# ADSearch

[ADSearch](https://github.com/tomcarver16/ADSearch) is a C# tool designed to work seamlessly with C2 frameworks like Cobalt Strike and Sliver using `execute-assembly`, enabling efficient and stealthy in-memory Active Directory enumeration. Unlike PowerShell-based tools like PowerView, which often rely on disk or process creation, ADSearch can be loaded directly into memory through the C2's implant. It supports custom LDAP queries, LDAPS connections, and JSON output for structured data collection.

## AD Enumeration

{% tabs %}
{% tab title="Users" %}
{% code overflow="wrap" %}
```bash
# User enumeration
ADSearch.exe --users

# Same with LDAP query
ADSearch.exe '--search "(&(objectCategory=person)(objectClass=user))"'

# Filter attributes
ADSearch.exe '--search "(samaccountname=administrator)" --attributes cn,logoncount,description'
```
{% endcode %}
{% endtab %}

{% tab title="Computers" %}
{% code overflow="wrap" %}
```bash
# Enumerate computer objects
ADSearch.exe --computers
```
{% endcode %}
{% endtab %}

{% tab title="Groups" %}
Enumerate memberships on the current domain:

```bash
# Enumerate Domain Admins
ADSearch.exe --domain-admins
```

If a bidirectional trust exist, cross-domain enumeration can be perfomed with the use of credentials to avoid the Kerberos Double Hop issue:

{% code overflow="wrap" %}
```bash
# Enumerate Enterprise Admins
ADSearch.exe '--search "(&(objectCategory=group)(cn=enterprise admins))" --attributes cn,member --domain moneycorp.local --username "x7331" --password "P@ss123!"'
```
{% endcode %}
{% endtab %}

{% tab title="OUs" %}
{% code overflow="wrap" %}
```bash
# Enumerate Organizational Units
ADSearch.exe '--search "(objectCategory=organizationalunit)" --attributes name'
```
{% endcode %}
{% endtab %}

{% tab title="GPOs" %}
{% code overflow="wrap" %}
```bash
# Enumerate Group Policy Objects
ADSearch.exe '--search "(objectCategory=groupPolicyContainer)" --attributes displayname'
```
{% endcode %}

To enumerate the GPOs applied to the a specific OU, the `gplink` attribute must first be retrieved. This attribute holds references to GPOs linked to the OU and is not returned by default in a standard LDAP query:

{% code overflow="wrap" %}
```bash
# Enumerate the gplink attribute
ADSearch.exe '--search "(ou=devops)" --attributes gplink'

# List the GPO that corresponds to the target gplink
ADSearch.exe '--search "(&(objectCategory=groupPolicyContainer)(|(name={0BF8D01C-1F62-4BDC-958C-57140B67D147})))" --attributes displayname'
```
{% endcode %}
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="Trusts" %}
The `(objectClass=trustedDomain)` query returns all objects representing trusted domains. To focus only on relevant trust-related data, the `--attributes` argument can be used to extract specific properties such as trust direction, type, and attributes ([trustAttributes](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c), [trustDirection](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5026a939-44ba-47b2-99cf-386a9e674b04)):

{% code overflow="wrap" %}
```bash
# Enumerate all trusts
ADSearch.exe '-d dollarcorp.moneycorp.local --search "(objectClass=trustedDomain)" --attributes cn,flatName,objectClass,trustAttributes,trustDirection,trustPartner --json'

# Enumerate external cross-forest trusts (trustAttributes=0x00000004)
ADSearch.exe '-d moneycorp.local --search "(trustAttributes=4)" --attributes cn,flatName,name,objectClass,trustAttributes,trustDirection,trustPartner --json'

# Enumerate external domain-specific trusts
ADSearch.exe '-d dollarcorp.moneycorp.local --search "(trustAttributes=4)" --attributes cn,flatName,name,objectClass,trustAttributes,trustDirection,trustPartner --json'
```
{% endcode %}

If an external trust is found, then information can be extracted from the trusted domain:

{% code overflow="wrap" %}
```bash
ADSearch.exe '-d eurocorp.local --search "(objectClass=trustedDomain)" --attributes cn,flatName,name,objectClass,trustAttributes,trustDirection,trustPartner --json'
```
{% endcode %}
{% endtab %}

{% tab title="Second Tab" %}

{% endtab %}
{% endtabs %}
