Hey everybody and welcome to the next video.
We're going to be going over finding some new access.
So right now we've got a impersonation token set up on which users.
This is Jay Smith right.
So we want to use this user to enumerate the Active Directory Domain for us to try to figure out where
we can go and what options we have.
So the first thing we're gonna do is use a bloodhound.
So to do this the first you need to do is apt get install bloodhound.
And I've already got it installed.
So in your case it will go ahead and install.
Now once it's installed you're going to do Neil for J console and you're going to plop that bad boy
into the background because you just don't want it to stay running the whole time.
Right.
So now that that's running and it's starting.
Perfect goal.
Once that started we need to actually go to a browser and connect to our local host on 74 74 to be able
to change are the Neil password.
So it's Neil for J is to use name and Neil for j is the password.
So what we need to do will pop out over here and we'll do HDTV TTP vocal host 7 4 7 4
which is going to bring us to our Neil browser and it's going to ask you for your first era username
in your last and your password.
So this right here is the password.
So in my case I've set it up so I've set up a new password here which is what you're going to want to
do.
So what I've done is when you when you first do that you're going to use Neil for Jay as the user in
the Neil for Jay as the password.
And then it's going to prompt you for a new password once you've got that new password set you're going
to go ahead and just close the browser.
You don't need it any longer.
So now we've got that setup.
What we need to do now is download something called Shark pound which is bloodhounds get repo.
They have a compiled version for Windows so you don't have to try to run a power show.
And I've already went ahead and download that but the W get is at the bottom or in the below the video.
So go ahead and copy paste that w get it sharp hound dog.
Which if we take a look right here we can see we already have it downloaded.
Right so the next thing we're going to want to do is upload this and we can do that is let's look at
what what we have in our current directory pricing system.
Thirty two.
Yes.
So we'll get back into users and then we'll do J.
Smith go to their desktop.
Right.
Perfect so here we go.
So we can see see users JS Smith desktop.
Perfect.
We're going to upload sharp Hound Dog XY
perfect and forgotten.
Take a look.
We got it there.
So what we're gonna do is I'm gonna go ahead and execute this and this is gonna dump a few things on
the desktop so you can put this anywhere you want.
I'm putting on the desktop for ease of use but it's just going to generate a zip file for us.
So if we do execute dash F sharp pound Daddy XY
sharp LB Daddy go and run that and if we go ahead and take a look here we see we have a zip file.
So what we're gonna do is we're going to go ahead and grab this.
So we're gonna download this file.
Perfect.
Now we've got that local to our machine.
And then with are we if we if you've setup Neil for J and you set a new password on it what we're gonna
do now is just use bloodhound that's gonna load up a gooey for us to interface with but it's going to
ask us for the user name and password which in this case will be Neil for JS the user name and then
the password is whatever you set.
So Nio for J and then whatever password you set after the fact.
So this will go ahead and load up bloodhound
so this actually will be completely clear.
So let me go ahead and just clear this out clear that this so yours would look.
It's going to look like this.
I do want to clear it up
once that's done.
OK.
So what you're going to see is this.
So this is this is your initial bloodhound.
So we're going to want to do is come up the top right and do upload data and what we're gonna do is
we're gonna provided that zip file.
It'll go ahead and open it up and grab all of the Jason files such as the groups users computers et
cetera that we're going through here.
So you can see it's processing it all and we can see here we've got six users in the domain three computers
fifty two groups zero active logged on sessions and forty one relationships.
So if we go to queries there's a lot of built in queries.
So we want the find the shortest path to domain admin and we're gonna pick this domain domain admins
this group.
And OK so let's take a step back here.
So it looks like we've got domain admin here right you've got domain admin administrator which is the
local admin account but here we have a group.
So it says security org and since it's all the way this is Jay Johnson.
OK.
So it looks like Jay Johnson is part of a group called security or which has which is a member of the
domain admins group.
So it looks like based on this Jay Johnson is going to be our entry point here.
We're going to want to try to aim for this user specifically.
So for now we're going to leave this alone but bloodhound is a very useful tool I suggest taking a little
bit more time and investigating this tool and seeing how it works.
Looking up tutorials it's a very very useful tool and it's very powerful but for what we need we just
wanted to know what user we needed to its target.
So in this case it's Jay Johnson so go ahead and clear this up and now that we've gotten are and we've
gotten our next point we're going to take this a step further and move laterally in the next video.