dscl
Created by Jonathan Bar Or (@yo_yo_yo_jbo)
Description
An extensive tool for communicating with the Directory Services, useful for Discovery.
| Created | Tactics | Tags |
|---|---|---|
| 2023-04-25 | Discovery Persistence | users network configuration groups shares password policy |
Paths
/usr/bin/dscl
Use Cases
Local user enumeration
Enumerate all local users.
dscl . -list /Users
Active Directory user enumeration
Enumerate all Active Directory users.
dscl "/Active Directory/TEST/All Domains" -list /Users
Local user information gathering
Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.
dscl . -read /Users/$USERNAME
Active Directory user information gathering
Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.
dscl "/Active Directory/TEST/All Domains" -read /Users/$USERNAME
Local group enumeration
Enumerate all local groups.
dscl . -list /Groups
Active Directory group enumeration
Enumerate all Active Directory groups.
dscl "/Active Directory/TEST/All Domains" -list /Groups
Local group information gathering
Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the “admin” group.
dscl . -read /Groups/$GROUPNAME
Active Directory group information gathering
Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the “admin” group.
dscl "/Active Directory/TEST/All Domains" -read /Groups/$GROUPNAME
Computer enumration
Enumerate all computers in an Active Directory.
dscl "/Active Directory/TEST/All Domains" -list /Computers
Share enumration
Enumerate all shares.
dscl . -list /SharePoints
Password policy discovery
Gain password policy information
dscl . -read /Config/shadowhash
Change a user password
Change an existing user’s password.
dscl . passwd /Users/$USERNAME oldPassword newPassword
Detections
- No detections at time of publishing