WEBVTT

00:00:01.840 --> 00:00:03.250
Welcome to our lab environment.

00:00:03.670 --> 00:00:04.300
As I mentioned,

00:00:04.310 --> 00:00:07.640
I'm running the attacks from the Windows machine that are previous compromised.

00:00:07.640 --> 00:00:11.550
To check if the machine is part of the domain, let's open the terminal.

00:00:13.140 --> 00:00:16.550
Perfect, in here, as you can see, I can ping the domain controller.

00:00:17.890 --> 00:00:20.320
Also, if I used the comment whoami,

00:00:20.600 --> 00:00:23.150
I consider my user is part of the Globomantics domain.

00:00:23.840 --> 00:00:26.090
And just to check more information about this user,

00:00:26.140 --> 00:00:31.310
I can use the comment net user /domain and my username.

00:00:31.310 --> 00:00:32.600
When I press Enter,

00:00:32.720 --> 00:00:35.200
my Windows machine will create the domain for all

00:00:35.200 --> 00:00:36.450
the information about this user.

00:00:36.990 --> 00:00:37.610
As you can see,

00:00:37.710 --> 00:00:40.850
I have here the full name and also the groups that they belong to.

00:00:41.670 --> 00:00:44.280
It is important to note that I'm not administrating domain.

00:00:44.440 --> 00:00:45.670
I'm just a regular user.

00:00:46.340 --> 00:00:46.750
Also,

00:00:46.840 --> 00:00:49.100
remember that I mentioned that we could mentally query the

00:00:49.100 --> 00:00:50.650
domain for a lot of interesting information.

00:00:51.140 --> 00:00:52.080
So, take a look.

00:00:52.200 --> 00:00:55.740
For example, if I use the comment net user /domain,

00:00:56.040 --> 00:00:59.200
it will require the domain controller for all the users in the domain.

00:01:00.170 --> 00:01:03.330
And then, if you want to get more information about one specific user,

00:01:03.450 --> 00:01:08.780
I can just type net user /domain and then the username that I want to query.

00:01:08.780 --> 00:01:10.450
When I press Enter,

00:01:10.600 --> 00:01:13.670
this will create a domain for all the information about the specific user.

00:01:13.670 --> 00:01:14.750
And take a look.

00:01:14.930 --> 00:01:17.370
This user here is a Hyper‑V administrator,

00:01:17.460 --> 00:01:18.550
which is pretty interesting,

00:01:19.410 --> 00:01:21.830
but acquiring the domain memory may take a lot of time,

00:01:22.080 --> 00:01:25.160
so we need an automated solution, and for this reason,

00:01:25.170 --> 00:01:26.850
we have the ADRecon.

00:01:27.740 --> 00:01:30.850
So, let's start by visiting the ADRecon GitHub page.

00:01:32.640 --> 00:01:35.080
In here, we can find tons of information about the two,

00:01:35.280 --> 00:01:38.480
including a really detailed step by step on how to use the ADRecon,

00:01:38.480 --> 00:01:40.350
as well as some other cool features.

00:01:41.100 --> 00:01:43.980
One thing to note is that if you want a beautiful Excel report,

00:01:44.100 --> 00:01:47.550
you need to have Microsoft Excel installed in the machine that you're using.

00:01:48.140 --> 00:01:49.580
If you don't have, it is also fine.

00:01:49.790 --> 00:01:52.550
The only difference is that all the data will be saved in CSV.

00:01:53.740 --> 00:01:54.510
Perfect, now,

00:01:54.620 --> 00:01:59.350
let's download the two by clicking this button and then clicking Download ZIP.

00:02:01.140 --> 00:02:03.850
Perfect, now let me quickly extract this to my desktop.

00:02:05.540 --> 00:02:06.000
Awesome!

00:02:06.030 --> 00:02:07.870
As you can see, all the files are here.

00:02:07.880 --> 00:02:09.070
We can now use the tool.

00:02:09.539 --> 00:02:11.800
So, let's open the Windows terminal,

00:02:11.800 --> 00:02:15.650
and then let's go to the ADRecon folder in my desktop.

00:02:16.910 --> 00:02:19.000
Perfect, as you can see, in this folder,

00:02:19.030 --> 00:02:22.350
I have one ps1 file, which is a PowerShell script.

00:02:23.240 --> 00:02:27.450
So to run it, let's start PowerShell by typing powershell and pressing Enter.

00:02:28.590 --> 00:02:28.920
Cool.

00:02:29.020 --> 00:02:30.470
To use this tool, it's pretty simple.

00:02:30.480 --> 00:02:37.610
All I have to do is execute the script by typing .\ and then ADRecon.ps1.

00:02:38.310 --> 00:02:42.160
When I press Enter, the two will do a bunch of queries against the domain.

00:02:42.160 --> 00:02:43.930
And after all the information is gathered,

00:02:43.930 --> 00:02:46.950
you put together a really nice Excel report for us,

00:02:47.440 --> 00:02:49.050
and you can see that happening in the background.

00:02:50.380 --> 00:02:53.450
This process may take a few minutes, depending the size of your company,

00:02:53.840 --> 00:02:57.350
but to not waste your time, I'm speeding up this video so we don't have to wait.

00:02:59.340 --> 00:02:59.820
Awesome.

00:02:59.940 --> 00:03:02.890
The script now is completed and says that the data was saving

00:03:02.890 --> 00:03:05.450
to this Excel file on the ADRecon folder.

00:03:06.000 --> 00:03:08.460
You can even see that a new folder was created in here.

00:03:08.460 --> 00:03:12.020
And the interesting part is that I have an antivirus installed on this machine,

00:03:12.060 --> 00:03:13.350
and nothing was detected.

00:03:14.370 --> 00:03:15.780
So, let's check the report.

00:03:16.000 --> 00:03:17.990
Let me open the ADRecon folder.

00:03:17.990 --> 00:03:20.950
And here, you note that a new folder was created.

00:03:21.610 --> 00:03:25.550
Inside of this folder, there's one Excel report and a CSV folder.

00:03:26.310 --> 00:03:30.950
All the raw data is in the CSV folder, but for now, let's open the Excel report.

00:03:33.210 --> 00:03:33.610
Awesome.

00:03:33.610 --> 00:03:34.070
Take a look.

00:03:34.250 --> 00:03:37.350
The report has a lot of tabs, and it's fairly well organized.

00:03:38.110 --> 00:03:39.840
For example, from this main menu,

00:03:39.940 --> 00:03:42.100
I can check the list of all the computers in the domain

00:03:42.200 --> 00:03:43.850
by clicking the option Computers.

00:03:45.200 --> 00:03:47.590
In here, you can see all the computers in the domain.

00:03:47.590 --> 00:03:51.080
And for some of them, we can even see the operational system they are using,

00:03:51.080 --> 00:03:53.130
and this can be pretty interesting.

00:03:53.480 --> 00:03:55.800
For example, if you see a Windows XP machine,

00:03:55.940 --> 00:03:57.650
you know that is a easy target to exploit.

00:03:58.640 --> 00:04:02.850
Also, as you may have noted how the data is dividing tabs in the spreadsheet.

00:04:03.410 --> 00:04:05.850
So let's take a look on the tab Users.

00:04:07.630 --> 00:04:09.750
In here, I can see all the users in the domain,

00:04:10.110 --> 00:04:13.560
and I can also see if the account is disabled and some other information.

00:04:14.600 --> 00:04:17.269
Also, let's check the password policy for the domain.

00:04:17.269 --> 00:04:20.450
For that, let's go to the Default Password Policy tab.

00:04:22.600 --> 00:04:23.070
Take a look.

00:04:23.070 --> 00:04:26.550
In here, I can see that the password has a minimum of nine characters,

00:04:27.140 --> 00:04:29.650
and also, the Account lookout threshold is 0,

00:04:29.890 --> 00:04:31.850
which means there is no account lockout,

00:04:32.240 --> 00:04:34.450
meaning that we can try as many passwords as we want,

00:04:34.450 --> 00:04:36.350
and the account will not be locked out.

00:04:37.140 --> 00:04:39.600
So if you get the list of all the users in the domain from

00:04:39.600 --> 00:04:43.010
the Users tab and if you build a password list based on

00:04:43.010 --> 00:04:44.370
this nine character requirement,

00:04:44.630 --> 00:04:48.350
we can run a password brute force attack or even a passwords pre‑attack.

00:04:49.040 --> 00:04:49.810
Pretty cool, right?

00:04:50.340 --> 00:04:52.990
Now, let's go to the Group Members tab.

00:04:52.990 --> 00:04:56.350
In here, we can see all the groups and its members.

00:04:57.010 --> 00:05:00.250
So, let's say you want to find out which users are administrators.

00:05:00.940 --> 00:05:04.860
I'll use this Excel filter to select all the groups that are admin groups,

00:05:04.860 --> 00:05:09.350
for example, the Domain Admins group and the Hyper‑V Admin group.

00:05:10.820 --> 00:05:11.820
When I apply the filter,

00:05:11.940 --> 00:05:14.810
I will see only the accounts that belongs to those admin groups.

00:05:15.440 --> 00:05:17.640
For example, we just found out that this user,

00:05:17.640 --> 00:05:19.600
Michael Doug, is a domain administrator,

00:05:20.040 --> 00:05:21.690
and this can be really interesting.

00:05:22.410 --> 00:05:24.700
Since we know that he has access to everything in the domain,

00:05:24.770 --> 00:05:26.260
he could be our next target.

00:05:26.260 --> 00:05:29.780
We can try to exploit his computer or simply try to get his password

00:05:29.860 --> 00:05:32.310
using some other attacks such as phishing attacks.

00:05:33.440 --> 00:05:38.050
And remember, all this information is also in the CSV files in the CSV folder.

00:05:39.140 --> 00:05:41.260
Those files have all the raw information,

00:05:41.400 --> 00:05:43.410
and you can import this data into other tools,

00:05:43.710 --> 00:05:44.760
but personally,

00:05:44.940 --> 00:05:48.340
I like to use the Excel spreadsheet since it's way easier to visualize

00:05:48.370 --> 00:05:50.150
and search for the data that we are looking for.