POWERSHELL: Random Users & Weak Passwords (Active Directory #03)

Check out Snyk to help bake security into your development process, find and fix vulnerabilities before the bad actors do! snyk.co/johnhammond
Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeacoffee
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humblebundle
🐶Snyk ➡ j-h.io/snyk
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsorship
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc

[@_JohnHammond]

HUGE THANKS to Snyk for sponsoring this video & supporting the channel! Check out Snyk to help bake security into your development process, find and fix vulnerabilities before the bad actors do! snyk.co/johnhammond

[@pcfverbeek]

Test-Computersecurechannel -repair -credential $cred will solve the trust thing in one line and no reboots. Like all users, machines also have their own password to connect to AD and doing the snapshot thing kills that so you need an account wiht admin privilges to restore that. Usually a machine needs to connect once per 3 months (I think that's default) or so before it expires. Remote workers often face this if they don't connect to their corp VPN.

[@davidherok5083]

I find this format with all the headaches, debugging, and finally solving problems way more instructive and ultimately satisfying than a lot of well scripted tutorials out there. Thank you John and keep up the good work!

[@FurikuriYugi]

I don't watch terrible videos. I watch educational videos and you my friend are a pleasure. Keep on showing real life programing, don't just teach the thing; demonstrate the thing.

[@davidawesome0248]

Get-Random has a -count option, which should do what you were doing for most of the video

[@_JohnHammond]

OHH MY GAWDD

[@j_r_-]

But wouldnt it potentially return duplicates?

[@davidawesome0248]

@@j_r_- no It puts it in a random order then returns the first min(x,length) objects

[@Grommish]

@@_JohnHammond it's how we learn! Do it wrong and ugly, then make it elegant!

[@petergaudiomonte1080]

Thank you John! Starting my homelab this week!

[@Alloyminium]

Love your work! Thank you for bringing such great content for us learners! :)

[@UKvideos2009]

Thank you for these videos, John, I am learning so much and enjoying myself.

[@Amarilite]

Loving this series. Nice to see I'm not the only one constantly frustrated with Powershell :D

[@SoulJah876]

This was great - the roadblocks only help to solidify what must be learned. I'm gonna have to start taking notes.

[@leandromiano3190]

Troubleshooting and learning is never Garbage! As you said, you are learning with us, and this is amazing. I hope you are thinking to do similar videos with SCCM , this will be explosive! Thank you so much to bring us on this journey with you!

[@FindAllHere]

Keep em coming please!!!

[@h1ghrise]

Powershell's essential is piping objects (and commands) into another. So "$users | Get-Random" will deliver the same output, and is (im my opinion) easier to read. Also Arrays, Hashtables etc, have a .Count Property which shows you the amount of elements containing.

[@wp-wisdom]

Please keep up with the great content!

[@JustDorian]

To fix the domain trust, try using the Network ID button in System Properties, saves you the extra restart!

[@NahImPro]

I could watch these all day and then use what you learn for me lol 😂 thanks John

[@notta3d]

Great stuff yet again. Just a FYI, Get-Help [-examples] is your friend. Powershell has some very good help files. Make sure to run update-help as an admin on your new vm's first though.

[@JustinRobertsW]

Snapshots and Domain Controllers do not play well together...

[@johnvardy9559]

Love you John

[@PierreFierlafijn]

Hi, I'm enjoing your struggle with AD and powershell. As a AD administrator and self claimed powershell expert (imposter syndrome kicking in) I see the 2 obvious problems you have here. 1. Could not find domain issue: You have joined the workstation after your snapshot. Joining a computer to AD creates a AD Computer object in AD that is not present in your snapshot. When you're workstation try to connect to the AD (kerberos tickets and so on) it doesn't find the computer object and does not trust this computer. Solution: Rejoin the domain with your workstation and snapshot both at that time. Then this will be solved for an amount of time (There are password assigned to the computer that are auto updated, but this will not give problems for months). This is no timeskew issue, but a ad rollback issue 2. A hashtable or array are there own objects in powershell with there own attributes and are not object as is in javascript. To convert a hashtable to a (PSClient)Object you need to cast the hashtable with "$o = [PSCustomObject]@{...}". Then $o | ConvertTo-Json will work as expected. Hope this helps folks

[@dragonrm7332]

John I don't think your DC snapshot has the computer account for the workstation, which would be why you keep having to rejoin the domain. Restore snap, rejoin the workstation then take a new DC snap.

[@maartenbw22]

Looking back at video #1, this is definitely the case 👍

[@michaelmadsen2574]

And, if the computer account is still in the AD, log on with the local admin and use reset-computermachinepassword. Just point it to a DC in the forest, and a credential in the domain. This will repair the trust relationship.

[@itsadamslife1]

Agreed. The snapshot for the DC was taken before the workstation was joined to the domain.

[@drph4nt0m]

"Hey John" at 44:42 was spooky. :)

[@arghyl]

The struggles build our strength.

[@shootingkiller9109]

Hello John. To get more than more groups per user you can do the following Get-Random -InputObject $groups -Count 5 So line will return any 5 random groups out of 10

[@shootingkiller9109]

Thanks a lot man!. I am loving this series.

[@davidawesome0248]

I said this 10 minutes after it came out and he decided to reply to me, but cool we both know this

[@laurenlewis4189]

Okay... It's almost 3 am and I can't think straight, but here's what I learned through sheer stubbornness and way too many hours of experimentation: 1. ConvertTo-Json has a depth parameter that flattens (if you're lucky) any arrays/lists/collections below that depth, it is set to 2 by default 2. ConvertTo-Json really just hates System.Collections.ArrayLists The problem John was having was the depth thing; I say that's lucky because otherwise instead of flattening, it interprets the values as objects instead of strings: those objects have properties and those properties have hashtables full of properties. The more depth you add, the more convoluted it gets. I kept trying to drag the original $group_names ArrayList along to the end of the script and have that be the array that's converted to the JSON file because it was convenient to have the Add and Remove methods, but it ends up spewing an output that is so ugly it made firefox crash just trying to paste it in a youtube comment (no, seriously, there was way too much text and my browser crashed). My solution was kinda bruteforce and probably inelegant, but I converted the ArrayList into a stringly-typed array (strongly typed, string array) while passing it to ConvertToJson. ```PowerShell ConvertTo-Json -InputObject @{ "domain"=$Domain "groups"=([string[]]$groups) "users"=$users } -Depth 3 | Out-File $OutputJSONFile ``` (Not that I expect markdown to work, much less syntax highlighting, but it makes a nice visual break for the code.) I also did the same with my own version of adding groups to the user object that picks a random number of group objects from the arraylist, up to a predetermined maximum number, and assigns them all to a [string[]] typed variable: ```PowerShell [string[]]$usergroups = (Get-Random -InputObject $groups -Count (Get-Random -Minimum 1 -Maximum $MaxUserGroups)) ``` All that said, this series has inspired me to share my own process with "the class" in either my own video series, or a series of blog posts. Look out for it on the internet, coming to a website near you "soon"

[@goldenhell9]

Hey John, I really like the PowerShell stuff. The issue you were facing with the Domain trust relationship... Have you tried to run this command from the client VM: Test-ComputerSecureChannel -Repair You might need to run it with the -cred parameter because it needs to be able to execute some stuff on the DC as well.

[@kernel0verflow919]

57:08 Luke Smith? For a second I thought this might be a linux video ;)

[@natking1u1z99]

I've been looking for a way to automate AD user creation for years for my labs.

[@itlink6488]

hey John ... i might ne wrong here but i think that you made the snapshot before you joined the PC to the domain ... therefore when reverting ... there is no computer abject in AD database for the test PC ... therefore you get the error. :)

[@huben_1337]

if i get it right a major problem cause for u was, that hashtable objects are much different from array objects in powershell

[@sandra8139]

I just posted about the identity with my Sim

[@spikeukspikeuk]

John, just a minor point, but in my experience you would not make the group names as plurals!

[@jonjon12498]

Is that a windows 11vm or did you upgrade to 11 and is windows 11 worth it? Also I love your videos and you’ve taught me a lot

[@dabbopabblo]

+= 1 does work you just wrote =+1 in the wrong order

[@acidspark]

Yeah, you kept setting i equal to 1 so endless loop.

[@jtsoldier]

Phil Mackenzie is an executive. You're in so much trouble when he finds out about this.

[@VidathD]

How come u didn't immediately go to SecLists? You traitor! Poor Daniel. 😆

[@guilherme5094]

👍

[@chrishears]

LOL Do you play Golf King World Tour? I think you do, that or someone is using you image. Korean golfing game.

[@nixielee]

You should probably have real passwords with real complexity if this is going to simulate a real AD, not removing all possible standards.

[@azerts]

I was with you until you said "gOd I HaTe pOwErShElL s0 much" @ 28:42

[@siphoboity12]

I saw manchester mfs have my bfs password.

[@tw4vesx332]

great video and serie, but u r actually dump to bother deleting "bad words" from a password list file -.- :D

[@zacass6]

Sysdm.cpl will get you quick to the domain add area. Use the network account button to get the trust back. When you revert the snapshot it losses trust me thinks.

[@VidathD]

How come u didn't immediately go to SecLists? You traitor! Poor Daniel. 😆

[@VidathD]

How come u didn't immediately go to SecLists? You traitor! Poor Daniel. 😆

[@VidathD]

How come u didn't immediately go to SecLists? You traitor! Poor Daniel. 😆