Skip to content

Commit a109693

Browse files
DeydaDeyda
authored
Add files via upload
1 parent 78d9cdb commit a109693

File tree

9 files changed

+470
-0
lines changed

9 files changed

+470
-0
lines changed

‎ADV190023/ActiveDirectory-DCLDAPEvents.ps1

+118
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
<#
2+
.SYNOPSIS
3+
This script checks all domain controller concerning Event ID 2887 & 3040 (LDAP Clear Text/Unsigned)
4+
5+
.DESCRIPTION
6+
This script checks all domain controllers of the domain via Get-WinEvent and searches for the event with the
7+
ID 2887 in the Directory Service Event Log. If this script finds domain controllers where the event occurs, a
8+
CSV file is created in the directory ~\Documents and after checking all domain controllers a table is displayed in the shell.
9+
10+
.NOTES
11+
Version: 1.0
12+
Author: Arne Tiedemann
13+
Rewrite Author: Manuel Winkel <www.deyda.net>
14+
Creation Date: 2020-03-04
15+
Purpose/Change: Extension by event id 3040
16+
#>
17+
###########################################################################
18+
# Variables
19+
###########################################################################
20+
$OU = (Get-ADDomain).DomainControllersContainer
21+
$DCs = Get-ADComputer -Filter * -SearchBase $OU
22+
23+
# Create an Array to hold our returnedvValues
24+
$InsecureLDAPCount = @()
25+
###########################################################################
26+
# Functions
27+
###########################################################################
28+
29+
###########################################################################
30+
# Script
31+
###########################################################################
32+
# CleanUp the Environment
33+
$null = Get-ChildItem -Path ~\Documents\InsecureLDAPBinds*.csv | Remove-Item -Force
34+
35+
# Getting Events from all DCs
36+
foreach($DC in $DCs.Name) {
37+
if (Test-Connection -Count 1 -ComputerName $DC -ErrorAction SilentlyContinue) {
38+
# Define the result as true
39+
$Result = $true
40+
41+
# Test if Machine is avalable
42+
try {
43+
$null = Test-WSMan -ComputerName $DC -ErrorAction Stop
44+
} catch {
45+
Write-Host 'We are not able to use remote management with these Server: ' -NoNewline
46+
Write-Host $DC -ForegroundColor Yellow
47+
$Result = $false
48+
}
49+
50+
# Run only if the machine is reachable
51+
if ($Result -eq $true) {
52+
try {
53+
Write-Host 'Getting Events 2887 from DC: ' -NoNewline
54+
Write-Host $DC -ForegroundColor Green -NoNewline
55+
56+
# Grab the appropriate event entries
57+
$Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{Logname='Directory Service';Id=2887; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
58+
59+
if ($Events.Count -gt 0) {
60+
61+
# Loop through each event and output the
62+
ForEach ($Event in $Events) {
63+
$eventXML = [xml]$Event.ToXml()
64+
65+
# Build Our Values
66+
$Count = ($eventXML.event.EventData.Data[0])
67+
}
68+
69+
# Add new line to Arraylist
70+
$InsecureLDAPCount += [pscustomobject]@{
71+
DomainController = $DC
72+
Count = $Count
73+
}
74+
}
75+
Write-Host ' Done...' -ForegroundColor Yellow
76+
} catch {}
77+
try {
78+
Write-Host 'Getting Events 3040 from DC: ' -NoNewline
79+
Write-Host $DC -ForegroundColor Green -NoNewline
80+
81+
# Grab the appropriate event entries
82+
$Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{Logname='Directory Service';Id=3040; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
83+
84+
85+
if ($Events.Count -gt 0) {
86+
87+
# Loop through each event and output the
88+
ForEach ($Event in $Events) {
89+
$eventXML = [xml]$Event.ToXml()
90+
91+
# Build Our Values
92+
$Count = ($eventXML.event.EventData.Data[0])
93+
}
94+
95+
# Add new line to Arraylist
96+
$InsecureLDAPCount += [pscustomobject]@{
97+
DomainController = $DC
98+
Count = $Count
99+
}
100+
}
101+
Write-Host ' Done...' -ForegroundColor Yellow
102+
} catch {}
103+
}
104+
}
105+
}
106+
107+
# Dump it all out to a CSV.
108+
if($InsecureLDAPCount.Count -gt 0) {
109+
$InsecureLDAPCount | Export-CSV -NoTypeInformation ~\Documents\InsecureLDAPCount.csv
110+
}
111+
112+
###########################################################################
113+
# Finally
114+
###########################################################################
115+
$InsecureLDAPCount | Where-Object { $_.Count -gt 0 } | Format-Table -AutoSize
116+
###########################################################################
117+
# End
118+
###########################################################################

‎ADV190023/ActiveDirectory-LDAPInterfaceEventLogging.ps1

+242
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
<#
2+
.SYNOPSIS
3+
This script create a detailed CSV List of the Systems
4+
5+
.DESCRIPTION
6+
This script reads the previously created CSV file if it is not older than 15 minutes. If the file is older,
7+
the check is automatically repeated and the CSV file is rewritten. The CSV file is read and every domain
8+
controller that has at least one event (ID 2887 or 3040) is activated for LDAP logging
9+
10+
.NOTES
11+
Version: 1.0
12+
Author: Arne Tiedemann
13+
Rewrite Author: Manuel Winkel <www.deyda.net>
14+
Creation Date: 2020-03-04
15+
Purpose/Change: Update for Event ID 3040
16+
#>
17+
Param(
18+
$Runtime = 30
19+
)
20+
###########################################################################
21+
# Variables
22+
###########################################################################
23+
$OU = (Get-ADDomain).DomainControllersContainer
24+
$DCs = Get-ADComputer -Filter * -SearchBase $OU
25+
26+
# Runtime in Minutes
27+
$Hours = 24
28+
29+
# Create an Array to hold our returnedvValues
30+
$InsecureLDAPCount = @()
31+
$PathLDAPCount = ('{0}\Documents\InsecureLDAPCount.csv' -f $env:USERPROFILE)
32+
###########################################################################
33+
# Functions
34+
###########################################################################
35+
36+
###########################################################################
37+
# Script
38+
###########################################################################
39+
# CleanUp the Environment
40+
$null = Get-ChildItem -Path ~\Documents\InsecureLDAPBinds*.csv | Remove-Item -Force
41+
42+
#check if Enumeration File is new
43+
if ((Test-Path -Path $PathLDAPCount -ErrorAction SilentlyContinue) -and
44+
(Get-Item -Path $PathLDAPCount).LastWriteTime -gt (Get-Date).AddMinutes(-15)) {
45+
Write-Warning 'Skip enumerating Domain Controller Events, file is not older than 15 Minutes!'
46+
$InsecureLDAPCount = Import-Csv -Path $PathLDAPCount
47+
} else {
48+
# Getting Events from all DCs
49+
foreach($DC in $DCs.Name) {
50+
# Define the result as true
51+
$Result = $true
52+
53+
if (Test-Connection -Count 1 -ComputerName $DC -ErrorAction SilentlyContinue) {
54+
# Test if Machine is avalable
55+
try {
56+
$null = Test-WSMan -ComputerName $DC -ErrorAction Stop
57+
} catch {
58+
Write-Host 'We are not able to use remote management with these Server: ' -NoNewline
59+
Write-Host $DC -ForegroundColor Yellow
60+
$Result = $false
61+
}
62+
63+
# Run only if the machine is reachable
64+
if ($Result -eq $true) {
65+
try {
66+
Write-Host 'Getting Events 2887 from DC: ' -NoNewline
67+
Write-Host $DC -ForegroundColor Green -NoNewline
68+
69+
# Grab the appropriate event entries
70+
$Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{Logname='Directory Service';Id=2887; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
71+
72+
if ($Events.Count -gt 0) {
73+
74+
# Loop through each event and output the
75+
ForEach ($Event in $Events) {
76+
$eventXML = [xml]$Event.ToXml()
77+
78+
# Build Our Values
79+
$Count = ($eventXML.event.EventData.Data[0])
80+
}
81+
82+
# Add new line to Arraylist
83+
$InsecureLDAPCount += [pscustomobject]@{
84+
DomainController = $DC
85+
Count = $Count
86+
}
87+
}
88+
Write-Host ' Done...' -ForegroundColor Yellow
89+
} catch {
90+
Write-Warning $_.Exception.Message
91+
}
92+
try {
93+
Write-Host 'Getting Events 3040 from DC: ' -NoNewline
94+
Write-Host $DC -ForegroundColor Green -NoNewline
95+
96+
# Grab the appropriate event entries
97+
$Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{Logname='Directory Service';Id=3040; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
98+
99+
if ($Events.Count -gt 0) {
100+
101+
# Loop through each event and output the
102+
ForEach ($Event in $Events) {
103+
$eventXML = [xml]$Event.ToXml()
104+
105+
# Build Our Values
106+
$Count = ($eventXML.event.EventData.Data[0])
107+
}
108+
109+
# Add new line to Arraylist
110+
$InsecureLDAPCount += [pscustomobject]@{
111+
DomainController = $DC
112+
Count = $Count
113+
}
114+
}
115+
Write-Host ' Done...' -ForegroundColor Yellow
116+
} catch {
117+
Write-Warning $_.Exception.Message
118+
}
119+
}
120+
}
121+
}
122+
123+
# Dump it all out to a CSV.
124+
if($InsecureLDAPCount.Count -gt 0) {
125+
$InsecureLDAPCount | Export-CSV -NoTypeInformation -Path $PathLDAPCount
126+
}
127+
}
128+
#Scriptblock for getting insecure LDAP Binds
129+
$ScriptBlockLogging = {
130+
# Get Size of Directory Service Log
131+
$SizeCurrent = (Get-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\EventLog\Directory Service").MaxSize
132+
# Set Directory Event Log max Size 3GB
133+
Set-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\EventLog\Directory Service" -Name 'MaxSize' -Type DWord -Value '3221225472'
134+
# Enable Logging of LDAP Events
135+
Set-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics" -Name '16 LDAP Interface Events' -Value 2 -Force
136+
137+
Write-Host " Minutes: " -NoNewline
138+
1..$Using:Runtime | ForEach-Object {
139+
Start-Sleep -Seconds 60
140+
Write-Host "$($_)," -NoNewline
141+
}
142+
143+
# Create an Array to hold our returnedvValues
144+
$InsecureLDAPBinds = @()
145+
146+
# Grab the appropriate event entries
147+
$Events = Get-WinEvent -ComputerName $env:COMPUTERNAME -FilterHashtable @{Logname='Directory Service';Id=2889; StartTime=(Get-Date).AddHours(-$Using:Hours)} -ErrorAction SilentlyContinue
148+
149+
if ($Events.Count -gt 0) {
150+
151+
# Loop through each event and output the
152+
ForEach ($Event in $Events) {
153+
$eventXML = [xml]$Event.ToXml()
154+
155+
# Build Our Values
156+
$Client = ($eventXML.event.EventData.Data[0])
157+
$IPAddress = $Client.SubString(0,$Client.LastIndexOf(":")) #Accomodates for IPV6 Addresses
158+
$Port = $Client.SubString($Client.LastIndexOf(":")+1) #Accomodates for IPV6 Addresses
159+
$User = $eventXML.event.EventData.Data[1]
160+
Switch ($eventXML.event.EventData.Data[2])
161+
{
162+
0 {$BindType = "Unsigned"}
163+
1 {$BindType = "Simple"}
164+
}
165+
166+
# Add new line to Arraylist
167+
$InsecureLDAPBinds += [pscustomobject]@{
168+
DomainController = $env:COMPUTERNAME
169+
IPAddress = $IPAddress
170+
Port = $Port
171+
User = $User
172+
BindType = $BindType
173+
}
174+
}
175+
}
176+
177+
# Set Directory Service Log to the old MaxSize Value
178+
try {
179+
Set-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\EventLog\Directory Service" -Name 'MaxSize' -Type DWord -Value $SizeCurrent -ErrorAction Stop
180+
} catch {
181+
Set-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\EventLog\Directory Service" -Name 'MaxSize' -Type DWord -Value 1024 -ErrorAction Stop
182+
}
183+
184+
# Disable LDAP Logging
185+
Set-ItemProperty -Path HKLM:"SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics" -Name '16 LDAP Interface Events' -Value 0 -Force
186+
187+
Write-Host ' Events found: ' -NoNewline
188+
Write-Host $InsecureLDAPBinds.Count -ForegroundColor Green -NoNewline
189+
190+
# Dump it all out to a CSV.
191+
if($InsecureLDAPBinds.Count -gt 0) {
192+
$InsecureLDAPBinds | Export-CSV -NoTypeInformation C:\Windows\Temp\InsecureLDAPBinds.csv
193+
}
194+
195+
# Done
196+
Write-Host " Done.. " -ForegroundColor Green
197+
198+
}
199+
200+
# Activate LDAP Logging on every DC in the Domain and let it run for 30 minutes
201+
foreach($DC in $InsecureLDAPCount | Where-Object { $_.Count -gt 0 }) {
202+
if (Test-Connection -Count 1 -ComputerName $DC.DomainController -ErrorAction SilentlyContinue) {
203+
# Test if Machine is avalable
204+
try {
205+
$null = Test-WSMan -ComputerName $DC.DomainController -ErrorAction Stop
206+
Write-Host 'Running on: ' -NoNewline
207+
Write-Host $DC.DomainController -ForegroundColor Green -NoNewline
208+
209+
# invoke command on remote DC
210+
Invoke-Command -ComputerName $DC.DomainController -ScriptBlock $ScriptBlockLogging -ErrorAction Stop
211+
212+
# Copy file to local drive
213+
if (Test-Path -Path ('\\{0}\Admin$\Temp\InsecureLDAPBinds.csv' -f $DC.DomainController) -ErrorAction SilentlyContinue) {
214+
Move-Item -Path ('\\{0}\Admin$\Temp\InsecureLDAPBinds.csv' -f $DC.DomainController) -Destination ('{0}\Documents\InsecureLDAPBinds_{1}.csv' -f $env:USERPROFILE, $DC.DomainController) -Force
215+
}
216+
} catch {
217+
Write-Host ' The machine: ' -NoNewline
218+
Write-Host $DC.DomainController -ForegroundColor Green -NoNewline
219+
Write-Host (' {0}' -f $_.Exception.Message) -ForegroundColor Yellow
220+
}
221+
}
222+
}
223+
224+
# Get all files and and output a summary
225+
$Files = (Get-ChildItem -Path ~\Documents -Filter 'InsecureLDAPBinds_*.csv').Fullname
226+
$LDAPBinds = @()
227+
228+
foreach($File in $Files) {
229+
$LDAPBinds += Import-Csv -Path $File
230+
}
231+
###########################################################################
232+
# Finally
233+
###########################################################################
234+
if($LDAPBinds.Count -gt 0) {
235+
# Cleaning Up the workspace
236+
$LDAPBinds | Group-Object -Property 'DomainController',"IPAddress","User","BindType" | Select-Object Count, Name
237+
# Export LDAP Binds
238+
$LDAPBinds | Export-Csv -NoTypeInformation -Encoding UTF8 -Path ~\Documents\InsecureLDAPBinds.csv -Force
239+
}
240+
###########################################################################
241+
# End
242+
###########################################################################

0 commit comments

Comments
 (0)