1️⃣ Active Directory Cheatsheet

  1. Perform user hunting to track down where users are logged into in the network - find users that are members of high-value groups.
  2. Dump credentials and/or obtain Kerberos tickets.
  3. Gain access to the user’s machine using creds/ticket.
  4. (Possibly) escalate privileges in the machine.
  5. Repeat steps above until you have administrative privileges in the Domain Controller.

πŸ“œAD Enumeration

- Users / Groups / Computers

  • μƒμœ„ κΆŒν•œμ„ 가진 user μ°ΎκΈ°
λ©”μ„œλ“œμ„€λͺ…
onCreate()μ•‘ν‹°λΉ„ν‹° 생성 μ‹œ 호좜, 화면에 λ³΄μ΄λŠ” 뷰의 일반적인 μƒνƒœλ₯Ό μ„€μ •
onStart()μ•‘ν‹°λΉ„ν‹°κ°€ μ‚¬μš©μžμ—κ²Œ ν‘œμ‹œλ˜κΈ° 직전에 호좜
onResume()μ•‘ν‹°λΉ„ν‹°κ°€ μ‚¬μš©μžμ™€ μƒν˜Έμž‘μš© ν•˜κΈ° 전에 호좜
onPause()μ‹œμŠ€ν…œμ΄ λ‹€λ₯Έ μ•‘ν‹°λΉ„ν‹°λ₯Ό μž¬κ°œν•˜μ§€ 직전에 호좜
onStop()μ•‘ν‹°λΉ„ν‹°κ°€ 더이상 μ‚¬μš©μžμ—κ²Œ ν‘œμ‹œλ˜μ§€ μ•Šμ„ λ•Œ 호좜
onDestroy()μ•‘ν‹°λΉ„ν‹° μ†Œλ©Έ 전에 호좜(λ§ˆμ§€λ§‰ 호좜)
πŸ“œ**μ•‘ν‹°λΉ„ν‹° Flow

![image-20240909091857392](/images/Active Directory Cheatsheet/image-20240909091857392.png)

![image-20240909091916569](/images/Active Directory Cheatsheet/image-20240909091916569.png)

πŸ“œν”„λž˜κ·Έλ¨ΌνŠΈ

- μ•‘ν‹°λΉ„ν‹°μ²˜λŸΌ μ΄μš©ν•  수 μžˆλŠ” λ·°

- ν•œ 화면에 μ—¬λŸ¬ ν™”λ©΄ ꡬ성 μ‹œ κ°œλ³„ μ•‘ν‹°λΉ„ν‹° 클래슀의 λ³΅μž‘μ„±μ„ 쀄여쀄 수 있음

- μ—¬λŸ¬κ°œμ˜ ν”„λž˜κ·Έλ¨ΌνŠΈλ₯Ό ν•˜λ‚˜μ˜ 앑티비티에 μ‘°ν•©ν•΄ 창이 μ—¬λŸ¬ 개인 UI ꡬ성 κ°€λŠ₯

- ν•˜λ‚˜μ˜ ν”„λž˜κ·Έλ¨ΌνŠΈ : Fragment.class + layout.xml

- Fragment, ListFragment, PreferenceFragment, DialogFragment λ“±

πŸ“œν”„λž˜κ·Έλ¨ΌνŠΈμ™€ μ•‘ν‹°λΉ„ν‹°μ˜ 관계

![image-20240909091927585](/images/Active Directory Cheatsheet/image-20240909091927585.png)

πŸ“œμ„œλΉ„μŠ€

- λ°±κ·ΈλΌμš΄λ“œμ—μ„œ μ‹€ν–‰λ˜λŠ” ν”„λ‘œμ„ΈμŠ€λ‘œ, λ³„λ„μ˜ μ‚¬μš©μž μΈν„°νŽ˜μ΄μŠ€ 제곡 X

- ν™”λ©΄κ³Ό 상관 없이 μž₯μ‹œκ°„ μ²˜λ¦¬ν•΄μ•Ό ν•˜λŠ” μž‘μ—… κ΅¬ν˜„μ— 적합

(ex. λ©”μ‹ μ €, μŒμ•… ν”Œλ ˆμ΄μ–΄ λ“±)

- ν•˜λ‚˜μ˜ μ„œλΉ„μŠ€ : Service.class

- μ„œλΉ„μŠ€ ꡬ동 방법

> startService() : μ–΄ν”Œλ¦¬μΌ€μ΄μ…˜ ꡬ성 μš”μ†Œκ°€ startService() 호좜 μ‹œ λ™μž‘(μœ„μ—„)

> bindService() : μ–΄ν”Œλ¦¬μΌ€μ΄μ…˜ κ΅¬μ„±μš”μ†Œκ°€ bindService() 호좜 ν›„ λ°”μΈλ“œ 되면 λ™μž‘ (μƒν˜Έμž‘μš©)

λ©”μ„œλ“œμ„€λͺ…
onCreate()μ„œλΉ„μŠ€ 졜초 생성 μ‹œ μˆ˜ν–‰ (μ„€μ • 절차)
onStartCommand()startService() 호좜 μ‹œ λ™μž‘ν•˜λŠ” ν•¨μˆ˜
onBind()bindService() 호좜 μ‹œ λ™μž‘ν•˜λŠ” ν•¨μˆ˜
onDestroy()μ„œλΉ„μŠ€ μ†Œλ©Έ μ‹œ λ™μž‘ν•˜λŠ” ν•¨μˆ˜
πŸ“œμ„œλΉ„μŠ€ 생λͺ… μ£ΌκΈ°

![image-20240909091938909](/images/Active Directory Cheatsheet/image-20240909091938909.png)

πŸ“œλΈŒλ‘œλ“œμΊμŠ€νŠΈ λ¦¬μ‹œλ²„

- μ•ˆλ“œλ‘œμ΄λ“œ μ‹œμŠ€ν…œ λ˜λŠ” λ‹€λ₯Έ μ•±μ˜ λΈŒλ‘œλ“œμΊμŠ€νŠΈ λ©”μ‹œμ§€λ₯Ό μ†‘μˆ˜μ‹ ν•˜λŠ” κΈ°λŠ₯을 의미

- 이벀트 λͺ¨λΈλ‘œ μˆ˜ν–‰λ˜λŠ” μ»΄ν¬λ„ŒνŠΈ = μ—†μœΌλ©΄ 말고, 있으면 λͺ¨λ‘ μ‹€ν–‰

- μ „ν™” μˆ˜μ‹ , 배터리 λΆ€μ‘±, 문자 μˆ˜μ‹ , μ™€μ΄νŒŒμ΄ 발견, λΈ”λ£¨νˆ¬μŠ€ μ—°κ²° λ“±

- μˆ˜μ‹  방법

> manifest 이용 : manifest에 μΈν…νŠΈ 등둝 -> Receiver 클래슀 / onReceive()

> context 이용 : μƒˆλ‘œμš΄ Receive 클래슀 μΈμŠ€ν„΄μŠ€ -> IntenFilter 등둝

πŸ“œμ»¨ν…μΈ  ν”„λ‘œλ°”μ΄λ” (Content Provider)

- μ•± κ°„μ˜ 데이터 곡유λ₯Ό λͺ©μ μœΌλ‘œ μ‚¬μš©ν•˜λŠ” μ»΄ν¬λ„ŒνŠΈ

- μΌλ°˜μ μœΌλ‘œλŠ” λ‹€λ₯Έ μ•±μ˜ 데이터에 μ™ΈλΆ€ 앱이 μ ‘κ·Ό ν•  수 μ—†μŒ

- μ£Όμ†Œλ‘, 사진첩, λ©”λͺ¨ μ½μ–΄μ˜€κΈ° (URI 기반)

- μ•ˆλ“œλ‘œμ΄λ“œμ—μ„œ μ œκ³΅ν•˜λŠ” URIμ—λŠ” κΆŒν•œμ΄ ν•„μš”ν•œ ν•­λͺ©κ³Ό ν•„μš”ν•˜μ§€ μ•Šμ€ ν•­λͺ©λ“€μ΄ 있음

![image-20240909091949490](/images/Active Directory Cheatsheet/image-20240909091949490.png)

πŸ“œμΈν…νŠΈ

- μ•± ꡬ성 μš”μ†Œ μ‚¬μ΄μ—μ„œ μž‘μ—…μ„ μš”μ²­ν•˜λŠ” λ©”μ‹œμ§€ 객체

- μΈν…νŠΈ μœ ν˜•

> λͺ…μ‹œμ  μΈν…νŠΈ : μ‹œμž‘ν•  κ΅¬μ„±μš”μ†Œλ₯Ό λͺ…μ‹œμ μœΌλ‘œ μ§€μ •ν•˜λŠ” 것

> μ•”μ‹œμ  μΈν…νŠΈ : νŠΉμ • κ΅¬μ„±μš”μ†Œλ₯Ό μ§€μ •ν•˜μ§€ μ•Šκ³ , μˆ˜ν–‰ν•  μž‘μ—…μ„ μ§€μ •ν•˜λ©΄ ν•΄λ‹Ή μž‘μ—…μ„ μ²˜λ¦¬ν•  수 μžˆλŠ” κ΅¬μ„±μš”μ†Œκ°€ μ„ νƒλ˜μ–΄ μž‘μ—…μ„ μˆ˜ν–‰ (μ „ν™”κ±ΈκΈ°, 지도에 ν˜„μž¬ μœ„μΉ˜ ν‘œμ‹œ λ“±)

![image-20240909091957888](/images/Active Directory Cheatsheet/image-20240909091957888.png)

πŸ“œλΉŒλ“œ ν”„λ‘œμ„ΈμŠ€

- μ»΄νŒŒμΌλŸ¬λŠ” μ†ŒμŠ€ μ½”λ“œλ₯Ό DEX 파일둜 λ³€ν™˜ν•˜κ³  κ·Έ μ™Έ λͺ¨λ“  것을 λ¦¬μ†ŒμŠ€λ‘œ λ³€ν™˜

- APK κ΄€λ¦¬μžλŠ” DEX 파일과 λ¦¬μ†ŒμŠ€λ₯Ό 단일 APK에 κ²°ν•©

- APK 생성

> 디버그 : μŠ€νŠœλ””μ˜€ μžλ™ ꡬ성

> 릴리즈 : 개발자 μ„œλͺ… ν•„μš”

![image-20240909092005200](/images/Active Directory Cheatsheet/image-20240909092005200.png)

πŸ“œμ•ˆλ“œλ‘œμ΄λ“œ μ•± ν”„λ‘œμ νŠΈ κ΅¬μ„±μš”μ†Œ

- Manifests

> AndroidManifest.xml

> μ•± ꡬ성 μš”μ†Œ 및 κΆŒν•œ 정보λ₯Ό μ •μ˜

- java

> μžλ°” μ†ŒμŠ€νŒŒμΌμ΄ λ“€μ–΄μžˆλŠ” 폴더

> νŒ¨ν‚€μ§€λͺ…κ³Ό λ™μΌν•œ ν•˜μœ„ 폴더듀이 λ§Œλ“€μ–΄μ§

- res

> λ¦¬μ†ŒμŠ€ 파일이 λ“€μ–΄μžˆλŠ” 폴더

> XML λ ˆμ΄μ•„μ›ƒ, κ·Έλ¦Ό, λ¬Έμžμ—΄μ„ μ •μ˜ν•œ XML

![image-20240909092014289](/images/Active Directory Cheatsheet/image-20240909092014289.png)

πŸ“œgradle

- λΉŒλ“œ 배포 도ꡬ

- μ•ˆλ“œλ‘œμ΄λ“œ μŠ€νŠœλ””μ˜€μ™€ λΉŒλ“œ μ‹œμŠ€ν…œμ€ 독립 관계

- μ•ˆλ“œλ‘œμ΄λ“œ μŠ€νŠœλ””μ˜€λŠ” μ½”λ“œ νŽΈμ§‘λ§Œ, gradle이 λΉŒλ“œ

- build.gradle

> λͺ¨λ“ˆμ˜ λΉŒλ“œ 방법을 μ •μ˜ν•œ 슀크립트

> λΉŒλ“œμ— μ‚¬μš©ν•  SDK버전, μ‚¬μš© 라이브러리 λ“±

- setting.gradle

> μ•± λΉŒλ“œ μ‹œ 포함할 λͺ¨λ“ˆμ„ μ •μ˜