dscl

An extensive tool for communicating with the Directory Services, useful for Discovery.

Author: Jonathan Bar Or (@yo_yo_yo_jbo) Created: 2023-04-25

Persistence Discovery users network configuration groups shares password policy

Paths

/usr/bin/dscl

Example Use Cases

Local user enumeration #

Enumerate all local users.

dscl . -list /Users
dscl . list /Users
dscl . ls /Users

Discovery users

Active Directory user enumeration #

Enumerate all Active Directory users.

dscl "/Active Directory/TEST/All Domains" -list /Users
dscl "/Active Directory/TEST/All Domains" list /Users
dscl "/Active Directory/TEST/All Domains" ls /Users

Discovery network users

Local user information gathering #

Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

dscl . -read /Users/$USERNAME
dscl . read /Users/$USERNAME
dscl . cat /Users/$USERNAME

Discovery users configuration

Active Directory user information gathering #

Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

dscl "/Active Directory/TEST/All Domains" -read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" cat /Users/$USERNAME

Discovery network users configuration

Local group enumeration #

Enumerate all local groups.

dscl . -list /Groups
dscl . list /Groups
dscl . ls /Groups

Discovery groups

Active Directory group enumeration #

Enumerate all Active Directory groups.

dscl "/Active Directory/TEST/All Domains" -list /Groups
dscl "/Active Directory/TEST/All Domains" list /Groups
dscl "/Active Directory/TEST/All Domains" ls /Groups

Discovery network groups

Local group information gathering #

Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

dscl . -read /Groups/$GROUPNAME
dscl . read /Groups/$GROUPNAME
dscl . cat /Groups/$GROUPNAME

Discovery groups configuration

Active Directory group information gathering #

Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

dscl "/Active Directory/TEST/All Domains" -read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" cat /Groups/$GROUPNAME

Discovery network groups configuration

Computer enumeration #

Enumerate all computers in an Active Directory.

dscl  "/Active Directory/TEST/All Domains" -list /Computers
dscl  "/Active Directory/TEST/All Domains" list /Computers
dscl  "/Active Directory/TEST/All Domains" ls /Computers

Discovery network shares

Password policy discovery #

Gain password policy information

dscl . -read /Config/shadowhash
dscl . read /Config/shadowhash
dscl . cat /Config/shadowhash

Discovery password policy

Change a user password #

Change an existing user's password.

dscl . passwd /Users/$USERNAME oldPassword newPassword

Persistence password

Local account creation #

Create a local account

dscl -create

Persistence

Detections

Jamf Protect: Detect user account creation with dscl