-: Hello and welcome back.
So in this lecture we're going to touch
on a subject that we haven't covered in the course yet.
For this we're going to need knowledge of two major things.
One of those things is knowledge of active directory.
Now, since this is out of the aspect for this course
we will not be covering what Active directory is
or how it works.
So I do recommend for you to go and read about it
or just to get the basic knowledge so you can follow along
through this challenge that we're going to go through
in this lecture.
So I recommend going onto the Microsoft website
because all of the documentation and all of the definition
and structure of Active Directory can be found here.
You just type in active directory, you click
on any of these links and you start reading about it.
Now this is a lot of things to read
so you don't really have to do that.
You can just go and Google
on some other website that gives more plain
and simple explanation of Active directory
what it is and how it works.
And that should be enough for this lecture.
The second thing that we need is a Try Hack Me account.
So
in my Back bound course I do cover the Try Hack Me platform
but for this course I think we are encountering it
for the first time.
So go ahead, create an account on the Try Hack Me platform.
And once you create an account
there is one more thing that you should do
and that is to connect to their VPNs
so you can access their virtual machines that are used
for practice.
So for this particular lecture we're going to
cover the attractive directory challenge.
Now you can find the attacktive directory challenge
at this link right here.
So try hack me.com room and then slash attractive directory.
Once you go there
you will also have a simple explanation here
on how you can deploy the machine
that we are going to be targeting as well
as how you can connect to their vpn.
So to connect to their vpn
just follow along this small tutorial
under the task number one and you should be connected
to the open VPN at the end of this task.
As you can see right here
I downloaded my VPN configuration file
and I used pseudo open VPN to open
and run this configuration file.
So you will need to use pseudo once you do that.
Let me lower this.
We no longer need this window.
You should have their IP address.
If you type I config and scroll all the way down
there will be another interface turning
up with an IP address for this vpn.
Okay, awesome.
Once we do that
we are ready to get started with attacking this machine.
So we are strictly going to focus
on completing these challenges right here
that we are provided.
So we're not going to mention some other different ways
that certain things can be done.
We just want to complete this task.
So for the first task, which is setting up the machine
and the VPN, there is nothing really that we need to do
but once we do that we can just click on start machine
and our machine or our target machine will be started
and it's IP address will be shown in one minute.
The machine expires in about one hour
but you can always click on add one hour
if you haven't finished everything
or you can just terminate the machine and restart it again.
Okay, so once we finish the first task
we are ready to go onto the second task, which is set up.
Now for this, I already finished all of these things
but you will need to do it installing in packet.
So it does give you commands
and the tools that you will need to
install certain things that this challenge requires.
So for example, you need to keep the impacket dot kit
and it'll be stored in the slash opt slash impacket.
Another thing that you need to do is install
the requirements for the packet with PIP three
and you need to run the setup.py file
once you complete these two commands.
So just follow along, read through all of this
follow along the commands that you need to execute
for this challenge.
And in case you encounter some issues, there is
also different commands here that might work instead.
And once you're done with the impacket
you also want to install Bloodhound
and Neo4J with the command provided down below.
It might require pseudo, I don't really remember
but give it a try without and with pseudo.
If you have issues, always perform APT
update and APT upgrade first
and then redo the installation of these packages.
Okay, once that is done
we are ready for the first real task, which is enumeration.
So you will notice that right here I have some
of the tasks completed, but we're just going to ignore that
and we're going to pretend as
if we are restarting this from the beginning.
Okay.
So enumeration,
Welcome to tactic directory.
Now here is the introduction and here is the part
that explains why enumeration should be done first
and which tools we can use to complete the enumeration part.
So right here we have several questions that we
need to answer and some of them are already answered
but don't mind that at the moment.
And let's go with the first task.
So let's read through this real quick.
Basic enumeration starts out with an Nmap scan.
Nmap is a relatively complex utility that has been refined
over the years to detect what ports are open on a device
but services are running
and even detect what operating system is it running.
It's important to note
that not all services may be detected correctly
and not enumerated to its fullest potential.
Despite Nmap being an overly complex utility
it cannot enumerate everything.
Therefore, after an initial N map scan
we'll be using other utilities to help us
enumerate the devices or the services running on the device.
Okay, we have some notes here that will be used for later.
And the three questions that we get in this
part of the task is what tool will allow us
to enumerate port 1 39 N 4 45,
What is the net bio domain name of the machine
and what invalid
TLD or TLD is also known as top level domain
do people commonly use for their active directory domain?
Okay.
So as our task told us,
the first approach will be to run a simple Nmap scan
which we can do by typing Nmap.
And then we just paste the IP address given to
us right here and press enter.
So this is the basic Nmap scan.
We're not using any other options and we'll just
get several ports open.
Now, based on these ports, we can already assume
that this target is running an active directory.
Since we see net bios, we see curbs, we see ldap
all these ports can indicate an active directory.
Now if we want to check the versions
we already know that we can run the dash as these can
and this will deploy the versions or this will
output diversions of softwares running on these open ports.
Okay, so we can see all of it right here and here
under this service on the ldap, we can already
see the
first answer
to the third question right here
which is what invalid top level domain do people
commonly use for their active directory domain?
And the answer is dot local.
We got dot local right here output it.
So if you paste it here it will be the correct answer.
But before that, since this is the third question
just don't mind it at the moment.
We did get the output of it in the SV scan
but let's answer the second question first.
What is the net bios domain name of the machine?
So here we really don't get the output for that
but there are several tools that we can use to
get the output.
One of those tools is enum4linux.
If you just type enum4linux and you paste the IP address
it will perform several different tasks
or checks including trying to discover the net
bio's domain name of the machine.
So it'll take several seconds for it to finish.
So let's wait for that.
Okay, so we can control c this
we don't need it to run any longer.
We got what we searched for
so the netbio's domain name we can find
or we can read it right from here.
So here are the accounts on the active directory
and
THM dash AD
would be the domain name.
And we can also read it up here.
It already got outputted to us before, which is right here
domain name
THM dash AD.
So if you copy this, you paste it right here
it will be the correct answer.
And what tool will allow us to enumerate port 139?
445 we can use in enum4linux
but it is not the only tool that can be used.
This THM dash ad can also be discovered
with MSF console.
So let me show you, there is a module
the auxiliary module that can be used to also
get the domain name once we input the target ip.
So let's just wait for the MSF console to open up.
And the auxiliary module that we want to
use is the SMB version.
We might have already used it before in the course
but right now we're going to use it
for the purposes of enumerating attacktive directory.
Okay, so the MSF console opened up
and we want to go use auxiliary.
We want to go
scanner first.
Go scanner than SMB and SMB version
so show options
will give us all the input fields that we need to provide.
And the only one is our hosts
which we can just paste like this.
And if I type run it should work.
And in the output we should get the domain name
that we are asked for in the enumeration phase.
And here it is authentication domain THM dash ad.
So it's also another tool that can be used to
discover the domain name.
Okay, awesome.
Now that we cover the first part of the enumeration
now let's go to the enumerating users via Kerberos.
So if you read through the Microsoft documentation
that I provided you for the active directory
you will also encounter something called Kerberos.
And we do get a little bit of a definition right here.
So a whole host
of other services are running including Kerberos.
Kerberos is a key authentication service
within active directory.
And after this definition it does provide us
with a little bit of a hint
of how we can approach this challenge.
And with this port open
and we saw the kerberos running on an open port
we can use a tool called Kerbrute to brute force directory
of users, passwords and even perform password spraying.
And here's the little note, several
of the users have informed me that the latest version
of Kerbrute does not contain the userEnum flag in Kerbrute.
If that is the case
with the version you have selected, try an older version.
So just quick note right here.
And enumeration.
So for this challenge we will need a modified user list
and a password list which will be used to cut
down on time of enumeration of users and passwords.
Hash cracking.
All right, so three things we're going to need
for this part of the challenge.
We're going to need Kerbrute.
So just click on this link open
in a different tab so you can download a tool
and you also want to download the user list
and the password list, which you can also open
in a different tab and download it from there.
Now, I've already downloaded all three.
As you can see I have Kerbrute right here.
I have the users and the password list right here.
So simply just save the user list
and the password list and you will get these two txt files.
And Kerbrute tool can be downloaded from GitHub.
If we go right here and here
you will have the versions depending
on which operating system you're running.
We want clinic CMD 64 and you can download it
or you can see
the download or installation process
by deleting the releases
and going to just the Kerbrute page
or the Kerbrute official page.
You could have also clicked right here probably.
And here if I scroll all the way down,
we will see the usage
and we will also see the installation guide
which tells us how we can install Kerbrute.
Okay, again, back to our challenge
or to our attacktive directory.
And once it loads up, let's see which questions do we get
in this part of the challenge?
Okay, let's go down once again, enumerating
and the three questions are already answered, but let's see
how did we come up with these solutions?
And the first one is what command
with Kerbrute will allow us to numerate valid user names?
So once you download Kerbrute, let's exit the MSF console.
Yeah, this is the command to exit Python, not MSF console.
So let's do it properly.
We go to desktop or
wherever you have your Kerbrute downloaded
and you change the directory to the Kerbrute.
If you compiled it the way that is shown
on the GitHub installation page, then
in the desk directory you will have all the
executable files.
Now I deleted the rest
since the only one that we need is Kerbrute linux, AMD 64.
Now to just run it
we can type dot slash Kerbrute
and just press enter.
It'll give us the help menu for this tool.
Now it is asked what command within Kerbrute
will allow us to enumerate valid user names.
And already here under the available commands
we can see user in them, which will enumerate valid domain
usernames via Kerberos, so we can already specify it right
here without even running the command first.
But let's see, since for the other two questions
we will need to run that command.
Let's do it like this to run it properly.
And let me just move this a little bit up.
To run it properly, you want to type Kerbrute
or the executable name and then user enum, then
dash D will be the domain as we can see right here.
And we saw in the first part, the domain
given or the full domain given is spooky sec dot local.
Remember when we provided it dot local
under the first enumeration part?
Well this is the first or the full domain to our target.
And we can also specify the IP address
by using dash dash dc.
And we should also see that option somewhere.
Or is it in?
Okay, here it is.
Dash dash dc is the location of the
domain controller to Target.
So if it is left blank, if it's not specified
it'll look this up on or over dns.
So here essentially we want to copy the IP address
and paste it right here.
And since we are provided with user and password lists
we can use the user list to enumerate users.
All we have to do
is type in users
dot txt.
But let me just see if it's in the same directory.
It's not in the same directory.
So we have to specify the full path home, Mr.
Hacker, desktop users dot txt, or pretty much wherever
you have it saved, just specify the full path
to the user's file and if I press enter
it will output all the users that it managed to find.
As we can see valid username for James SVC admin.
And it also has something interesting right here,
which we will talk about in just a second.
And there are other valid usernames such as administrator
which will also be interesting later on and the backup
which will certainly be interesting later on.
So let's answer these questions right here.
What notable account is discovered?
These should jump at you.
The first thing that we see is SVC admin.
And why is it?
Well, that's because it's the only one
that outputted the entire hash right here for us to see.
So that's the first account that is discovered
and that is notable and interesting to us.
Now we will see what we can do with this hash later on
but let's specify SVC admin
as an result right here.
What is the other notable account that is discovered?
Well, it's definitely backup
since it's not that common to see it.
But administrator would also be a decent answer
because administrator is always something
that we are targeting, but it is a normal account to see
on active directory, whether it being administrator
or route or anything like that.
It's a must to have on active directory.
So we'll just going to go with backup
as the other notable account that is discovered
since it can be interesting for us.
Now, once you answer these two questions
you can close this tool.
No need for it to run anymore.
And in the next lecture we're going to see how
useful this will be for us
in the exploitation phase of this challenge.
See you in the next lecture.