WEBVTT 00:00.390 --> 00:01.980 Everybody welcome to the first video in the module. 00:02.010 --> 00:08.280 So as we talked about the previous video we're going to be going over a full assessment on no access 00:08.280 --> 00:12.050 to domain administrator on a Windows domain network. 00:12.060 --> 00:14.840 Now the first step we're going to want to do is take a look at our reconnaissance. 00:14.850 --> 00:21.200 So we've got a range 1 9 2 1 6 8 1 100 to 1 0 3 is our scope. 00:21.270 --> 00:25.650 So the first thing we want to do is just quickly do an end map scan to find out what we're working with 00:25.860 --> 00:31.140 so and map 1 9 2 1 6 8 1 One hundred dash 1 0 3 which is our scope. 00:31.150 --> 00:35.970 So go ahead and run that. 00:36.160 --> 00:37.120 Perfect. 00:37.150 --> 00:39.640 So if we take a quick look here it looks like one hundred. 00:39.640 --> 00:49.560 This looks like a domain controller based on the fact that there's ELD up Cape password 5 cross domain. 00:49.640 --> 00:54.380 So this looks like our domain controller so we'll keep that in the back of our mind so if we look at 00:54.380 --> 01:06.750 one hundred we see here there isn't much going here 3 3 8 9 is up see we're not seeing anything too 01:06.750 --> 01:07.370 fancy here. 01:07.380 --> 01:17.020 But if we look at one of three we do start seeing a few we see a web service we see HDTV proxy and ADHD 01:17.020 --> 01:24.400 is normally accustomed to a patchy Tomcat based on the ports with eight thousand nine. 01:24.400 --> 01:34.120 So if we do a quick curl on this host 1 2 1 6 8 1 dot 1 0 3 import 80 80 do a quick look and see what 01:34.120 --> 01:38.760 we get here so we could see a patchy tomcat. 01:38.790 --> 01:45.540 So let's go ahead and just take a look at this in our browser go ahead and take a look at the Web site 01:45.720 --> 01:51.420 up to 1 6 8 1 3 import 80 80 perfect. 01:51.430 --> 01:55.130 So it looks like we got a base install of Tomcat Apache tomcat. 01:55.150 --> 01:58.300 Looks like they have links to host manager and manager app. 01:58.330 --> 02:06.520 So in some cases a admin might leave a patch of Tomcats management interface with the default credentials 02:06.520 --> 02:07.960 of Tomcat tomcat. 02:08.080 --> 02:11.020 So let's go ahead and just take a quick look and see if that's the case. 02:11.050 --> 02:18.260 So if we do Tomcat we'll do Tomcat admin just to see because there's normally a few variations of this. 02:18.260 --> 02:24.140 No let's do admin tomcat. 02:24.340 --> 02:24.600 No. 02:24.780 --> 02:27.450 All right let's try Tomcat and Tomcat 02:30.470 --> 02:31.150 awesome. 02:31.160 --> 02:31.430 All right. 02:32.030 --> 02:36.470 So from this point we can actually start doing our exploitation we can deploy a wah file in here and 02:36.470 --> 02:40.720 actually start gaining some code execution and a shell on the on the system. 02:40.730 --> 02:47.990 Now what's good about this is sometimes if we're lucky the admin will be running example or Apache Tomcat 02:48.830 --> 02:56.450 as a admin or a privilege user instead of a service user or a service service user. 02:57.110 --> 03:00.890 So but we'll have to wait for the next video will we go over the exploitation process so this is just 03:00.890 --> 03:07.910 us doing our initial recon and finding a few a few interesting things that we can use to leverage our 03:07.910 --> 03:11.120 way to the initial access to the system. 03:11.270 --> 03:16.160 Because with a D we need to kind of move into a domain user account to kind of leverage things a little 03:16.160 --> 03:16.670 bit further.