Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 02. Protocols / DNS / Zone Enumeration

Attack

Zone enumeration is the low-noise way to turn DNS into an internal map. We enumerate records through DNS queries, AXFR if misconfigured, LDAP if we have domain credentials, and local DNS tooling if we are on a domain controller.

Variables

export DOMAIN=ootw.local
export DC=10.10.10.200
export USER=student
export PASS='student'

Basic DNS records

dig @$DC $DOMAIN SOA
dig @$DC $DOMAIN NS
dig @$DC $DOMAIN MX
dig @$DC $DOMAIN TXT
dig @$DC $DOMAIN ANY

SRV records

dig @$DC _ldap._tcp.$DOMAIN SRV
dig @$DC _ldap._tcp.dc._msdcs.$DOMAIN SRV
dig @$DC _kerberos._tcp.$DOMAIN SRV
dig @$DC _gc._tcp.$DOMAIN SRV

AXFR

dig @$DC $DOMAIN AXFR
dig @$DC _msdcs.$DOMAIN AXFR

adidnsdump

adidnsdump -u "$DOMAIN\\$USER" -p "$PASS" ldap://$DC
adidnsdump -u "$DOMAIN\\$USER" -p "$PASS" ldap://$DC -r

LDAP query

ldapsearch -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "DC=DomainDnsZones,DC=ootw,DC=local" "(objectClass=dnsNode)" name dnsRecord

Windows PowerShell

Get-DnsServerZone -ComputerName dc01.ootw.local

Get-DnsServerResourceRecord -ComputerName dc01.ootw.local -ZoneName ootw.local

Get-DnsServerResourceRecord -ComputerName dc01.ootw.local -ZoneName _msdcs.ootw.local

dnscmd

dnscmd /enumzones

dnscmd /zoneprint ootw.local

dnscmd /zoneexport ootw.local ootw.local.zone

Resolve host list

while read h; do dig +short @$DC "$h.$DOMAIN" | sed "s/^/$h.$DOMAIN /"; done < hosts.txt

Interesting names

dc, dc01, ad, ldap, kerberos
ca, pki, certsrv
sql, mssql, db, database
file, files, share, fs, nas
web, intranet, portal, app
backup, veeam, monitor, sccm
wpad, proxy, isatap

What to keep

Hostnames that imply roles
Records pointing to old or unreachable IPs
Records for PKI and ADCS
MSSQL names
File server names
WPAD or proxy names
Names that users or services are likely to access