WEBVTT 00:00.340 --> 00:01.800 Hey everybody welcome to the next video. 00:01.830 --> 00:07.620 So we've gotten access to the machine and we just happen and we happen to have a patched Tomcat running 00:07.630 --> 00:14.040 as administrator which means it gives us straight to system access on a domain registered machine which 00:14.040 --> 00:14.370 is good. 00:14.370 --> 00:17.860 This kind of gives us an initial entry point to the domain. 00:17.940 --> 00:22.740 However the first thing we're going to want to do when working specifically with an attacking a Windows 00:22.740 --> 00:25.500 domain we're gonna want to look and try to find out. 00:25.500 --> 00:28.170 Can we access a user. 00:28.300 --> 00:31.740 And the reason for this is because there's a nice tool called bloodhound which we go over in the next 00:31.740 --> 00:37.770 video that works pretty well at trying to figure out how to get to domain admin from what you have. 00:37.860 --> 00:42.960 And the only way to do that is to have an initial user account in some way shape or form. 00:42.960 --> 00:46.770 We don't have to have the password per say but we need the access of that user. 00:47.610 --> 00:53.670 So what we're going to do is we're gonna go ahead and list the tokens we're going to dump the hashes 00:53.670 --> 00:55.590 first and then we're going to list the tokens. 00:55.640 --> 00:59.980 So so we'll do hash dump. 01:00.090 --> 01:05.650 Now what's interesting here is the operation has failed. 01:05.730 --> 01:15.250 The reason for that is because we are in a 32 bit process so when we attacked comp Apache Tomcat we 01:15.250 --> 01:20.720 were accessing A's 32 bit process since this is a 64 bit machine. 01:20.860 --> 01:24.420 We need to launch so as we can see appear 64 bit. 01:24.850 --> 01:31.080 We need to access a process that is a 64 bit process. 01:31.090 --> 01:39.220 So if we just take a look here find a system process let's do it let's do one log on right. 01:39.220 --> 01:42.310 So we'll migrate over to PIB 1000 01:47.950 --> 01:56.500 perfect and if we get you I.D. We are still system perfect and then we'll do hashed up. 01:56.510 --> 02:04.180 Now what I want to do is take a copy of this admin hash because we might need it in the future specifically 02:04.180 --> 02:05.440 because a lot of 02:08.860 --> 02:19.660 the hashes hash a lot of admins tend to use the same username and password on the windows. 02:20.020 --> 02:21.700 Local administrator accounts. 02:21.970 --> 02:27.590 This is due to make automation and fixing things a tad bit easier now that we've gotten our hashes. 02:27.610 --> 02:32.500 Let's go ahead and see what we can do what tokens are available on the machine. 02:32.500 --> 02:40.660 So if we do load incognito perfect we'll do list tokens. 02:40.760 --> 02:48.940 You so we can see here we've got AI user a local service local server network service system administrator 02:49.900 --> 02:52.420 the windows manager and we look like we have Jay Smith. 02:52.450 --> 03:00.310 So Jay Smith happens to be on the domain Red Team nation that is actually exactly what we want so we'll 03:00.310 --> 03:02.920 go ahead and grab this. 03:02.980 --> 03:04.070 We'll copy that. 03:04.080 --> 03:08.350 And then what we're gonna do is we're gonna go ahead impersonate the user and that's as simple as impersonate 03:08.350 --> 03:13.100 token and we pop in that. 03:13.120 --> 03:18.490 But we need the extra slash in there to escape the first one. 03:18.520 --> 03:18.940 Perfect. 03:18.940 --> 03:26.290 So if we do get system or get system shall and we do. 03:26.290 --> 03:27.390 Who am I. 03:27.390 --> 03:29.120 It looks like perfect. 03:29.120 --> 03:30.260 We are Jason. 03:30.890 --> 03:36.380 So at this point we can start loading up a bloodhound and working with that and starting to get all 03:36.380 --> 03:39.980 of that running into our lateral movement and gaining our next level of access.