![Page 1: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/1.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
SharkFest ‘16 Europe
#sf16eu
Common Packets in a Windows /Active Directory Environment
Uli Heilmeier2016-10-18
![Page 2: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/2.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Goals
![Page 3: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/3.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Goals
• Overview of protocols used by Windows clients• DHCP• DC and Site discovery• Directory information• Authentication• PXE
![Page 4: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/4.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Terms
• Active Directory (AD): Distributed multi-master database with user, computer, groups, etc. objects
• Domain: A set of users, groups, computers sharing a common directory database, security objects, trust relationship
• Domain Controller: A server running different services to control a AD
• Forest: Top level container houses domains
• Site: Groups of geo locations
![Page 5: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/5.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
![Page 6: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/6.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
DHCP
![Page 7: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/7.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PCAP Time
![Page 8: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/8.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
![Page 9: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/9.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
DC and Site discovery
![Page 10: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/10.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PCAP Time
![Page 11: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/11.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
DC and Site discovery
• DNS• SRV _ldap._tcp.dc._msdcs.<domain-name>• SRV _ldap._tcp.<site-name>._sites.dc._msdcs.<domain-name>• A/AAAA <domain-name>
• CLDAP• Netlogon attribute
![Page 12: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/12.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
DC and Site discovery
• Tools• nslookup
• nltest• nltest /dsgetsite
• nltest /dsaddresstosite:<computer-name> or <ip-address>
![Page 13: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/13.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Directory Information
![Page 14: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/14.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PCAP Time
![Page 15: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/15.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Directory Information
• LDAP• SMB• DCERPC
• Portmapper• UUID-Service
![Page 16: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/16.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Authentication
![Page 17: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/17.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PCAP Time
![Page 18: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/18.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
![Page 19: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/19.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Authentication
• Kerberos• setspn –L <account-name>
• NTLM
![Page 20: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/20.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PXE
![Page 21: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/21.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
PCAP Time
![Page 22: Common Packets in a Windows / Active Directory Environment](https://reader033.vdocuments.us/reader033/viewer/2022051522/587132f31a28ab322d8c09cf/html5/thumbnails/22.jpg)
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Questions?
Email: [email protected]: @pizza_4u