# linWinPwn | A Bash Script That Automates A Number Of Active Directory Enumeration And Vulnerability Checks

**URL:** <https://onehack.st/t/linwinpwn-a-bash-script-that-automates-a-number-of-active-directory-enumeration-and-vulnerability-checks/219151>\
**Category:** Tools & Scripts\
**Tags:** tools\
**Created:** [April 18, 2022, 11:27am UTC](https://onehack.st/t/linwinpwn-a-bash-script-that-automates-a-number-of-active-directory-enumeration-and-vulnerability-checks/219151 "2022-04-18T11:27:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [April 18, 2022, 11:27am UTC](https://onehack.st/t/linwinpwn-a-bash-script-that-automates-a-number-of-active-directory-enumeration-and-vulnerability-checks/219151/1 "2022-04-18T11:27:36Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/5/a/5aad24e4c24521f6b88413299b4122904e9cd0fa.png)

## Description

linWinPwn is a bash script that automates a number of Active Directory Enumeration and Vulnerability checks. The script leverages and is dependent of a number of tools including: impacket, bloodhound, crackmapexec, ldapdomaindump, lsassy, smbmap, kerbrute, adidnsdump.

## Setup

Git clone the repository and make the script executable

git clone [https://github.com/lefayjey/linWinPwn](https://github.com/lefayjey/linWinPwn) cd linWinPwn; chmod +x linWinPwn.sh

Install Linux and Python packages

sudo apt update sudo apt install python3 python3-dev python3-pip python3-venv nmap smbmap john libsasl2-dev libldap2-dev ntpdate -y sudo pip install -r requirements.txt wget -q “[https://raw.githubusercontent.com/micahvandeusen/gMSADumper/main/gMSADumper.py](https://raw.githubusercontent.com/micahvandeusen/gMSADumper/main/gMSADumper.py)” -O ./Scripts/gMSADumper.py wget -q “[https://raw.githubusercontent.com/zyn3rgy/LdapRelayScan/main/LdapRelayScan.py](https://raw.githubusercontent.com/zyn3rgy/LdapRelayScan/main/LdapRelayScan.py)” -O ./Scripts/LdapRelayScan.py wget -q “[https://raw.githubusercontent.com/ropnop/windapsearch/master/windapsearch.py](https://raw.githubusercontent.com/ropnop/windapsearch/master/windapsearch.py)” -O ./Scripts/windapsearch.py

On non-Kali machines, uncomment the lines under `#Non-Kali variables` and run the following commands

sudo pip install impacket crackmapexec mkdir -p wordlists && wget [https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz](https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz) -O ./wordlists/rockyou.txt.tar.gz && gunzip ./wordlists/rockyou.txt.tar.gz && tar xf ./wordlists/rockyou.txt.tar -C ./wordlists/ && chmod 644 ./wordlists/rockyou.txt && rm ./wordlists/rockyou.txt.tar && wget [https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/cirt-default-usernames.txt](https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/cirt-default-usernames.txt) -O ./wordlists/cirt-default-usernames.txt

If you’re having DNS issues, run the `update_dns` script _WARNING: The script will update /etc/resolv.conf, make sure to backup it before running the script_

chmod +x update\_dns.sh sudo ./update\_dns.sh \<DC\_IP\>

## Usage

### Modules

The linWinPwn script contains 4 modules that can be used either separately or simultaneously.

**Default (fastest): ad\_enum,kerberos** with OPSEC safe checks using `-O`

./linWinPwn.sh -O -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\> -o \<output\_dir\>

**User modules: ad\_enum,kerberos,scan\_shares,vuln\_checks,mssql\_enum**

./linWinPwn.sh -M user -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\> -o \<output\_dir\>

**All modules: ad\_enum,kerberos,scan\_shares,vuln\_checks,mssql\_enum,pwd\_dump**

./linWinPwn.sh -M all -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\> -o \<output\_dir\>

**Module ad\_enum:** Active Directory Enumeration

./linWinPwn.sh -M ad\_enum -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -o \<output\_dir\>

**Module kerberos:** Kerberos Based Attacks

./linWinPwn.sh -M kerberos -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -o \<output\_dir\>

**Module scan\_shares:** Network Shares Scan

./linWinPwn.sh -M scan\_shares -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -o \<output\_dir\>

**Module vuln\_checks:** Vulnerability Checks

./linWinPwn.sh -M vuln\_checks -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -o \<output\_dir\>

**Module mssql\_enum:** MSSQL Enumeration

./linWinPwn.sh -M mssql\_enum -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -o \<output\_dir\>

**Module pwd\_dump:** Password Dump

./linWinPwn.sh -M pwd\_dump -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -S \<domain\_servers\_list\> -o \<output\_dir\>

## Demos

- HackTheBox Forest

[![asciicast](https://camo.githubusercontent.com/7036f0cf271e5990d74cadf8fca622c0cff8714074a8433a79fd09183338bf0e/68747470733a2f2f61736369696e656d612e6f72672f612f3436343930342e737667)](https://asciinema.org/a/464904)

- TryHackme AttacktiveDirectory

[![asciicast](https://camo.githubusercontent.com/edce4d19cc814f7e5f0fc187e9ae01192de06aa8494857773636f4db03e2bd55/68747470733a2f2f61736369696e656d612e6f72672f612f3436343930312e737667)](https://asciinema.org/a/464901)

## Use cases

For each of the cases described, the linWinPwn script performs different checks as shown below.

**Case 1: Unauthenticated**

- Module ad\_enum
  - rid bruteforce
  - user enumeration
  - ldapdomaindump anonymous enumeration
  - Check if ldap-signing is enforced, check for LDAP Relay

- Module kerberos
  - kerbrute user spray
  - ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)

- Module scan\_shares
  - SMB shares anonymous enumeration on identified servers

- Module vuln\_checks
  - Enumeration for WebDav and Spooler services on identified servers
  - Check for zerologon, petitpotam, nopac weaknesses

./linWinPwn.sh -M user -t \<Domain\_Controller\_IP\_or\_Target\_Domain\>

**Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)**

- DNS extraction using adidnsdump
- Module ad\_enum
  - BloodHound data collection
  - ldapdomaindump enumeration
  - Delegation information extraction
  - GPP Passwords extraction
  - Extract ADCS information using certipy
  - Check if ldap-signing is enforced, check for LDAP Relay
  - Extraction of MachineAccountQuota of user, Password Policy and users’ descriptions containing “pass”
  - LAPS and gMSA dump

- Module kerberos
  - kerbrute user=pass enumeration
  - ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)
  - Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)

- Module scan\_shares
  - SMB shares enumeration on all domain servers

- Module vuln\_checks
  - Enumeration for WebDav and Spooler services on all domain servers
  - Check for zerologon, petitpotam, nopac weaknesses

- Module mssql\_enum
  - Check mssql privilege escalation paths

./linWinPwn.sh -M user -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\>

**Case 3: Administrator Account (using password, NTLM hash or Kerberos ticket)**

- All of the “Standard User” checks
- Module pwd\_dump
  - secretsdump on all domain servers or on provided list of servers with `-S`
  - lsassy on on all domain servers or on provided list of servers with `-S`

./linWinPwn.sh -M all -d \<AD\_domain\> -u \<AD\_user\> -p \<AD\_password\_or\_hash[LM:NT]\_or\_kerbticket[./krb5cc\_ticket]\> -t \<Domain\_Controller\_IP\_or\_Target\_Domain\> -S \<domain\_servers\_list\>

## To Do

Improve kerberos authentication support

## Credits

- [S3cur3Th1sSh1t](https://github.com/S3cur3Th1sSh1t) - WinPwn
- [SecureAuth](https://github.com/SecureAuthCorp) - impacket
- [byt3bl33d3r, mpgn, Porchetta Industries](https://porchetta.industries/) - crackmapexec
- [Fox-IT](https://github.com/fox-it) - bloodhound-python
- [dirkjanm](https://github.com/dirkjanm/) - ldapdomaindump, adidnsdump
- [Hackndo](https://github.com/Hackndo) - lsassy
- [TarlogicSecurity](https://github.com/TarlogicSecurity) - kerbrute
- [zer1t0](https://github.com/zer1t0) - certi.py
- [ly4k](https://github.com/ly4k) - Certipy
- [micahvandeusen](https://github.com/micahvandeusen) - gMSADumper
- [n00py](https://github.com/n00py/) - LAPSDumper
- [zyn3rgy](https://github.com/zyn3rgy) - LdapRelayScan
- [ShawnDEvans](https://github.com/ShawnDEvans) - smbmap
- [ropnop](https://github.com/ropnop) - windapsearch

## Legal Disclamer

Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It’s the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.

## GitHub:

> **[GitHub - lefayjey/linWinPwn: linWinPwn is a bash script that streamlines the...](https://github.com/lefayjey/linWinPwn)**
>
> linWinPwn is a bash script that streamlines the use of a number of Active Directory tools