Hey everybody.
Welcome to next video.
So we're at the we're at the final stretch.
Give me the last feel so we're going to be working getting domain at this point.
So we've compromised two machines now.
We've gotten user Curt we've gotten access as the user John Smith or Smith and what we're going to do
now past this point is we're going to go ahead and dump passwords from memory.
So we're going to try to see if we can get anything from this machine because right now we haven't had
any luck actually usernames and passwords which might be very useful.
We do have the admin accounts but if they change those then the domain users we can't get access to
them or if they log out of the machine we can no longer gain access as that user.
So let's try to grab us a little bit more persistence here.
So the first thing we want to do is we'll check what directly we're and we'll see here where it looks
like we're in that.
So we'll see users
let's see here where's a good one so we're system right now.
So we'll do we'll do administrator
administrator and we'll probably dump it on the desktop desktop.
Right.
So first of windows when upload many cats which is under user share maybe cats X 64 and maybe cats Daddy
XY
perfect gonna and dump into a shell so and you and I are we can see we do have many cats.
Perfect.
So we'll do.
Go ahead and launch it
we should blame this on its own prompt.
Perfect.
Now we're gonna set our privilege level
to debug looks good.
I'm going to go ahead and dump the passwords all misspelled that S E K you are L as a log on passwords
for
so let's go to the top here
let's see where we got oh OK looks like the user I.T. support on the domain.
Red team nation with the log and server are tenacious DC 1 which is our domain controller and most likely
the one the dot one hundred we can see the password is password 1.
Awesome.
So with this we don't have to try to impersonate another user we can log in directly as them if we wanted
to with SMB against any machine on the domain which is really nice.
However we don't need the password at this point.
I don't think to actually go ahead and get ourselves domain admin but it's nice to have that little
extra bit there.
So what we need to do is we're going to go ahead and load ourselves up as the I.T. support user because
that seems pretty interesting.
It's it's it's a very useful named account which kind of tells me that it's possible that based on what
we saw in bloodhound Jay Johnson is has a potential path to a domain admin.
However if this I.T. support character can reset the password of that user let's say foo delegation
on over the 80 some 80 tree.
If this user happens to be underneath that we'll be able to reset the password and if we can reset the
password that domain user we now can then log into the domain controller as domain admin so what we're
gonna do is we're gonna impersonate the users so what do load incognito
will do list tokens
to and court we see sports or impersonate token go ahead and grab this guy.
Paste and we'll add our extra slash in
perfect so if we do Shell why am I.
Perfectly I.T. support.
So now let's do a quick check so we can actually we don't need an alt at browser to reset a domain admins
credentials.
If we have the ability to reset it.
So let's go ahead and give it a try.
So if we do not user Jay Johnson slash domain to notify that it's a domain user
domain I can spell correctly and then whatever password we want we'll do we'll do password 1.
Right.
Just to make things a little bit consistent for us.
Easy to remember.
So go ahead and set that and if that allows us to be set that means the delegation on this user to be
able to reset passwords happens to have this user as its delegate as well even though it probably shouldn't
because it's a domain admin poof.
Look at that request we process it the domain controller for ventilation not local.
Awesome.
So we've now changed the password for Jay Johnson So what we can do is we'll kick this bad boy into
the background and we'll use P.S. exact.
So if we do already have it.
So show options.
Show Options.
So we'll do set our hosts to 1 9 2 1 6 8 1 Top 100.
So this is the domain controller only or set SMB user to Jay Johnson and we'll set SMB pass 2.
Password 1.
Just what we set it to so go ahead and run that
awesome.
So we've gone ahead and logged in as Jay Johnson but let's check the EU.
OK.
So it went ahead and noticed that interpreter shall notice that Jay Johnson was an admin on that machine
so it automatically bumped us up to route.
So if we do see this info we can now see we are on our tenacious DC one as anti system authority.
Which then means we can take this domain controller we can already be to it if we really wanted to.
We have full control over the organization's domain.
So every Windows machine on the domain every server on the domain we now have full access to everything
on this domain.
For this organization which is a very very great place for a red team to be but a very bad place for
a red team to be from an organization standpoint because that means something's messed up.
And this is just kind of been a short module to kind of show you guys what the process would look like
when you're attacking a full domain from no access at all to eventually gaining a full domain Edmond
rights which is what we have here and we could take this step further and pull down all the password
hashes for every mission for every user on the system so that's kind of how you would go ahead and go
about it.
Now this is again a simulated environment.
However it's stuff like this does happen in the real world so it's it's something you always have to
look for.
Getting used to working with an attacking Windows Active Directory infrastructure is a very important
concept and it's good to kind of show you guys a full path from start to finish on how you're going
to go about this.
So I hope you guys had a great time doing this module it's a little bit less of a hands on more of a
watching how something is done so hopefully you took a lot of notes learned a few new tips and tricks
throughout the module take a few minutes and if you understand if you didn't have it if you had a problem
understanding any concept that was done here go ahead and do some additional research or throw yourself
over the Facebook group and throw a few questions at us we'll be more than happy to help.