Awesome.
I hope you really enjoyed our demos. As you can see,
it was fairly easy to get tons of information from the AD and even easier to
get access to a service account with an insecure password.
Now,
if you want to know more about this too, I do recommend you check in the
official documentation on the GitHub of this project. In there he said that it
too has tons of other features and really cool reports.
And if you don't want to type those links manually, you can simply go
to the course files and check the links in there.
Also,
if you want to get really technical in Active Directory
Reconnaissance, the same author of this tool gave a really
interesting talk about the topic on a OWASP Conference.
This presentation is almost two hours long,
but has tons of really interesting technical details about Active
Directory and how to extract information from it.
Also, as we saw in the last demo, I used a password cracking to called Hashcat.
If you want to know more about this tool, you can check this link. Or if
you don't want to use the Hashcat to crack passwords,
you can also use the John the Ripper, which does a similar job.
And if you were wondering how to prevent your company from this kind of attack,
the main recommendation is to implement rules in your detection
solutions to monitor high traffic of AD requests.
For example,
if you see one user requesting tons of information from the
Active Directory in a short period of time,
then it may be something suspicious.
Also very important, to prevent people from cracking the passwords of
your service accounts, you should use really strong passwords. I do
recommend at least 30 random characters, so then attackers will not
be able to crack the password that easily. So that's it, that's the
end of the course.
I hope that today you learned about the importance of
getting information from the Active Directory,
and I hope you have one more tool in your belt to help in Red Team engagements.
So thank you for watching and I'll see you soon.