In this video we are going to enumerate the ended up using that Bogart ended up.
So that was a protocol and it's correlated with direct access protocol used to add fetch and be the
objects in the Active Directory, not only inaccurately, we also have buried the next version of that.
Open it up.
So whenever you see the appropriate name open.
So that means you can assume that sort of visual learning on the set of it and would be set up.
So said you can either indicate and you can fetch the information on the date, etc..
And here I have my Windows Error Button 16.
The domain name is technician in that call and I have this test run and test boot.
So maybe third and that service will be running on this accurately.
You can also ensure adapter is using the server manager on different port as well.
We have the we should need the credentials for any of the user who this, uh, out of this equatorial.
So let's assume that the user you found some credentials and you can go ahead and try to authenticate.
So if you view the heritage and you can see there are so many options.
So you can use minus any prison without any comments and freshman is minus which the host so this is
the lab server and this one is you are right and B is for put and that would be another option B for
bind and we'll be using the blue for the password.
And this actually the band you need to specify an object to bind the connection to and from a connected
object.
We can query subtree from this.
So here you can see there are some computers.
So if you go ahead and bind for this computer, see?
And so when it goes to computers and these years, go take this name.
Control.
Then you can only record from this down, but as well you can't quite see other uses, etc. So that's
where we the binding to the main group, uh, root component that inspects that local.
So let's go ahead and say there are the remaining comments and minus six for simple authentication.
So there are two types simple.
And so that will be using the simple ID message.
Host So you can also do something like this.
Com
DC name if you don't know the name of this domain control, that's no problem.
You can it with your IP address as well.
So this is my IP address.
And then we need to specify port that is 389 and then we need to specify the user name.
So user name is like 69.
So that's Pashtu.
So I have occurrences of the text two.
I can use W for the password.
So you can also use capital W and you to plan for the past since you'll be coding many times.
Let's put the password here.
And the next option you need to do is.
So where we want to buy.
And that is this one our position that is one component.
So it's a DC stands for the main component takes issue nine comma DC is a coastal marker.
So this is the destination name for an object.
Whenever you go here and attach to and web properties and to the reader and you can see that distinction
that so you can see this distribution name starts from underneath.
Now put directory to the row now and you can see that can only connect goes to Pashtu and this is in
the name uses this is not an organization so this is normal uses and this use is in that position and.
So that is the distinguished name.
Oh, it's often this distinguished name.
Now when you do, if you hit and run with all of these objects, there is so much in everything you
can quite see.
You can see there is so many cars.
Now we are going to filter this.
So religion applied the filter so these objects can be treated as object classes.
So the there are some object classes like users, computer groups, etc. So like that you can see the
object class is to use.
So this is a case into the still you can
type normal capital C as well and you can see maybe so much information about all this.
And we're going to see some of the information about that.
User object classes, start person organization, but a certain end user.
So this is like hierarchy, I guess.
And you can see all of the information number of remote desktop users.
Object, gravity, you can do that and large parts of it are set and object said as well.
And user principle.
Now this is the big idea.
And Saramago name is Rogan a name.
So we can also, uh, get the attributes as well.
So you can say some account name and here you can see you get administrator cash, default account,
windows, currency.
So this brother is the computer account.
So you can see the ruler.
And then that means the computer icon by default, converted accounts are also paid as a user accounts.
So there are two computers, Windows and 16.
And this is the part that the man controls and the KBC is compute is a part of this unit are computers.
So you can put the space and you can go for destination M you can set in and obviously you get the the
finish name so you can also get object said.
And again, quoting your user principal now.
You're also waiting for the computer as only the computers.
Richard.
Sam, I can name.
So these are the only two computers.
Now, what we can do is we can also perform some operations.
There are some operators you can do order and greater than equal to return, equal to and not.
So here you need to specify the operator that is end.
And the first condition is of is equals to user.
And the next one is you can specify object class is equal to computer.
So what we're doing is we're getting every object that is user and computer now can gender.
User and computer.
So okay, user.
Normally these are not computers, but these computers are also users.
Now, what I will do is I will put an operator that is not.
Now here we are trying to fix are the users, but not computers and heat and power.
And you can see we did not get windows to the 16 and naked we see here.
We are getting only the usernames.
So user user accounts.
You can also change this to order.
So we are getting users are not computers so I think what are the information.
So we get all the information that is either user or not computer.
We can remove this one.
We are getting either user or computers.
So we are getting both.
You can go ahead and prioritise and go back to the router and you can see the.
There are some important attributes, so you can try to get them as well.
Well, let's go and see the groups.
So object class is equal to group.
And here you can see there are so many groups.
So particularly we can also use we are interested in admins, but we're also interested in only admins.
Right.
So I'm going to be another filter that is.
We can also use the wild card as an object.
So that's a name as equals to starter admin.
When you hit enter and you get only the groups that have the name admin select, you're going to see
only the administrators.
Now what I want to do is I want to set the users for the particular group to be in the segments.
So you need to copy this or distinguish the name of this being segments.
Now?
No, this one.
Now, what we're going to do is we are going to change this object class is equal to user and the next
move there is that the user should be the member of and paste the distinguished name here.
And he tender and there are no you lose under the instruments.
You can go and change this to domain administrators.
So Berman admins.
And here you can see the administrator.
You can also call for remote desktop as well.
Okay.
They are in the building one.
And you're going to see that these two years are so young.
Young.
But if you've got the credentials, you can probably be into the.
So in order to compile that juicy part, uh, let's first right click on this.
If you go to I do read it and search for user account control and you will get the attributes of that
object and you can see there is a hexadecimal number when you are coding in this and it upsets me,
we get the integer.
So I will show you how to decode that as well.
First, let's focus on this normal account and don't explain password.
And here you can see want the greater Kerberos three ID.
So you want to go very far by icons that have this vertical propagation and then you can perform this
instead of parachuting.
So first, let's fetch this user account control.
The object class is equals to user and SAM acronym and user account control.
So you can see it misses the decimal number.
Our father knew this.
That control.
Now you can.
You can search for this.
By default, every user will have a fight over and here to concede the fight for a bit.
So there is a tab for this.
So if you go to this website and where you can see the chart here.
So these are the, uh.
Values for this aspect.
Blue flag, the flag and their values and S.R.O. second shared with dignity has the 514 So that means
it should have the normal icon and five plus five progress to that issue that is again desirable.
So we know we can drag into the categories so that state has the value for voting, which is the combination
of normal icon and icon visible.
So in that way if you are in convert or any flag like so let's take the example for this.
We know that the user have this flag, the ID said.
So we are going to copy this one which is 42 x 60,003 42.
Now if you go to this 42 X and see what is near to this, which is less than that, 42 likes this 141
that's 94 of them.
So that means you can.
Or you can assume that this flag is set and if you subtract this 41 legs from this vertical X, you
get some value and you can go and search for remaining numbers.
And it is below that one and this one is below that one.
And you can assume that flag might be set.
So this is an interesting, uh, the domain controller we have about 53480.
That is some prostrated.
So you can see a delegation.
So you can also use the PowerShell for this, but I use it this.
I do not get any.
I like this flex value.
Flex in the spring strings.
I have only one script and this one.
So the script will take the integer as a parameter and tries to convert this one again to its list.
And for each of us, it is trying to train to divide the number by two and with a particular value if
it's ten.
So it will try to and assume that this flag is set.
So it's basically like dividing the number with two and taking the flags, checking the corresponding
flags.
So let's start with this one.
I already copied the code and so this in my decode, you will see that B is one.
So if it's a partial education policy bypass and we career USC and you need to parse the number and
here you can see it, it will go and do the operation and it will show the facts for us.
Normal recount, bond expert password and biometric ID.
So you can see we got the user are gone with this and so you can go and do the Kerberos.
Yes.
It appears to know how to find this user account means you can just waiting for the bar.
You can go for the user account can which is greater than 40 likes.
So you used use greater than the equal to so let's say user account control greater than Ecuador.
So by equipping a saint, you must.
Now, what you can do is you can copy this one, which is.
Don't record the organization.
Copy this.
So if you need a flag, you said that should be the value greater than this, right?
That means if there is any other flag set along with this one, I will see you're going to add the number,
but not this.
So that should be greater than or equal to this flag.
You know it tender.
And you can see that it's just one and two.
So you can see this quality, uh, for testing my account, the backbone to put identification.
Now the next thing is we are going to search for servicemen supporting them.
So if the servicemen name you said something, so that means they are going to might be providing the
services for them so that servicemen spending is not checked for this one.
I think I said for this one.
So we can see some temporary splinters.
That balloon now hoping that this one you can just fetch.
Using a service principle
so you can drink this one.
Then we also got solutions for names for the computers as well.
So what we're going to do is.
We are going to see not object crashes because to computer.
Our what we can be used to getting some police here.
User inspired name is equal to star shamans.
There should be something.
So did not deserve Prince William's serviceman's vote.
So in front of that and also I had that Sarvis prince part name.
Okay.
We were wondering Gonder and the remaining users, uh, categories and post one.
You can see this one.
You can try to block airbrushing and get the hash for this icon.
Now another thing is you can also get the operating system information as well.
Object class is you can still computer and get a code name and operating system.
So this should give you the idea of what operating system the computers are running.
We can see Windows Server two and 16 and DEC is not.
So you can go and try and.
So this is very very important one operating system.
And you can also Bourbon Street operators are also.
Like if you have dined here.
So we have only one thing.
So we had a real run through their objectives also at national theaters as well.
So this is.
And therefore we can do the same on the stellar end or as well.
So I think that's are the basics about this enumeration.
So you can also use that to guarding equity.
So this is similar syntax to the absurd, but you can run this on, on this box, you should run on
the like you can log in with the with this credentials, with the have an item and get the publisher
from running and then be as quiet as.