Hey everybody welcome to the last video of the module.
So in this video we're gonna be going over cash credentials.
Now we're going to briefly go over this just so you understand the attack vector that can happen for
read only domain controllers.
Now we've talked about those before where they normally are used in remote versus remote offices so
that they can they don't compromise.
They don't tend to compromise the real domain controller.
Now this is all well and good.
The problem is is a lot of read only domain controllers are setup with cache credentials so that users
that consistently authenticate in that office let's say to that read only domain controller.
Their credentials are cached so that it doesn't have to keep calling back to the main domain controller
in HQ.
That's great for redundancy sake and if some connection was cut between the remote office and the HQ
office the read only domain controller can still authenticate the users and get them working.
Now that's a bad thing for it.
That's a great thing for an attacker's point of view as well.
Now if an attacker was able to gain access to the read only domain controller in most situations they
won't be able to jump over to HQ.
However if they have cache credentials those credentials are still valid credentials on the HQ.
So if one of them happens to be members of domain admin now it's got a full path directly over to the
HQ as domain controller.
Now there's also another way where these the local account being ran on the domain controller the read
only domain controller might be the has it have a shared password with the real domain controller in
HQ.
And if that's the case you can drop the password hash and then move straight over to the Domain Controller.
So it's important to lock down the read only domain George but it's also a good aspect for red team
or to look at especially if you are attacking a remote office location.
This might very well give you a path to domain to domain admin and once you have that you can spread
out quite quickly inside of an organization.
So I just wanted to kind of touch base on that.
Get that in the back of your heads to get familiar with that feel free to look up on read only domain
controllers we're not going to be touching configuration of Active Directory anymore past this point.
We will be having a module on attacking it but not configuration.
So please go ahead and look this up.
This is the end of this particular module in the next block to we're going to be going over curve.