CYBER GYAN VIRTUAL INTERNSHIP
PROGRAM
Centre for Development of Advanced
Computing (CDAC), Noida
Submitted By:
Hartik Rai
Project Trainee, (June-July) 2025
Active Directory Enumeration
using Empire
Problem Statement:-
• Simulate real-world AD penetration testing
• Use PowerView for AD enumeration
• Gather info on users, groups, trusts
• Identify ACLs, sessions, and admins
• Spot misconfigurations and weak permissions
• Leverage Empire for post-exploitation steps
• Execute commands, maintain access, pivot
• Mimic attacker behavior for defense insights
• Document findings and recommend improvements
Essential Tools and Simulated Environment
PowerView VMware
A powerful PowerShell toolkit for Active Directory Provided a secure and isolated virtual laboratory
enumeration, enabling detailed discovery of environment to meticulously simulate an
users, groups, computers, trusts, and active enterprise Active Directory infrastructure for safe
sessions within the domain. testing and analysis.
Empire PowerShell Scripting
A versatile post-exploitation framework built on Crucial for automating enumeration tasks and
PowerShell, used to simulate attacker activities executing Empire modules, allowing for efficient
such as privilege escalation, lateral movement, and precise control over the simulated attack
and data exfiltration. scenarios.
Project Goals: Simulating Real-World Cyber
Threats
Gather Intelligence Identify Vulnerabilities
Collect critical information from a simulated Active Pinpoint security flaws and misconfigurations
Directory environment to understand its structure through systematic enumeration techniques.
and potential weaknesses.
Leverage Post-Exploitation Analyze & Mitigate
Utilize PowerShell Empire to simulate advanced Assess identified attack vectors and propose
attacker movements and maintain persistence within effective mitigation strategies from a defensive
the network. perspective.
Reasons Behind AD Enumeration & Attacks
Lack of User Awareness
Users click on phishing links or attachments and Poor cyber hygiene, such as sharing password and Use
of outdated protocols like NTLMv1
Weak Authentication Policies
Uncovered shared folders and resources with excessively open permissions, enabling unauthorized data access
and potential data breaches.
Trust Relationships
Mapped trust relationships between domains, revealing potential lateral movement paths for attackers to pivot
across different segments of the network.
Weak Password Policies
Identified lax password policies, including short minimum lengths and lack of complexity requirements, making
brute-force attacks more feasible.
Service Accounts
Exposed unmanaged service accounts with elevated privileges, posing a significant risk if compromised due to
their widespread access.
Methodology: A Phased
Approach to Penetration
Testing
Step 1: Environment
Setup
Configured a realistic Active Directory test environment within
VMware Workstation, replicating typical enterprise network
structures.
Step 2: Initial
Enumeration
Executed PowerView scripts to systematically enumerate domain
users, groups, and trust relationships, gathering foundational
intelligence.
Step 3: Post-Exploitation
Execution
Gained initial access and launched Empire modules to simulate advanced
post-exploitation techniques, including credential harvesting and
persistence.
Step 4: Documentation & Analysis
Each phase was meticulously documented with screenshots and
commands, providing a detailed audit trail for analysis and learning.
Post-Exploitation with Empire: Simulating Advanced
Attacks
Using PowerShell Empire, we simulated various advanced
attack techniques to demonstrate potential impact and
persistence within the compromised Active Directory
environment:
• Privilege Escalation: Utilized Empire modules to gain
higher-level administrative access within the domain.
• Data Exfiltration: Simulated the stealthy extraction of
sensitive data from the network to an external command
and control server.
• Credential Dumping: Executed techniques to harvest
user credentials, including hashed passwords, from
memory and disk.
• Lateral Movement: Demonstrated how an attacker
could move between compromised systems within the
network using stolen credentials.
• Persistence: Established backdoors and scheduled
tasks to maintain long-term access to the Active
Directory environment.
Defensive Perspective:
Strengthening Active Directory
Security
Understanding attack techniques is crucial for effective defense. Based on our
findings, we propose several key mitigations to enhance Active Directory security
and resilience against similar threats.
Least Privilege Principle Strong Password
Implement strict access controls, ensuring users and Policies
Enforce complex password requirements and multi-factor
service accounts only have the minimum necessary authentication (MFA) to prevent credential compromise.
permissions.
Real-time PowerShell SIEM Integration &
Monitoring
Deploy advanced monitoring solutions to detect and alert Logging
Enhance event logging across the AD environment and
on suspicious PowerShell script execution within the integrate logs with a Security Information and Event
network. Management (SIEM) system for centralized threat detection.
Outcome and Key Learnings
• Successful Completion: Successfully executed both
Active Directory enumeration and post-exploitation
tasks, validating the simulated attack chain.
• Hands-on Experience: Gained invaluable practical
experience in both red teaming (attack simulation)
and blue teaming (defensive strategies) concepts.
• Practical Knowledge: Developed deep practical
knowledge of Active Directory internals, common
vulnerabilities, and the application of penetration
testing tools in real-world scenarios.
• Attacker Mindset: Learned to think like an attacker,
anticipating their moves, which is crucial for building
robust defensive strategies.
• Defender Response: Understood how security
teams should respond to sophisticated attacks,
emphasizing proactive monitoring and rapid incident
response.
Conclusion and Future
Impact
This internship project provided profound insights into the
complexities of enterprise-level Active Directory security, from
both offensive and defensive standpoints.
• The project refined my understanding of cybersecurity principles
and practical application.
• This experience is invaluable for future roles in cybersecurity,
red teaming, and ethical hacking.
• It prepared me for real-world challenges in securing complex IT
infrastructures.
