonar\_NNNN.N.NN-N\_amd64

Extract the downloaded archive:

tar -xvf dc\_sonar\_NNNN.N.NN-N\_amd64.tar.gz -C dc\_sonar\_NNNN.N.NN-N\_amd64

Go to the folder with the extracted files:

cd dc\_sonar\_NNNN.N.NN-N\_amd64/

Install PostgreSQL:

sudo bash install\_postgresql.sh

Install RabbitMQ:

sudo bash install\_rabbitmq.sh

Install dependencies:

sudo bash install\_dependencies.sh

It will ask for confirmation of adding the ppa:deadsnakes/ppa repository. Press `Enter`.

Install dc-sonar itself:

sudo dpkg -i dc\_sonar\_NNNN.N.NN-N\_amd64.deb

It will ask for information for creating a Django admin user. Provide username, mail and password.

It will ask for information for creating a self-signed SSL certificate twice. Provide required information.

Open: [https://localhost](https://localhost/)

Enter Django admin user credentials set during the installation process before.

## Style guide

See the information in [STYLE\_GUIDE.md](https://github.com/ST1LLY/dc-sonar/blob/main/STYLE_GUIDE.md)

## Deployment for development

### Docker

In progress …

### Manually using Windows host and Ubuntu Server guest

In this case, we will set up the environment for editing code on the Windows host while running Python code on the Ubuntu guest.

#### Set up the virtual machine

[Create](https://www.virtualbox.org/manual/ch01.html#gui-createvm) a virtual machine with 2 CPU, 2048 MB RAM, 10GB SSD using [Ubuntu Server 22.04](https://ubuntu.com/download/server) iso in [VirtualBox](https://www.virtualbox.org/wiki/Downloads).

If Ubuntu installer asks for updating ubuntu installer before VM’s installation - agree.

Choose to install OpenSSH Server.

VirtualBox Port Forwarding Rules:

| Name | Protocol | Host IP | Host Port | Guest IP | Guest Port |
| --- | --- | --- | --- | --- | --- |
| SSH | TCP | 127.0.0.1 | 2222 | 10.0.2.15 | 22 |
| RabbitMQ management console | TCP | 127.0.0.1 | 15672 | 10.0.2.15 | 15672 |
| Django Server | TCP | 127.0.0.1 | 8000 | 10.0.2.15 | 8000 |
| NTLM Scrutinizer | TCP | 127.0.0.1 | 5000 | 10.0.2.15 | 5000 |
| PostgreSQL | TCP | 127.0.0.1 | 25432 | 10.0.2.15 | 5432 |

#### Config Window

[Download](https://www.python.org/downloads/release/python-3105/) and install Python 3.10.5.

Create a folder for the DC Sonar project.

Go to the project folder using [Git for Windows](https://git-scm.com/download/win):

cd ‘{PATH\_TO\_FOLDER}’

Make Windows installation steps for [dc-sonar-user-layer](https://github.com/ST1LLY/dc-sonar-user-layer#windows).

Make Windows installation steps for [dc-sonar-workers-layer](https://github.com/ST1LLY/dc-sonar-workers-layer#windows).

Make Windows installation steps for [ntlm-scrutinizer](https://github.com/ST1LLY/ntlm-scrutinizer#windows).

Make Windows installation steps for [dc-sonar-frontend](https://github.com/ST1LLY/dc-sonar-frontend#windows).

#### Set shared folders

Make [steps](https://gist.github.com/estorgio/0c76e29c0439e683caca694f338d4003#initial-steps) from “Open VirtualBox” to “Reboot VM”, but add shared folders to VM VirtualBox with “Auto-mount”, like in the picture below:

[![vm_shared_folders](https://raw.githubusercontent.com/ST1LLY/dc-sonar/main/py_charms_settings_scrs/vm_shared_folders.png)](https://raw.githubusercontent.com/ST1LLY/dc-sonar/main/py_charms_settings_scrs/vm_shared_folders.png)

After reboot, run command:

sudo adduser $USER vboxsf

Perform logout and login for the using user account.

In `/home/user` directory, you can use mounted folders:

ls -l

Output: total 12 drwxrwx— 1 root vboxsf 4096 Jul 19 13:53 dc-sonar-user-layer drwxrwx— 1 root vboxsf 4096 Jul 19 10:11 dc-sonar-workers-layer drwxrwx— 1 root vboxsf 4096 Jul 19 14:25 ntlm-scrutinizer

#### Config Ubuntu Server

##### Config PostgreSQL

[Install](https://www.digitalocean.com/community/tutorials/how-to-install-postgresql-on-ubuntu-20-04-quickstart) PostgreSQL on Ubuntu 20.04:

sudo apt update sudo apt install postgresql postgresql-contrib sudo systemctl start postgresql.service

Create the admin database account:

sudo -u postgres createuser --interactive

Output: Enter name of role to add: admin Shall the new role be a superuser? (y/n) y

Create the dc\_sonar\_workers\_layer database account:

sudo -u postgres createuser --interactive

Output: Enter name of role to add: dc\_sonar\_workers\_layer Shall the new role be a superuser? (y/n) n Shall the new role be allowed to create databases? (y/n) n Shall the new role be allowed to create more new roles? (y/n) n

Create the dc\_sonar\_user\_layer database account:

sudo -u postgres createuser --interactive

Output: Enter name of role to add: dc\_sonar\_user\_layer Shall the new role be a superuser? (y/n) n Shall the new role be allowed to create databases? (y/n) n Shall the new role be allowed to create more new roles? (y/n) n

Create the back\_workers\_db database:

sudo -u postgres createdb back\_workers\_db

Create the web\_app\_db database:

sudo -u postgres createdb web\_app\_db

Run the psql:

sudo -u postgres psql

Set a password for the admin account:

```auto
ALTER USER admin WITH PASSWORD '{YOUR_PASSWORD}';

```

Set a password for the dc\_sonar\_workers\_layer account:

```auto
ALTER USER dc_sonar_workers_layer WITH PASSWORD '{YOUR_PASSWORD}';

```

Set a password for the dc\_sonar\_user\_layer account:

```auto
ALTER USER dc_sonar_user_layer WITH PASSWORD '{YOUR_PASSWORD}';

```

Grant CRUD permissions for the dc\_sonar\_workers\_layer account on the back\_workers\_db database:

```auto
\c back_workers_db
GRANT CONNECT ON DATABASE back_workers_db to dc_sonar_workers_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_workers_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_workers_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_workers_layer;

```

Grant CRUD permissions for the dc\_sonar\_user\_layer account on the web\_app\_db database:

```auto
\c web_app_db
GRANT CONNECT ON DATABASE web_app_db to dc_sonar_user_layer;
GRANT USAGE ON SCHEMA public to dc_sonar_user_layer;
GRANT ALL ON ALL TABLES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dc_sonar_user_layer;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dc_sonar_user_layer;

```

Exit of the psql:

```auto
\q

```

Open the pg\_hba.conf file:

sudo nano /etc/postgresql/12/main/pg\_hba.conf

Add the line for the connection to allow the connection from the host machine to PostgreSQL, save changes and close the file:

```auto
# IPv4 local connections:
host all all 127.0.0.1/32 md5
host all admin 0.0.0.0/0 md5

```

Open the postgresql.conf file:

```auto
sudo nano /etc/postgresql/12/main/postgresql.conf

```

Change specified below params, save changes and close the file:

```auto
listen_addresses = 'localhost,10.0.2.15'
shared_buffers = 512MB
work_mem = 5MB
maintenance_work_mem = 100MB
effective_cache_size = 1GB

```

Restart the PostgreSQL service:

sudo service postgresql restart

Check the PostgreSQL service status:

service postgresql status

Check the log file if it is needed:

tail -f /var/log/postgresql/postgresql-12-main.log

Now you can connect to created databases using admin account and client such as [DBeaver](https://dbeaver.io/download/) from Windows.

##### Config RabbitMQ

Install RabbitMQ using the [script](https://www.rabbitmq.com/install-debian.html#apt-quick-start-packagecloud).

Enable the management plugin:

sudo rabbitmq-plugins enable rabbitmq\_management

Create the RabbitMQ admin account:

sudo rabbitmqctl add\_user admin {YOUR\_PASSWORD}

Tag the created user for full management UI and HTTP API access:

sudo rabbitmqctl set\_user\_tags admin administrator

Open management UI on [http://localhost:15672/](http://localhost:15672/).

##### Install Python3.10

Ensure that your system is updated and the required packages installed:

sudo apt update && sudo apt upgrade -y

Install the required dependency for adding custom PPAs:

sudo apt install software-properties-common -y

Then proceed and add the deadsnakes PPA to the APT package manager sources list as below:

sudo add-apt-repository ppa:deadsnakes/ppa

Download Python 3.10:

sudo apt install python3.10=3.10.5-1+focal1

Install the dependencies:

sudo apt install python3.10-dev=3.10.5-1+focal1 libpq-dev=12.11-0ubuntu0.20.04.1 libsasl2-dev libldap2-dev libssl-dev

Install the venv module:

sudo apt-get install python3.10-venv

Check the version of installed python:

python3.10 --version Output: Python 3.10.5

##### Hosts

Add IP addresses of Domain Controllers to `/etc/hosts`

```auto
sudo nano /etc/hosts

```

#### Layers

##### Set venv

We have to create venv on a level above as VM VirtualBox doesn’t allow us to make it in shared folders.

Go to the home directory where shared folders located:

cd /home/user

Make deploy [steps](https://github.com/ST1LLY/dc-sonar-user-layer#ubuntu) for dc-sonar-user-layer on Ubuntu.

Make deploy [steps](https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu.

Make deploy [steps](https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu.

##### Config modules

Make config [steps](https://github.com/ST1LLY/dc-sonar-user-layer#config) for dc-sonar-user-layer on Ubuntu.

Make config [steps](https://github.com/ST1LLY/dc-sonar-workers-layer#ubuntu) for dc-sonar-workers-layer on Ubuntu.

Make config [steps](https://github.com/ST1LLY/ntlm-scrutinizer#preparations-for-run) for ntlm-scrutinizer on Ubuntu.

##### Run

Make run [steps](https://github.com/ST1LLY/ntlm-scrutinizer#run) for ntlm-scrutinizer on Ubuntu.

Make run [steps](https://github.com/ST1LLY/dc-sonar-user-layer#run) for dc-sonar-user-layer on Ubuntu.

Make run [steps](https://github.com/ST1LLY/dc-sonar-workers-layer#run) for dc-sonar-workers-layer on Ubuntu.

Make run [steps](https://github.com/ST1LLY/dc-sonar-frontend#run-development) for dc-sonar-frontend on Windows.

Open [https://localhost:8000/admin/](https://localhost:8000/admin/) in a browser on the Windows host and agree with the self-signed certificate.

Open [https://localhost:4200/](https://localhost:4200/) in the browser on the Windows host and login as created Django user.

## GitHub:

> **[GitHub - ST1LLY/dc-sonar: Analyzing AD domains for security risks related to...](https://github.com/ST1LLY/dc-sonar)**
>
> Analyzing AD domains for security risks related to user accounts