-: Welcome back.
Let's perform the last two steps of our challenge.
So we successfully compromised the active directory
by getting access to the SVC admin account and
towards the end of the last lecture we also saw
that we can access the backup share
and we got credentials out of that share
since they were stored in a file that we had an access to.
Once we decoded the file content
we got the password for that account, which is right here.
Now let's see how we can use that to our advantage.
And let's move on to the next step
which is domain privilege escalation
elevating privileges within the domain.
Okay, let's read what it says.
Now that we have new user account credentials
we may have more privileges on the system than before.
Since if you remember
as we see admin couldn't really access anything else
but the backup share.
But now we got the backup account as well.
So the username of the account backup gets us thinking
what is this backup account to?
Well, it is the backup account for the domain controller.
This account has a unique permission that allows
all active directory changes to be synced
with this user account.
This includes password hashes.
Knowing this, we can use another tool
within impacket called Secrets dump.py.
This will allow us to retrieve all
of the password hashes that this user account has to offer.
And exploiting this, we will effectively have full control
over the active directory domain.
Okay, awesome.
So we know which tool to use.
We got provided that tool in the impacket that we downloaded
at the beginning of this challenge.
So the file that we want to access is secretsdump.py.
Let's clear this.
And my impacket is
in the opt directory and
I should have secretsdump.py.
And by the way, if you wonder how any of these files works
you can just nano it to read the code.
We already covered Python.
Now this may be a little bit more advanced compared
to what we coded since it does include classes,
methods and all of that.
But nonetheless, this is Python
and you should be familiar with most of the code right here.
Okay.
Now that we know which tool to use,
let's use it with sudos,
since it probably does require sudo and
let's see if it does provide anything to us
once we specified dash H.
So we do get the help manual right here
and dash dc dash IP is what we want.
It is the IP address of the domain controller.
We want to specify it as with the previous commands
the option or the IP address of our target to connect to.
So let's specify it.
First,
paste the IP address,
and after that,
all we need to do is
provide the backup account credentials on the domain.
So it's spookysec dot local slash backup
so it's no longer SVC admin.
Now we want to access backup
and the password is 'backup' and it's written right here.
We can just
copy it. So or since I already type backup
2 5 1 7
8 6 0.
So 2 5 1 7
8 6 0.
Alright, so we specified the secret stamp
which is the tool that we got provided with to use.
We specified the IP address of our domain
and then we specified the full path or full domain
with the account and its password that we want to use.
Let's press enter.
Okay, so we do get some error.
Let's see, why do we get the error?
Remote operations failed connection
error name or service not known.
Okay, so we might need to
also provide
the IP address
at the end.
Let's try it like this.
So once again, we did provide it right here
but until it's also provided in the domain.
So we use the backup account at this IP address
which is once again the target's IP.
And if I press enter,
okay, now it works.
Here we get the hash
to all of the accounts on this active directory.
And specifically we would most likely be interested
in the administrator hash right here.
Since with this hash
we can actually use a different tool that we got told to use
at the beginning of the challenge, which we will see
in just a second to access the administrator account
with just this hash.
Now this entire line is not the entire hash.
What we are mostly interested
in or what the NTLM hash will be is just
this third part right here, which starts with zero E.
So we can just copy it zero E
and then we can use a different tool to
access the administrator account using this hash.
So the tool that we want to use, let me just clear this
is evil dash
winrm.
This tool will allow us to gain access
to this active directory
by just providing the username and the hash value.
So if I type it
I'll most likely need to use it with sudo.
And then here I have the command auto complete it
from before.
But all I want to do is change the IP address
because it's not the same.
So this is the command sudo evil dash winrm dash I.
I will be for the IP address of the target. Here
we specify the IP then -u, which sends for username
you want to specify the username and then dash
capital H where you will specify the actual hash value
for that account, which we got
by using the secrets dump tool.
Okay, let's press enter.
It might take a few seconds to work
and hopefully if it works, we will get access
to the administrator account on the domain.
Here it is.
If I type, who am I?
I am the THM-AD, which remember it's the net
bios domain that we specified in the first or
in the second enumeration of this machine.
And then slash administrator, which is our account.
And we are in the administrator directory.
So we successfully escalated our privileges by
getting this hash
providing it to the evil winrm, which allowed us
to actually get access to the administrator account.
And now let's see why that is possible.
Or in other words, let's answer these questions right here.
So what method allowed us to dump
NTDS.DIT?
And for anyone who's wondering what that is
let me just show you.
I exited the session with the administrator
once we ran the secrets dump with the backup account.
Remember we got all the hashes, but we get answer
to this question somewhere towards the beginning.
So here it is, using the
D R S U
API method
we got NTDS.DIT secrets.
So we can specify the method DRSUAPI.
And what is the administrator NTLM hash?
NTM hash said it's the third part.
So just copy paste it right here.
Should be correct.
What method of attack could allow us to authenticate
as the user without password, which we saw one minute ago
once we used the EVILWINRM is the pass the hash attack.
So with the pass the hash attack
or with the attack that we used right
before going to answer these questions
we successfully got access to the administrator account
without even knowing their password.
We only had their hash, We provided a hash
and we logged in to the account with just the hash.
Using a tool called evil WINRM
which we just did.
What option will allow us to use a hash?
And here it's dash H
and I believe that's also what we use the dash capital H
which allowed us to pass the hash
for the administrator account
and get access to it like that.
So let's do it once again
and let's move on to the flag submission.
So flag submission is simply just finding the flag
for these three accounts on the domain.
So as we are already logged in, like administrator account
we can type there to see
if there's anything in this directory.
If I go back, type there here,
and if I remember correctly
the flag will be on the desktop.
So let's go to the desktop directory.
Here it is root.txt.
We can use the type command to type it out, root.txt.
And here's the flag for the administrator account
which we can provide right here.
Now you can log in as different accounts to get access
to backup and SVC admin, but it is not needed.
Remember we are admin, we can access these accounts as well.
So all we need to do
Oops
Go back to the user's directory.
So we go, went all the way back to the user's directory.
And here the users, we have the SVC admin
which is required right here.
So let's get the svc-admin
flag.
Let's say that it might also be on desktop.
And yes, if it even says right here, they can be located
on each user's desktop.
So there will tell us the name and if we type user.txt.
Oh it's user.txt.txt.
Here is the
value or the
flag.
Let's copy it.
Paste it under the svc-admin
and we can submit it. Should be correct.
And here is one more step for the backup account.
We just do the same thing.
Let's see if there's backup right here should be.
There's the backup account.
Let's go to the desktop there.
Type
PrivEsc.txt.
And here is the flag
for the backup account.
We paste it right here and it should also be correct.
So we successfully completed the entire challenge
of hacking or compromising the active directory
and also performing privilege escalation
on it to gain access to the administrator account.
And
for the end
we provided these three flags, which are needed.
Okay, awesome.
Now in case you didn't understand some
of the stuff that we covered here,
it's really important what I mentioned at the beginning
of the challenge to learn about active directory,
learn about how it works
so you can fully understand this challenge.
Now, this is not really a beginner challenge
but it's also not too advanced.
It's somewhere in the medium
and I believe that's how it's ranked as well.
I know somewhere here, yeah
here it is, the difficulties medium.
So it's not too hard, but it's also not
for the beginners because it does require knowledge
of using these different tools that we covered.
And also knowledge
of how active directory works and what type
of the attacks we can perform on the active directory.
So play with this a little bit more.
You can redo this on your own
if you think that will boost your skills
but you can also cover other machines on
Tri Hack Me platform.
There are also free ones, there are paid ones
and you can cover different machines
and practice your skills
whether that being attacking a different active directory
or whether that being performing any other type
of the attack that we covered throughout the course.
Nonetheless, thank you for watching
and I will see you in the next lecture.