Certainly we will be doing this on our books from the works and they Beatrice's you one 9693.
So these changes I got into the subscription.
Let's see that in maps, candidates.
How many words can you say is on time?
And you can see the DNS server and the web server.
And you see that Kerberos and the actor traded up.
So you can assume that this isn't actually a disaster and the domain name is egotistical bank and if
you see the website you don't get much information and here there are some blog posts and here you can
see the usernames.
These are also not much where you are.
These become users and in their voters bit you will have these user names.
Now you can see these usernames can be made into the word list.
So I have already made this for this.
I have just started this first fashion.
Fashion.
I dropped the first name and followed by this second name.
So you can see are the combinations.
Now we can use a tool called two of.
I don't get.
I need this Kerberos to check whether this user like this or not.
So we will get different response whether these are if the user exists.
Gertrude.
And if you run this and you can see the option is user enum and we need to specify the domain.
And we say further DC that is the domain controller and then.
We need to space for users.
And you can see we got only two rider names.
You have Smith and Head Smith.
Now we can use impact.
And B users
who check any
Kerberos pre-order indication, not record users.
So they have this don't appropriate setting the user control user can control.
So I think it's a signal that Bishop.
Think we need a space where something like users file out.
We can just simply request.
There are only two users.
We can say Smith.
So we don't have password.
Just pretend to.
And we got that paid for.
So this dude is and group with this.
You have to go and password.
There is no.
We can get the TDD for this because there is no don't don't record period not for this user.
So we can crack this using that John the report so it's simply John Morris and the hash of cracking
we will get the password in.
And here you can see the password is the strokes.
So we can log in using random.
User name is Smith and the password is 133.
And now I have run this power up.
You did not give any users.
So what I'm going to do is.
I'm going to.
Pull some script that is in to pass pretty.
It takes, uh, rum.
It takes some basic takes.
They are profitable.
And this is the binary we are using auto, you know.
So it will check for the future.
So we.
We took instead of profitable commercial end user users description field and then business and and
then navigation accounts.
So I have ordered dinner this one here the ordering and you can basically run the bread down on this
one and get the information.
So down there to give you the information that a particular user has this, uh, discussing capability.
So that means they use that user can request that they see any letters changes to the Gerber catalog
and obviously we can get the hashes of are the users.
And you can see user data and you can submit their score and host this.
I mean, you draw down all this data in order to exceed.
Partial.
Education policy by pass and using the Medicare.
And output file we can place in the current progression.
And we should see the get requests from that machine.
In order to run this.
And here you can see the congressional users, the hit submit account has DSP and said there's a response
minimum sonar slash it's not domain and instead of profitable users we have it.
So that's how we got into this, our initial foothold and the DCC capabilities.
So these are well pretty common domain administrators, enterprise administrators, etc..
And don't you have this SBC loan manager?
So this guy also had this replication getting this out.
So we need to get to this account so that we can dump the yourself out of the users.
And here you can also see the description for this and nothing juicy.
So I have written a piece for any local excavation and I have found the catalog on credentials.
So you can run one piece.
It's going to take some time and you'll get these credentials.
This one is the password file, as we see managed to.
So since we had the password and this user has the application genius, we can go ahead and use secrets.
Don't.
I actually forgot this usage.
The syntax.
So anyway, let's just figure this out.
Describe.
I think we can use this index as we see lawn jihad, colon password.
At the IP address.
So this syntax is pretty common for the impact of TOS.
And we can see we've got the cash.
So we can copy these and build a mesh and try to log in.
As administrator.
I think it's.
The computer is still using this and PLM version one we can be successfully wrapping.
And we can see we got that mutual practice.
Now we can go and pitch that room.
That's after this video, this Sunday box.
First we how the user names from the website and we how we use the computer to brute force the average
user names.
And from those user names we have found this Yosemite user having this ID set and then we got the hash
because of the weak password.
We Texas when we crack the password and log bin and after some enumeration, we came to know that SBC
Road Manager has this application user and we have escalated to that user using the inches followed
by the one piece.
And with that we have done put the hashes of are with this since it's using and DRM version one it does
accept the hash you should have password.
So that's how we logged in.