So for this video and the next video we're going to talk about physical components of Active Directory
and then we're going to talk about the logical components of Active Directory.
So I'm only going to introduce concepts and ideas that pertain to this course on the logical side.
I am going to introduce some concepts and ideas that are out of scope for the course I think are still
important but for the physical side I'm going to limit to what's in scope as to not confuse you or make
things any more complicated because Active Directory can run really deep really fast.
So we're going to give a high level overview and then it'll make a lot more sense once we start building
things out.
So let's talk about two very important physical Active Directory components.
So the very very most important Active Directory component is what is called a domain controller.
So if you've never heard of a domain controller that is the head honcho of all the servers right.
When you set up Active Directory you have what is called a domain controller.
Now the domain controller has a lot of features that it provides and does for the environment it hosts
what is called the Active Directory Domain Services the directory store meaning it hosts your phone
Remember we talked about it being a phone book.
It has all the information on the users the computers of what printers are in the network etc. It knows
everything on top of this.
It's providing authentication and authorization.
So going back to the last video and we talked about cobras it's doing that at the Domain Controller
level and if we're in what's called a forest or in a domain where we have a parent child situation which
we're going to talk about in the logical side of things it does replication.
So that way the other forest or other domains we make an update to one item in one domain controller
it updates across the board.
Now we'll talk about that here in just a second but also we have administrative access with the domain
controller.
So that is to manage user accounts and network resources as you're going to see when we built our domain
controller.
What we do is we go in there and this is where we can add users.
This is where we can add our computers where we can add policies where we can do all different sorts
of things.
We do it at the Domain Controller level.
So when we talk about domain controller again it's the head honcho it's the top dog.
When we attack an internal network it's very very bad.
If we can compromise your domain controller because that means we can compromise the whole network potentially.
So depending on how big the network is if it's just one domain and we compromise the Domain Controller
we've compromised everything.
OK.
So this is one of the top targets when you're doing an internal assessment though it's not the only
target.
And I should note do not get your eyes set on just doing domain controller compromise in that being
it.
When it comes to Active Directory pen testing or internal pen testing there's other information that
clients might want as well.
Think about potentially PCI or personally identifiable information especially if it's related to social
security numbers or sensitive information about people.
Think about any kind of credit card information that might be obtained.
Think about any kind of proprietary information that you might be able to obtain as well.
So don't just go for domain admin or compromising the Domain Controller.
Think beyond that.
Think what could you do as an attacker.
That would be really damaging to a client.
Now from here let's also talk about Active Directory data stores.
So the big takeaway from the Active Directory data store is that it holds this file called the N T DSA
dot Det D I.T. OK and this file is very very sensitive.
Now typically when you compromise a domain controller you want to grab this file.
Why do we want to grab this file.
Well it contains everything that is stored in Active Directory data.
That means all the users the objects the groups etc..
More importantly it contains password hashes for all users in that domain.
So when you compromised that domain controller and then you go get the A.D. S debt file.
Guess what.
You've got all the password hashes.
Doesn't mean you have all the passwords but you have the hashes.
You can take them off line try to crack them.
You can attempt past the hash attacks.
You can tempt Golden Ticket attacks with a hash.
And I know you might not know what all these are right now.
But we're going to see why compromising this end TADS file will lead to amazing things as an attacker
for us.
We'll get into the attacking side of things.
So that's all I want you to take away from this.
I want you to take away these two components a domain controller and the data store because the domain
controller is one of our primary targets is an attacker.
That is the the big cheese right.
We want to attack it.
We want to compromise it because that's where all the data is stored.
That's what's doing our authentication.
That is where everything about anything is there.
And we're going to live inside the domain controller for a while when we're doing our lab build.
We set everything up we set up our policies you're going to get a good feel for what exactly you can
do on a domain controller and then know the data store the data store has this and TADS file and that
file includes all information from Active Directory data including password hashes.
Big big big thing to remember.
So that's it from here we're going to talk quickly about logical items and they're going to move on
to building our lab which is going to be super exciting.