One Day SecOne Day Sec

Penetration Basics - Running csvde on Windows 7

Onedaysec
3 min read
0 views
docx image 1770019794862 0 c0490f6118

0x00 Preface

---

In the previous article 'Penetration Basics - Obtaining Active Directory Information 2: Bypass AV', the method of using csvde to obtain Active Directory information was introduced. Its advantages include being built into Windows Server systems and exporting data in CSV format for easy viewing. However, this command is not supported by default on Windows 7 systems.

This article will introduce methods to run csvde on Windows 7, expanding its applicability.

0x01 Introduction

---

This article will cover the following:

  • Background Knowledge
  • Porting Approach
  • Implementation Methods

0x02 Background Knowledge

---

Reference Materials:

https://docs.microsoft.com/en-us/previous-versions/orphan-topics/ws.10/cc772704(v=ws.10)?redirectedfrom=MSDN

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732101(v=ws.11)

1. Dependencies of csvde

The following structure needs to be clarified:

  • Windows Server 2003, supports csvde by default
  • Windows Server 2008 and later versions, require enabling the Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) server role
  • Windows XP Professional, requires installation of Active Directory Application Mode (ADAM)
  • Windows 7 and later versions, require installation of Remote Server Administration Tools (RSAT)

2. Installing Remote Server Administration Tools (RSAT)

Remote Server Administration Tools for Windows 7: Microsoft no longer provides downloads

Remote Server Administration Tools for Windows 8 download link: https://www.microsoft.com/en-us/download/details.aspx?id=28972

Remote Server Administration Tools for Windows 10 download link: https://www.microsoft.com/en-us/download/details.aspx?id=45520

3. Installing Remote Server Administration Tools (RSAT) on Win7

(1) Download and install KB958830

Microsoft no longer provides manual downloads; you can choose to install Win7 automatic update patches

(2) Install the feature

Open Control Panel, select Turn Windows features on or off

In the Windows Features interface, you can find Remote Server Administration Tools, as shown in the figure below

(2) Install the feature — technical illustration 1

To support csvde, you need to install AD DS Snap-ins and Command-line Tools, with the path as follows:

Remote Server Administration Tools -> Role Administration Tools -> AD DS and AD LDS Tools -> AD DS Tools -> AD DS Snap-ins and Command-line Tools, as shown in the figure below

(2) Install the feature — technical illustration 2

After successful installation, the current Win7 system supports the csvde command

0x03 Migration Approach

---

The default installation path for csvde is c:\windows\system32. You can use Process Monitor to monitor the startup process of csvde and locate the dependency files required by csvde, as shown in the figure below

0x03 Migration Approach — technical illustration 3

From the figure, it can be seen that csvde requires the dependency file C:\Windows\System32\en-US\csvde.exe.mui during startup

After a period of testing, the following migration approach was ultimately determined:

  • Copy the file C:\Windows\System32\csvde.exe
  • Copy the file C:\Windows\System32\en-US\csvde.exe.mui

0x04 Implementation Method

---

We know that creating files under C:\Windows\System32\ requires administrator privileges. To enable transplantation under standard user permissions, the relative path method can be adopted here:

  • Copy csvde.exe to any path accessible with standard user permissions
  • Create folder en-US in the same directory, copy csvde.exe.mui

For testing convenience, I have uploaded the csvde from my test system to GitHub at the following address:

An open-source project

0x05 Summary

---

This article introduces the method to run csvde under Win7, improving applicability. The same method can be applied to implement operation under Win8 and Win10 respectively.

Related Questions & Answers

Can I combine csvde with other information gathering techniques for more comprehensive Active Directory reconnaissance?

Yes, csvde is often used as part of a broader AD enumeration strategy. For example, after exporting user objects with csvde, you can analyze the data or combine it with email export methods from [Penetration Basics - Searching and Exporting Emails from Exchange Servers](/news/penetration-basics-searching-and-exporting-emails-from-exchange-servers). Additionally, to evade detection while using these tools, consider implementing log deletion techniques from [Penetration Techniques - Deletion and Bypass of Windows Logs](/news/penetration-techniques-deletion-and-bypass-of-windows-logs).

How can I run csvde on Windows 7 without requiring administrator privileges?

By using a relative path method: copy `csvde.exe` to any folder you can write to (e.g., your user's Temp directory), create an `en-US` subfolder in that same directory, and place `csvde.exe.mui` inside it. Then execute `csvde` from that folder. This avoids the need to write to `C:\Windows\System32`, which typically demands admin rights. This technique can also be applied on Windows 8 and 10, as mentioned in the article [Penetration Basics - Running csvde on Windows 7](/news/penetration-basics-running-csvde-on-windows-7).

What is the migration approach to make csvde work on Windows 7 without installing RSAT?

The migration approach involves copying only the essential files: `csvde.exe` from `C:\Windows\System32` and the corresponding MUI file `csvde.exe.mui` from the `en-US` subfolder. These two files are sufficient to run csvde. This technique is especially useful when you cannot install RSAT or want to avoid leaving traces; you can also use relative paths to run under standard user privileges as described in [Penetration Techniques - Deletion and Bypass of Windows Logs](/news/penetration-techniques-deletion-and-bypass-of-windows-logs) to reduce forensic evidence.

What dependencies does csvde require on different Windows versions, and how do I enable it on Windows 7?

On Windows Server 2003 csvde works by default, but starting from Windows Server 2008 you need the AD DS or AD LDS server role. On Windows 7 and later, you must install Remote Server Administration Tools (RSAT). For Windows 7 specifically, you install KB958830 (or enable automatic updates), then go to Control Panel > Turn Windows features on or off and enable 'AD DS Snap-ins and Command-line Tools' under Remote Server Administration Tools. After installation, csvde becomes available.

What is csvde and why would I want to run it on a Windows 7 system during penetration testing?

csvde is a built-in Windows Server command-line tool that exports Active Directory data in CSV format, making the output easy to view and process. While it's natively available on Windows Server, running it on a Windows 7 client can expand your information gathering capabilities during a penetration test, as shown in the article [Penetration Basics - Running csvde on Windows 7](/news/penetration-basics-running-csvde-on-windows-7). This technique pairs well with methods covered in [Penetration Basics - Active Directory Information Gathering 2: Bypass AV](/news/penetration-basics-active-directory-information-gathering-2-bypass-av) for stealthy AD reconnaissance.

Continue Reading