Let's continue with our reconnaissance phase,
and let's start to explore what exists within the domain.
The first module that I'm going to make use of is looking at the domain policy.
And with this module, I'm looking specifically for password policies,
Kerberos Policies, etc.
So based on the results, I now have information about the MinimumPasswordAge,
the PasswordLength. I can also see that PasswordComplexity is enabled,
along with quite an extensive PasswordHistory.
From a Kerberos perspective,
I can see details about the TicketAge and ServiceAge.
Now let's get some information about the domain controller.
From the results, I can see that the current Forest is globomantics.com.
The domain controller is running Windows Server 2016.
This helps me to understand what type of
vulnerabilities could be used on the target.
And then I also have information about the IP address of the
domain controller. And this specific domain controller runs all of
the roles related to Active Directory.
Now let's take a look at what organizational units are
currently set up within Active Directory.
For this, I'm going to make use of PowerView and the get_ou command.
And again, within the Record Options,
I'm going to leave this to the defaults, and I will execute the module.
So looking through the results,
I can see the standard Active Directory organizational units,
such as domain controllers, but there are also some custom ones.
For example, there's an OU which is titled Servers.
There is also another OU which is titled High Privileged,
that is nested within the server's organizational unit.
This gives me a good indication of the type of OU structure
and whether or not this organization is using a flat structure
or something a bit more complex.
Now let's take a look at what security groups exist within this domain.
And to do that, I'm going to stay within the PowerView module,
but this time making use of the get_group command.
I will leave the options as defaults,
and I will go ahead and execute this module.
Now the results from this command would be pretty extensive.
Essentially it's going to give me all of the groups
that exist within this domain.
I can use the Record Options to falter and tweak the
results to look for something specific.
For example,
I could search for any group that has the word admin or administrators.
But since I'm doing a full‑on discovery,
I want to see all of the groups that exist, as this will give me
some information and insight into what exists.
Now as I scroll through this list,
I'm going to pick out a couple of groups that stand out.
So one of the groups that stand out is this one that is called Helpdesk.
Now we've seen this before in the previous video,
but here I can see that this group is actually one that has been created.
I have some information about when it was changed,
the sid of the group, and I can also see who the members are of this group,
which in this case is Ron.
Another interesting group that stands out is this one
that is called Sensitive Users.
If I look at the members,
I can see that this group is nesting another group
which is titled Super Secret Users.
And right below that, under Super Secret Users,
I see a username by the name of SamiraA.
And as we've seen in the previous video, this user is a Domain Administrator.
Now let's take a look if this domain has any trust
relationships with other domains.
To do that, I'm going to stay within PowerView,
but this time make use of the map_domain_trust command.
I will leave the Record Options as it is and execute the module.
Now that I have the results, there's something really interesting.
This domain, globomantics.com, has a Bidirectional trust with another domain,
globoticket.com.
Now this is great because this means that I could probably pivot across to
globoticket.com and exfiltrate valuable information.