Everybody in this video we're going to be talking about Active Directory.
Now what is active directory.
Active Directory is a directory service created by Microsoft.
Now this is a directory service that allows you to manage a domain in a Windows environment.
Now you can think of a domain as a forest where each tree is either a computer or user.
Now this domain service or directory service will manage all of these to keep everything either patched
up in sync it will handle the authentication and authorization for every account and computer it's a
centralized management service as well.
So pretty much anything you want to do whether it's restricting access or allowing only certain applications
or setting password time outs and loading people's profiles for their user across any machine in the
domain.
So if the user logs in and one office they can log in in a different office in a different time zone
entirely on a completely separate machine and still have all of their stuff moved over.
So Active Directory is very powerful and it's a very important as a red team are to understand what
it is and how it works which is why this whole module is dedicated to building it out and understanding
what the features are enabling things disabling Things To Know Better yet how to attack it.
Now whereas this used this is used in a lot of enterprise environments most enterprise environment will
have a Windows domain of some kind whether that's to compensate for not every employee wanting a Mac
book as an example.
So I'm talking from the Silicon Valley standpoint a lot of people out here will offer Macs as a as a
default MacBook Pro.
However there are some organizations where they only use Windows or an employee gets a choice.
Now if an employee wants to use windows they have to have a domain in place or an active directory domain
in place to be able to manage that centrally.
And that's you're going to find in most organizations you will have some sort of Windows domain in place.
Again this is commonly used for workstations and then as Windows servers.
So there's a lot of software that only works on Windows.
And if an organization needs it they have to run a Windows server which means they need a domain.
They don't always have a domain but it's good for patch management and things like that.
Now what does this mean to an attacker gaining domain a domain admin or domain administrator.
Think of that as the administrator account on a regular Windows machine.
However a domain administrator has admin access on every machine and every server that it manages.
Which is why it's very important gaining access to admin on one machine does not necessarily mean you'll
have admin access on the next one because they in most cases they're going to have the admin password
different on each machine.
Now keep in mind it is possible and I've seen it where people use the same admin password across all
the machines so gaining access to one theoretically gave you access to all of them but in most cases
you're not going to see that.
But a domain administrator would have access to every machine because they have to now there are countless
ways to attack a domain such as through bloodhounds such as through a service account like I said a
service account having too much access.
A In a local admin account that has a shared credentials.
So there's a lot of different variations that you can do and we'll have a whole module on a few different
ways to attack a domain so I'm going to set up a whole Ada environment and we're gonna go through a
full attack scenario in its own module.
There is one thing I wanted to go over with you guys.
So if a virtual box.
Now what we've done so far is we we've built the victims the to the M's here and we haven't.
And we've made some modifications.
However going forward we're gonna be doing things that could if done incorrectly causing the system
to do weird stuff and sometimes you don't want to have to reset or reinstall the operating system just
to be able to revert your changes.
Some changes are irreversible when you're when you're installing the 80s service example there's a few
things that you can't back out.
Once it's considered domain controller which will roll over later.
So what I want you all to do is to get used to taking snapshots so at the top right we see snapshots
we see our current state.
You can take a snapshot when it's on.
However it's going to take significantly longer so I suggest just powering it off and then just issue
your snapshot by saying take that we're gonna call this before we install our next video we're going
in we're going to be running through the next few videos we're gonna be doing the install.
So I want to get a clean slate so in case anything happens I can pull back to this and then redo it.
So go ahead.
OK now you can see it's current the current state here is before 80 install.
Now when I go and make some changes I can come back here.
Click on this and hit restore and it'll bring me back to the current state of before eighty install.
I just wanted you all to be aware of that.
Go ahead and do that now before we make any massive changes like we're about to do in this in this course.