search

CravateRouge / bloodyAD

BloodyAD is an Active Directory Privilege Escalation Framework
MIT License
1.12k stars 112 forks source link

getGroupMembers works but also fails #7

Closed jsdhasfedssad closed 2 years ago

jsdhasfedssad commented 2 years ago

Hi. Listing members of a domain group using the command "getGroupMembers" sort of works, I get the info I need, but it also fails :)

getGroupMembers1

CravateRouge commented 2 years ago

Hi, indeed! But this function has been deleted anyway. You should now use: python bloodyAD.py -u 'domainadmin1' -d adlab.local -p Password512! --host 10.0.0.200 getObjectAttributes 'domain admins' member To have the members of the domain admins group.

jsdhasfedssad commented 2 years ago

OK. I got the command "getGroupMembers" from the help output of your tool. That clearly needs updating. I have also seen some discrepancies between the help output and the tool's Github page as well.

The command "getObjectAttributes" outputs a lot of information. So much so that it is hard to find specific information such as the targeted object's/principal's SID. Greping the output also does not work. Nor does the command "tee". In addition the output contains large blocks of base64 encoded data which forces scrolling of the output.

CravateRouge commented 2 years ago

This is because you used an old version of the tool, please update it at the last version available. The help output is dynamically updated depending of the existing functions but you're right I forgot to update the README.

Try the last version of getObjectAttributes with a filter like I showed you in my previous reply. You'll also get rid of the majority of the base64 large blocks if you don't use a filter because of some improvements.

You can't pipe the output because you're piping only standard output but the output is generated with the python module LOG.info so you'll have to pipe error output with 2>&1 | grep (you can also use jq because it's a JSON output ;) ). Or you can use the filter objectSid when calling getObjectAttributes to only have the SID.