WEBVTT

00:00:01.640 --> 00:00:02.750
In this demonstration,

00:00:03.140 --> 00:00:07.050
we're going to take a look at creating a rogue domain controller with DCShadow,

00:00:07.440 --> 00:00:10.490
which allows you to manipulate Active Directory data.

00:00:10.720 --> 00:00:14.820
This allows us to insert objects into our fake DC,

00:00:14.970 --> 00:00:19.150
which is then followed by a push to the actual live domain controller.

00:00:19.840 --> 00:00:21.510
Once the attack has been completed,

00:00:21.820 --> 00:00:24.550
the rogue DC will be taken back down immediately.

00:00:25.440 --> 00:00:29.700
This type of attack is very effective when attempting to evade defenses as

00:00:29.700 --> 00:00:34.030
you can modify data within Active Directory, and there is a possibility

00:00:34.030 --> 00:00:38.460
that security monitoring tools may not be configured to look for this type

00:00:38.460 --> 00:00:42.810
of behavior. For this demonstration, creating a rogue domain controller

00:00:42.810 --> 00:00:46.610
with DCShadow, it's important to understand that you need to have two

00:00:46.890 --> 00:00:48.650
Mimikatz windows running.

00:00:49.440 --> 00:00:50.910
So in this case,

00:00:50.910 --> 00:00:54.780
I've got Mimikatz running once as a domain

00:00:54.830 --> 00:00:56.950
administrator for Globomantics domain.

00:00:57.440 --> 00:01:00.840
In this case I've got cmd running as Windows authority system,

00:01:01.140 --> 00:01:04.379
so we're going to go ahead and browse over to the mimikatz directory.

00:01:04.690 --> 00:01:04.970
All right,

00:01:04.970 --> 00:01:06.000
so here we're at

00:01:06.320 --> 00:01:11.310
c:\Users\olaf.jackson\Desktop\mimkatz_trunk\x64. We'll

00:01:11.310 --> 00:01:12.350
run mimikatz,

00:01:14.580 --> 00:01:17.790
do a privilege::debug, and here we are running the

00:01:17.790 --> 00:01:19.950
mimikatz as NT AUTHORITY. Perfect.

00:01:20.940 --> 00:01:29.660
So let's go ahead and use lsadump::dcshadow, and then object:CN=mary.smith,

00:01:29.660 --> 00:01:33.110
so the domain object container for mary.smith, and then

00:01:33.110 --> 00:01:36.480
comma, CN=Users, domain controller,

00:01:36.500 --> 00:01:41.490
which is GLOBOMANTICS, and we've got the .LAB we've got to add there, so

00:01:41.490 --> 00:01:50.920
DC=LAB1 for GLOBOMANTICS.LAB1. And now the attribute, in this case, is simply

00:01:50.920 --> 00:01:55.480
the description. The value that we want to change for the description would

00:01:55.480 --> 00:02:03.400
just be Pluralsight. So we've got lsadump::dcshadow /objectCN=mary.smith, and

00:02:03.400 --> 00:02:12.270
CN users and the DC=GLOBOMANTICS and DC=LAB1 /attribute:description /value,

00:02:12.350 --> 00:02:13.780
value that we're going to change.

00:02:13.790 --> 00:02:17.830
Okay, the RPC bind is registered and the server is waiting.

00:02:17.840 --> 00:02:22.230
So, in this other window where we're an administrator, mind you a domain

00:02:22.230 --> 00:02:30.710
administrator, we can do lsadump::dcshadow /push. And there we go,

00:02:30.720 --> 00:02:33.950
as you can see, after the change took into effect,

00:02:34.010 --> 00:02:39.020
it did stop the server and now let's take a look at the user

00:02:39.020 --> 00:02:41.050
info to make sure that it was actually changed.

00:02:42.600 --> 00:02:46.050
After jumping over to the Windows 2016 server,

00:02:46.940 --> 00:02:50.000
we can see that mary.smith here has the description

00:02:50.170 --> 00:02:51.950
Pluralsight that's been added.