OK, so in the last lecture, we set up the remaining piece of our domain controller, the BPP server.
So we've got our scope defined.
We've got our DNS records in place and we have a domain controller.
But now we need users.
Right.
You can't really do much with domain if you don't have users.
So we're just going to create two for this environment.
There are tools you can use to just really pimp out your environment.
For example, there's a tool called bad bloodiness.
If you search for it on GitHub, it will create an intentionally vulnerable environment with random
data to get random computer objects, random usernames, a bunch of randomisation.
But I want more control.
That's why I'm not doing it that way.
But I think it's good if you actually configure yourself because then you get to learn first hand,
right?
So I'm all about the learning.
So what we can do is we'll just go in here and we'll just go to users and computers.
Right here, active directory users in computers.
We're just going to create two users to start.
So I'm going to go ahead and expand my domain.
I'm going to go to Geyser's.
And you can see we don't really have many we just have guessed right, and we should have an administrator.
We do.
So I'm just going to right.
Click in here and I'm going to go to new user.
Let's create our yuzu that this is what I use for my labs and all my training, it's made his name up,
Randy Moralez and he can use the name are more rallies.
All right.
Looks good.
And we'll create a basic password for him
and check user must change password next.
And then we're just going to click next and create our.
Very cool.
Let's create one more user.
And this will be Jacqueline B. Pollard again, if you're wondering where did I get these names from,
literally all I did was I just went to Google and I typed, like, random name generator.
Right.
That's all I did.
And I just use one of those names.
So don't overthink this process.
So her user login name will be Jay Pollard.
Looks good.
We'll click next.
Put in her password
and uncheck user must change your password at next log on click.
Next finish.
Very cool.
And I'm going to make this a little bit more believable by going to properties.
And the description CEO and founder office.
Let's say we'll say E
14.
That's just a random office.
Maybe they're on the 14th floor of a building telephone number to one, two by five.
Five zero zero one email.
Now, this is a real email address I'm going to put in here and we'll talk about this in an upcoming
lecture.
But you're going to want to purchase a domain.
I use GoDaddy and then you're going to want to get email set up for that.
I know it's an additional cost, but this is how you really learn about hacking, right?
Because once you have a valid email address, like a real email address that you can send email to,
that's not Gmail or something like that, then you can start playing with initial access.
Right, spearfishing your fictitious users, maybe, you know, coaxing your fictitious user into landing
on a malicious website, drive by download.
Right.
Or maybe you can explain it to attack a vulnerability and unpatched browser.
But you can't really do that if you don't have an email account, you can't get the whole show off and
make it realistic.
So I'm a big fan of purchasing a legit email address and purchasing a legit domain and then using that
for testing.
So that's what I'm going to do.
I'm going to put in his email address
and the webpage Carbon Buy.com.
Hey, that looks good.
Click OK here.
And we'll do something similar for Jacklin.
She is the CFO.
Her office is one floor up, a phone number.
There we go with her email address.
It's Jack Quinn, that Pollard at Carbon Bank Dotcom.
Now, at the time, I think it was like five dollars.
An email address is what I paid GoDaddy.
That may change.
You can sometimes find coupons online, but it's not very it's not very expensive.
And think my domain was like nine dollars.
Right, for the year.
Carbon Buy.com right there looks pretty good.
To both these accounts look pretty good and a believe for good here.
So now that we have our accounts, what we need to do is join our pieces to the demands of the next
lecture.
That's what we'll do.
I'll see you guys in the next lecture when we start to joint our machines to the domain.
Zenovich by.