Active directory in Windows have some built in features to set restriction for passwords created in your environment. How cool would it be if we can compare the passwords used in your AD environment with the passwords disclosed in breach database? By doing this you can ensure that none of your users are using weak or passwords exposed in data breaches. If you are in IT security operations, this is something you really have to do and your CISO will definitely love it. To get this done we can make use of some cool OSINT tools. Password hashes from breaches and tools or scripts to query in Active Directory are required to perform this audit. Integrating them would give you an fantastic solution to audit your Active Directory.
Data breach database
HaveIBeenPwned (HIBP) contains passwords from many major data breaches, including Adobe, LinkedIn and many more. HIBP offers these password in SHA-1 and NTLM formats to download. There is even a API available which can integrated into any application. When I was drafting this post, HIBP contains 551 Million pwned passwords. If you check that link, you can find the download link available in NTLM format. You can either download the file directly or use torrent and download at your desired speed/time.
OSINT Tools which supports HIBP
DSInternals is a fantastic powershell module developed by Michael Graffnetter. It has multiple functionalities like hash dumping, password reset, LSA policy modification.
- Install DSInternals using the instructions here.
- Download the NTLM hash(ordered by hash) from HIBP
- Now you can query your AD using the cmdlets described here.
You will get results similar to the sample below.
Active Directory Password Quality Report ---------------------------------------- Passwords of these accounts are stored using reversible encryption: smith doe LM hashes of passwords of these accounts are present: hodge These accounts have no password set: test01 test02 Passwords of these accounts have been found in the dictionary: Administrator These groups of accounts have the same passwords: Group 1: graham graham_admin Group 1: admin sql_svc01 These computer accounts have default passwords: DESKTOP27$ Kerberos AES keys are missing from these accounts: sql_svc01 Kerberos pre-authentication is not required for these accounts: jboss Only DES encryption is allowed to be used with these accounts: sql_svc01 These administrative accounts are allowed to be delegated to a service: AdatumAdmin Administrator Passwords of these accounts will never expire: admin sql_svc01 These accounts are not required to have a password: gonzales
You can automate this by creating a scheduled task and save the results in a file.
To store results in a .csv, try the below commands in your ps script.
$accounts = Get-ADReplAccount -All -NamingContext 'DC=contoso,DC=com' -Server dc1.contoso.com $results = $accounts | Test-PasswordQuality -WeakPasswordsFile BadPasswords.txt $riskyAccounts = $accounts | where SamAccountName -in $results.WeakPassword $riskyAccounts | select SamAccountName,DisplayName,DistinguishedName | Export-Csv output.csv
Lithnet provides deep integration between HIBP Password DB and Active directory. Lithnet not only checks for pwned passwords, but blocks when a user is trying to set a new password which is part of pwned passwords or a dictionary.
These are some of the features of Lithnet
- Block compromised passwords from being used.
- Block passwords based on certain words.
- Define complexity policies based on length.
- Regular expression-based policies.
- Points-based complexity.
Lithnet supports writing logs in Windows event viewer, this will help administrators to create alerts whenever someone tries to create a pwned password.
Compromise is simple GUI based tool which supports HIBP database to check pwned passwords. It lets you check users from a specific OU.
HIBP Pwned password has a API support as well. This tool from Kloud supports checking pwned passwords in active directory by leveraging HIBP API.
This is how this tools works.
- taking the new password received from PCNS
- hashes the password to SHA-1 format
- looks up the v2 HIBP API using part of the SHA-1 hash
- updates the MIM Service with Pwned Password status
In this way you don’t have to download the pwned passwords every time it is updated in HIBP. You need a API key which was once free and now costs US$3.50 per month. After this announcement, this tool supports using downloaded database of pwned passwords. So an updated version is listed here.
Dictionaries to use in addition to HIBP
Some of the tools listed above supports checking password against any dictionary passwords list. If you are looking for such list, Seclist is a great resource I would recommend. It contains various password dictionaries used by white/black hat hackers.
Troy Hunt has done a incredible work by creating HIBP and there are so many organizations including Governments are using it. Take a look at here to find the different tools using HIBP API. There is even a domain search which allows companies to find if any of the accounts in their domain is part of a data breach.
Use these tools and identify weak or pwned passwords in your enterprise. Let me know if you are using any other tools to defend weak and pwned passwords in your environment.