So in this video, we were taking a look at the resource basic navigation attack.
This is very similar to the previous British tags.
There is only one difference.
That is the machine.
The computer is.
Crash tests and other computer for that is nonsense.
So here you have the workstation and there is a fake machine.
I.
Whenever we can write the attribute, this attribute, it must be to on behalf of other identity for
this workstation.
Then what?
This workstation thinks it blindly press this computer and gives you the impersonation you can impersonate
as any user to access the services on this workstation.
So for that, we need to how a user should have the right permission on this workstation and we should
have the ability to create the machine are going to run this domain by default.
Then computers can be created by normal users.
So here you can see the computers.
I don't have any other computers.
This one is a lot of windows and it's not working right now.
So be sure to have access as a dashboard user.
So this testimony, there is not any administrator.
So if we need to
verify this attribute further domain control and must be asked to assess how many complex accounts we
can create under domain.
After that, we need to create a fake computer account and then we need to get the seed of this account
and we need to assign that seed value to this attribute of this workstation.
Then this workstation, my brain blew this, uh, this computer.
So let's go and see.
I have already written this.
This is very simple.
Just looping over through the, uh, this easy.
And then we are just printing this and must be some sort of task created.
Write the code for create new computer so it takes the my name and the machine address parameters.
It will return the signature of this newly created computer.
Because we want we want the set of the newly created computer.
Sort of to try and catch broke.
So we can just directly bind to this our computers, or you will not see anything close to computers.
Commodities, gold.
Transitioning commodities goes through Oracle.
You can modify this going to the to the router and go for this distinguished name.
And you can see computers narrow.
So you can double click on this and grab that.
Right.
So copy this one.
So for the most uh uh domains this deal computers are they can just enumerate the uh for use using PowerShell
and create a backdoor you.
The U.S. goes to new territory in three of.
And based that you're.
No.
We need to add a channel to this one.
That will be our computer.
So these are children that.
And so this year they bring them.
And so this is a regular user of the computer.
So the string is a machine name that will be passing as the second barometer.
And the second one is computer.
So this will give you the directory entry for the computer object.
So it's a computer object.
Now we need to set some parameters for this.
We need to simulate this one as a computer object.
So that's why I took on these properties.
And go back to the letter and search for user account control.
And here you can see we have one where you that is the workstation and the writing is broken in hexadecimal.
So we're going to copy this user icon control to this one computer object properties of.
User account control dot value is equal to zero 6000.
Now when you do that this Americanism so we can object our properties our Sam name condemn remember
for the combat response there should be done right then be ready to machine them.
Whereas.
DA.
Now we need to commit this year.
Otherwise it will not be so.
Normally how commentary changes, our converter addict will be created.
And another thing is we need to set the password for this.
So password is mush because we will be creating the hash for this.
So let's set the password convert rather than invoke.
So there is a matter called set password.
And that's their strong base for this record to.
Password to.
And then we need to commit that genius again.
Now the computer object has been successfully created.
Wiggins created.
Computer.
We can also print them a password to the output so we can copy paste later to go through.
And the possibility to now fetch the seal so we can carry the attribute to the object.
So this written object said.
Object field of gyro.
And we need to, uh, convert this to here.
Izzy is equal to.
Right.
So we got this need.
We need to convert this into strings.
That will be returning our powder, our function.
Are we getting security identifier off?
New security identifier.
And we need to send this to.
Now we can just put into this said two strings or we can.
Sid these.
Siddhartha.
And we can turn this weekend's contest to.
See the dark blue string.
I'm.
We need to retain this as our knowledge as we are finally returning at the outset of this catch block.
Starting the career.
New computer will work and it will return the spring of the I said the spring of the newly created computer.
So we can change this to the we can divide this domain name to this position.
And this is going to take this disease blocker like we did previously.
So I know our code is printing number of computers we can create if we print ten.
So let's go and bring this one.
And here you can see number of convert you can create are ten.
So I got runner.
Whenever I was able to create a computer icon using this PSP user, I got this access denied.
Uh, I don't know what I did wrong.
So what I did is I have delegated this control to the testing user, add the special user, and in the
next selection you get this, I create accounts.
Then you can, uh, check this and click on get.
No.
What we need to do is we need to move forward.
This computer objects.
So this is one is a computer object and this one is computer that we need to loop over the computer
object and see if the current things that are how the right permissions over this computer are not supposed
to do that.
So I applied the filter object sequence to computer and moving over the search result so we can start
to not get better entry.
Now we need to get the object security so this will return the type to their security.
So two years ago to security.
Now we can just get the access.
Access control rules.
So we need to specify this.
How to turn and bypass and vehicle.
No.
The return babies are the traditional collection.
And so now in this race, we need to move forward these first.
So for each.
I.
I do better.
Access rule.
You are in charge now.
We can normally print the rules, but we need to compare whether.
With our username.
So right.
We need to correct the username that is.
This program is running on under so we can do that using.
Windows dot.
Windows identity don't get current.
So this will give you the string.
Who am I?
So who am I?
Represents the current username.
Are we just a current user name?
So this you're gonna return the where you like the domain name slash the use of we need to cut that
domain name.
They are split, so there will be a backwards rash.
And the second spring we need to update.
So you can put the comment here.
Take 69 slash bash two.
So we are splitting the string by this operator.
And this one is a junior element.
This one is first element.
So we get the current, the user name, as does two.
Now we are going to match this one.
If I fear that identity of friends.
So this identity of ends means which object has the x axis role on this?
A computer backed posting, Will took an additional one year.
So it would be very easy to convert the dark contents.
Now we can say current username username.
But who?
Now there is a match.
Then we can print this.
Active Directory rights.
So this will give you the right read, execute the car, etc..
Make sure it is access control like this water you are denied.
You can print others as well.
So let's bring this one.
Now if you go and run this and we can see.
We got some, uh.
Access rooms?
No.
Let's also printout this.
Uh.
Let's also print out the computer name.
That is this s r to.
As I do that part.
This will give you the end of that part.
Another can see me.
How?
Now I'll write property on this PC.
And also we have the right property and this control and I have put this right property here so we can
go and right click on this.
Properties and global security.
And I have added this dispute further reading write access.
Now we need to filter along these properties, which we know are.
Right.
So that's.
So in this computer, we have some access on this.
Now I need to filter some more.
That is, if you're not Active Directory.
Right.
Dark blue lawyer.
Sort of too strong, not too rare and indistinct.
If I have some.
Jan.
Right.
So with this.
Or are you generally called the naughty prince?
So then I'm going to print the actual letters.
Well.
So this was missing.
I think we learn from this and here we can see we how the right exist on this 1016.
So which is exactly what we need.
Now we have found that.
On this particular computer, we have red X's.
So what we're going to do is we're going to create the computer's fake computer icons.
So we've got great access on broken windows, so we're going to create poofy computers, or we can also
create one fake account as well.
We can write the one account, Siebel Computers as well.
So since we are in this room, it's better to create icons, so it will be easy to create a new computer.
I can just use some domain name because we are not using their domain name, their function, and now
return a function that will generate the random string.
So here you can see they are shooting and it will each time it will in the new random character from
this.
So it will just generate the random name.
So let's give this random name.
And this will return the strings.
Right.
String art to music.
And I'm going to print this.
Brenda Wilson, U.S..
So let's go and buy this one.
Now, if you to read this, we should see new computer icons.
Invalid syntax has been specified.
Invalid dense index.
Okay.
So I think first, let's bind to the base and then DNC and.
Okay.
I forgot this one.
We need to add this one as CNN's equals to.
Sorry for that.
Now we are going to go.
Now I think we have greater pelicans.
We're going to see the random names and the password.
So the same password.
Now we can check that and go and refresh this.
And here we can see blue computers.
Okay.
Should.
I see stronger bank.
So.
We are not printing into the shooting format.
So sorry for this.
We need to say I say that boosting.
So I seize the strings here.
So I'm just printing this close to this said this battery to a string.
So that's all we are getting wrong.
So let's go and build these accounts.
And let's run this again.
And here we can see we got the.
Since and also created the computers.
Okay.
We one last thing we need to do is we need to assign these kids.
Uh.
Well, this, uh, that is this computer that is.
This wouldn't be driven six.
Uh.
We can.
We are creating one fake.
Italian TV have created two computers in a room.
So in the foreign we are created this seed and we can just assign the side to this first 1016, and
the second one will be assigned to this computer.
So we need to find further particular resource as well.
So we are printing this new seed.
We need to convert this into bite form so we can use our security descriptor of.
Okay.
We need to add this issue to uniform.
So I this I covered this from editing website so these are if you compared this studios index.
So the first one is the owner owner B stands B stands for building administrator.
So we are assigning the symbol.
Are we retaining this engineer from that particular computer?
Well, we are mentioning that, uh, the one of these built in administrator and the darkhold is, uh,
this there are six entries and here you can see they each and the first one is the controller, that
is access.
And you can see here forever before Docker and second entries are flags.
There is no inheritance.
And third one is permissions.
So you can see these are the directory service access rights.
So again, you can just see all of these rights, uh, see ac DC and sister works.
And the last one is should be our.
So we can just copy this one.
I began sexting as junior Zeke was to copy this.
And here we need to press our the strings.
Plus the closing record.
So we need to send this one sen.
This is to this as a barometer.
Now we need to get the binary form of this.
So we need to create a new, brighter.
By significance to a shooting in New Bulgaria of.
That's Judy Garland.
So we'll be getting the binary format for this one in this bright side.
So I do need to raise we need to.
Where did this computer object?
So this one temp is the data entry.
So you can set temple dot properties off.
So right is the property we were discussing at the starting.
This one must be nice around Blacktown they are far far better.
Identity dot values equals two bytes 80.
Now we can just simply say temporary committee changes, so you can as a part of the value as well using
the clear function.
Now we can just sense the right rightly.
Center, Sid.
The computer we need to put into the computer so that we don't get any confusion if there are more computers.
So the first parameter is the seed that is new seed come out.
Second one is the important part.
So this should give you that.
So let's build this one.
And it's school based here.
Let's do returning computers.
We have.
Now we will do so.
This group will create new mobile computers and releasing their switch to the corresponding existing
computers.
But the user has the right access.
And here you can see the seed has been set to this.
Okay.
As I said to this computer.
Or there are other computers as well.
So it's.
So let's bring it out of this.
So there are broken windows and we are created by another computers.
Anyhow, said this to this little one six and the passwords are password.
Now, if I go under pressure, this means you took on business and also seeks an approval.
Ed ends a sort of MSDS and to act on behalf of other, uh, identity.
No one's seen this Benadryl from my mother, she said.
And what we need to do is we need to use Ruby.
Yes, we get the hash of user.
Oh, that is what what user?
This one.
British are.
And the password is password two and we get this article.
So these steps are similar to the previous consent variation so far with this one.
And.
Yes.
As for you.
So we are asking the ticket for our service on behalf of Edmond Shepard.
Now.
Copy this.
Odyssey for.
And the next one is impersonate the user as administrator.
And there must be, as has been their DCA effort since the 16.9. rokkr and particle.
And you can see pictures of this for me are important.
Now, if I said garish.
And here you can see we got the initiative to get further services, bigger ones.
Now we can go ahead and reach to the convention center.
So this is how you can.
I do abuse this resource vessel control and allegation.
If you want if you think, uh, uh, creating any computers can erase the thread so you can just, uh.
Do the name Paul Singer, constrain them.
So whenever this function will go a second time, you will get there that they'll get to really exist.
So that's that's where you can create only one computer.
But the seed will be assigned to the first computer.