0x00 Preface

---

In the previous article 'Domain Penetration - Obtaining DNS Records', methods for acquiring DNS records after gaining DNS administrator privileges in domain penetration were introduced. However, a more common scenario involves having only regular domain user privileges while still needing to obtain DNS records.

This article will reference publicly available materials to summarize methods for regular domain users to obtain DNS records and fix bugs in dns-dump.ps1 on newer versions of Windows systems.

0x01 Introduction

---

This article will cover the following topics:

  • Implementation Principles
  • Open-source Tools and Methods

0x02 Implementation Principles

---

1. Implementation Principles of SharpAdidnsdump

First, obtain the names of computers within the domain through LDAP queries, then retrieve their corresponding IP addresses via DNS queries.

For detailed implementation, refer to:

https://github.com/b4rtik/SharpAdidnsdump

Test environment: test.com

(1) Obtain the names of computers within the domain via LDAP query

The corresponding LDAP query parameters are as follows:

LDAP://test.com/DC=test.com,CN=microsoftdns,DC=DomainDnsZones,DC=test,DC=com
(&(!(objectClass=DnsZone))(!(DC=@))(!(DC=*arpa))(!(DC=*DNSZones)))

(2) Obtain the IP addresses corresponding to domain computers via DNS query

Using the Dns.GetHostEntry method, reference materials:

https://docs.microsoft.com/en-us/dotnet/api/system.net.dns.gethostentry?redirectedfrom=MSDN&view=netframework-3.5#System_Net_Dns_GetHostEntry_System_String_

2. Implementation principle of dns-dump

First, obtain DNS records via LDAP query, then decode the binary DNS records to retrieve the actual content

For details on DNS record decoding, refer to:

https://github.com/mmessano/PowerShell/blob/master/dns-dump.ps1#L483

0x03 Open-source tools and methods

---

Test Environment:

  • test.com
  • Server2012 R2

1. First obtain the names of computers within the domain via LDAP query, then obtain corresponding IPs via DNS query

(1) SharpAdidnsdump

https://github.com/b4rtik/SharpAdidnsdump

C# implementation for querying DNS records

Usage:

SharpAdidnsdump test.com

The results obtained are complete and consistent with dnscmd results

Note:

For dnscmd usage, refer to the previous article 'Domain Penetration - Obtaining DNS Records'

(2) adidnsdump

https://github.com/dirkjanm/adidnsdump

https://dirkjanm.io/getting-in-the-zone-dumping-active-directory-dns-with-adidnsdump/

Python implementation for querying DNS records

Suitable for Linux; cannot be used directly on Windows systems due to the need to install impacket

Installation method:

git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket
pip install .
cd ..
git clone https://github.com/dirkjanm/adidnsdump
cd adidnsdump
pip install .

First, obtain credentials for a domain user (plaintext password or NTLM hash)

Usage 1. Direct remote query:

adidnsdump -u test\\testuser1 -p test123! dc.test.com -r

Usage 2. Query via SOCKS proxy:

proxychains adidnsdump -u test\\testuser1 -p test123! dc.test.com -r --dns-tcp

Note:

You can also use NTLM hash as login credentials

2. First obtain DNS records via LDAP query, decode the binary DNS records to get the actual content

(1) dns-dump

https://github.com/mmessano/PowerShell/blob/master/dns-dump.ps1

Implemented in PowerShell, used to query DNS records

This PowerShell script is relatively old and failed in my test environments Server 2008 R2 and Server 2012 R2

After analysis, the LDAP query statement needs to be modified. The new script has been uploaded to GitHub, address as follows:

An open-source project

Usage:

Powershell -ep bypass -f dns-dump.ps1 -zone test.com

The results obtained are complete and consistent with those from dnscmd

(2) PowerView

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

Can also be used to query DNS records

The Convert-DNSRecord can be used to decode binary DNS records:

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1#L1814

Usage is as follows:

import-module PowerView.ps1
Get-DNSRecord -ZoneName test.com

3. Other Tools

(1) AdFind

C++ implementation (not open source), used for querying domain information

http://www.joeware.net/freetools/tools/adfind/index.htm

Common commands are as follows:

List domain controller names:

AdFind -sc dclist

Query online computers in the current domain:

AdFind -sc computers_active

Note:

The corresponding LDAP query conditions are as follows:

Transformed Filter: (&(objectcategory=computer)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))(pwdlastset>=131932198595370000)(|(!lastlogontimestamp=*)(&(lastlogontimestamp=*)(lastlogontimestamp>=131932198595370000))))

Query online computers in the current domain (display only name and operating system):

AdFind -sc computers_active name operatingSystem

Query all computers in the current domain:

AdFind -f "objectcategory=computer"

Query all computers in the current domain (display only name and operating system):

AdFind -f "objectcategory=computer" name operatingSystem

Query all users in the domain:

AdFind -users name

Query all GPOs:

AdFind -sc gpodmp

or

AdFind -gpo

Note:

Query GPO corresponding to the previous article 'Domain Penetration - Remote Execution via Scheduled Tasks in GPO'

0x04 Summary

---

This article introduces multiple methods for domain ordinary users to obtain DNS records, applicable to different environments. In practical use, AdFind's query efficiency is relatively low in certain situations.