Find compromised passwords in Active Directory with Have I Been Pwned

• Author
• Recent Posts

Wolfgang Sommergut

Wolfgang Sommergut has over 20 years of experience in IT journalism. He has also worked as a system administrator and as a tech consultant. Today he runs the German publication WindowsPro.de.

Latest posts by Wolfgang Sommergut (see all)

• Activate BitLocker with manage-bde, PowerShell, or WMI - Wed, Sep 20 2023
• Join Azure Active Directory with Windows 11 - Tue, Sep 12 2023
• Manage enhanced security mode in Microsoft Edge using Group Policy - Fri, Sep 8 2023

It's easy to find lists containing vast numbers of hacked passwords on the Internet. These credentials are easily accessible and can be exploited by malicious actors for brute force attacks.

To check whether Active Directory users are utilizing compromised passwords, you can query HaveIBeenPwned.com. This website contains a database of hundreds of millions of stolen passwords.

Consulting HaveIBeenPwned

The website provides a form for interactive usage where you can input a password for verification. This proves useful, for instance, when you want to determine whether a password has been compromised before assigning or changing it.

Determining whether a password has been leaked after a cyberattack

For administrators looking up passwords from Active Directory in the lists of HaveIBeenPwned, however, this function is rendered useless because AD passwords are stored as hashes.

Invoke API function

Nonetheless, the website offers an API for this task, where you provide the first five characters of a hash. As a result, you receive all hashes from the database that start with this character sequence, truncated by the initial five characters.

For the hash

198ffc97717b69d5b8227a1dde33bada

you would call the function as follows:

https://api.pwnedpasswords.com/range/198ff?mode=ntlm

The response would then contain c97717b69d5b8227a1dde33bada if the password were compromised.

Retrieving hashes from AD

The initial challenge lies in the fact that neither the GUI tools nor the PowerShell module for Active Directory provides direct access to password hashes stored in AD. Some guides suggest dumping the AD database using a shadow copy for this purpose.

A more elegant approach is available using the DSInternals PowerShell module. It contains the Get-ADReplAccount cmdlet, which generates a replica of the AD database via MS-DRSR. Therefore, you must invoke it with the credentials of an account owning the necessary replication rights.

Installing DSInternals and configuring replication users

The first step is to install DSInternals using the following command:

Install-Module DSInternals

Subsequently, provide the account you intend to use for this task with the required permissions. While a domain admin could be used for this purpose, it's not recommended in production environments.

For this task, open the properties from the context menu of the domain in AD Users and Computers and navigate to the Security tab.

Then grant the desired user or group the Replicating Directory Changes All and Replicating Directory Changes permissions.

Grant permissions to the user responsible for reading the password hashes

Now, you can retrieve an account's password hash and pass the first five characters to the API function of HaveIBeenPwned.

However, you have to overcome another hurdle because the hash is not available as a string but rather as a byte array of decimal numbers. These need to be converted to hexadecimal format and then combined into a string.The complete script is as follows:

Import-Module DSInternals
# Get users who have changed their password after a certain date
$user = Get-ADUser -Properties PasswordLastSet -Filter "PasswordLastSet -gt '08/21/2023'"
# Request the credentials of the user who will fetch the password hashes
$cred = Get-Credential

$user | foreach{
$hash=""
"`nChecking password for: " + $_.SamAccountName
$r = Get-ADReplAccount -SamAccountName $_.SamAccountName -Domain contoso -Server dc1 -Credential $cred -Protocol TCP
#Turn byte array into a hex string
$r.NTHash |foreach{
    $hash += ([Convert]::ToString($_,16)).padleft(2,"0")
}
#Calling Web API passing the first five chars of the hash
$pwned = Invoke-WebRequest -UseBasicParsing -Uri ("https://api.pwnedpasswords.com/range/" + $hash.substring(0,5) + "?mode=ntlm")
#Look up hash in the response from haveIbeenpwned
if($pwned.Content.ToLower().contains($hash.substring(5))){
    "`nPassword for " + $r.DisplayName + " is compromised!"
 }}

The script identifies all users who have changed their passwords since a specific date, such as the beginning of the current month, and checks whether the new password has been compromised.

Executing the AD password verification script

Summary

Given that access to Active Directory often relies on just a username and password, it's crucial to employ secure passwords. Administrators can ensure this, to a certain extent, through the password policy.

However, to prevent the use of compromised passwords, external services need to be consulted. HaveIBeenPwned maintains an extensive collection of stolen passwords that can be utilized for this purpose. By calling an API function using PowerShell, one can determine whether passwords have been compromised.