WEBVTT 00:00.120 --> 00:01.590 Hey everybody and welcome to the next video. 00:01.590 --> 00:04.800 We're going to be going over finding some new access. 00:04.800 --> 00:09.840 So right now we've got a impersonation token set up on which users. 00:09.920 --> 00:12.120 This is Jay Smith right. 00:12.120 --> 00:22.500 So we want to use this user to enumerate the Active Directory Domain for us to try to figure out where 00:22.590 --> 00:24.600 we can go and what options we have. 00:24.630 --> 00:26.790 So the first thing we're gonna do is use a bloodhound. 00:27.090 --> 00:33.440 So to do this the first you need to do is apt get install bloodhound. 00:33.930 --> 00:35.600 And I've already got it installed. 00:35.670 --> 00:38.050 So in your case it will go ahead and install. 00:38.160 --> 00:45.420 Now once it's installed you're going to do Neil for J console and you're going to plop that bad boy 00:45.420 --> 00:49.830 into the background because you just don't want it to stay running the whole time. 00:49.920 --> 00:50.190 Right. 00:51.110 --> 00:55.290 So now that that's running and it's starting. 00:55.290 --> 00:57.210 Perfect goal. 00:57.390 --> 01:05.400 Once that started we need to actually go to a browser and connect to our local host on 74 74 to be able 01:05.400 --> 01:08.880 to change are the Neil password. 01:08.910 --> 01:13.960 So it's Neil for J is to use name and Neil for j is the password. 01:13.990 --> 01:23.920 So what we need to do will pop out over here and we'll do HDTV TTP vocal host 7 4 7 4 01:27.250 --> 01:33.710 which is going to bring us to our Neil browser and it's going to ask you for your first era username 01:33.720 --> 01:35.030 in your last and your password. 01:35.060 --> 01:37.560 So this right here is the password. 01:37.610 --> 01:42.140 So in my case I've set it up so I've set up a new password here which is what you're going to want to 01:42.140 --> 01:42.800 do. 01:42.800 --> 01:46.820 So what I've done is when you when you first do that you're going to use Neil for Jay as the user in 01:46.820 --> 01:48.210 the Neil for Jay as the password. 01:48.350 --> 01:53.300 And then it's going to prompt you for a new password once you've got that new password set you're going 01:53.300 --> 01:55.240 to go ahead and just close the browser. 01:55.310 --> 01:57.060 You don't need it any longer. 01:57.080 --> 01:59.270 So now we've got that setup. 01:59.540 --> 02:08.750 What we need to do now is download something called Shark pound which is bloodhounds get repo. 02:08.750 --> 02:13.340 They have a compiled version for Windows so you don't have to try to run a power show. 02:13.610 --> 02:20.420 And I've already went ahead and download that but the W get is at the bottom or in the below the video. 02:20.420 --> 02:23.620 So go ahead and copy paste that w get it sharp hound dog. 02:24.620 --> 02:29.810 Which if we take a look right here we can see we already have it downloaded. 02:29.900 --> 02:37.560 Right so the next thing we're going to want to do is upload this and we can do that is let's look at 02:37.560 --> 02:41.680 what what we have in our current directory pricing system. 02:41.690 --> 02:42.130 Thirty two. 02:42.150 --> 02:42.420 Yes. 02:42.440 --> 02:48.360 So we'll get back into users and then we'll do J. 02:48.360 --> 02:53.100 Smith go to their desktop. 02:53.150 --> 02:53.790 Right. 02:53.800 --> 02:56.780 Perfect so here we go. 02:56.780 --> 02:59.190 So we can see see users JS Smith desktop. 02:59.330 --> 03:00.050 Perfect. 03:00.050 --> 03:04.660 We're going to upload sharp Hound Dog XY 03:07.970 --> 03:09.500 perfect and forgotten. 03:09.500 --> 03:10.400 Take a look. 03:10.400 --> 03:11.390 We got it there. 03:11.390 --> 03:14.570 So what we're gonna do is I'm gonna go ahead and execute this and this is gonna dump a few things on 03:14.570 --> 03:17.010 the desktop so you can put this anywhere you want. 03:17.060 --> 03:22.150 I'm putting on the desktop for ease of use but it's just going to generate a zip file for us. 03:22.190 --> 03:28.490 So if we do execute dash F sharp pound Daddy XY 03:31.470 --> 03:39.140 sharp LB Daddy go and run that and if we go ahead and take a look here we see we have a zip file. 03:39.710 --> 03:42.300 So what we're gonna do is we're going to go ahead and grab this. 03:42.300 --> 03:47.730 So we're gonna download this file. 03:47.840 --> 03:48.890 Perfect. 03:48.980 --> 03:50.690 Now we've got that local to our machine. 03:50.720 --> 03:57.700 And then with are we if we if you've setup Neil for J and you set a new password on it what we're gonna 03:57.720 --> 04:04.370 do now is just use bloodhound that's gonna load up a gooey for us to interface with but it's going to 04:04.370 --> 04:09.740 ask us for the user name and password which in this case will be Neil for JS the user name and then 04:09.740 --> 04:11.790 the password is whatever you set. 04:11.900 --> 04:18.410 So Nio for J and then whatever password you set after the fact. 04:19.060 --> 04:21.130 So this will go ahead and load up bloodhound 04:25.350 --> 04:29.900 so this actually will be completely clear. 04:29.920 --> 04:36.160 So let me go ahead and just clear this out clear that this so yours would look. 04:36.180 --> 04:38.580 It's going to look like this. 04:38.600 --> 04:39.400 I do want to clear it up 04:43.490 --> 04:44.590 once that's done. 04:44.690 --> 04:45.110 OK. 04:45.200 --> 04:46.170 So what you're going to see is this. 04:46.190 --> 04:47.860 So this is this is your initial bloodhound. 04:47.870 --> 04:55.060 So we're going to want to do is come up the top right and do upload data and what we're gonna do is 04:55.060 --> 04:57.100 we're gonna provided that zip file. 04:57.110 --> 05:02.440 It'll go ahead and open it up and grab all of the Jason files such as the groups users computers et 05:02.440 --> 05:04.680 cetera that we're going through here. 05:04.690 --> 05:11.020 So you can see it's processing it all and we can see here we've got six users in the domain three computers 05:11.360 --> 05:17.380 fifty two groups zero active logged on sessions and forty one relationships. 05:17.440 --> 05:20.360 So if we go to queries there's a lot of built in queries. 05:20.470 --> 05:27.620 So we want the find the shortest path to domain admin and we're gonna pick this domain domain admins 05:27.630 --> 05:28.740 this group. 05:28.740 --> 05:32.740 And OK so let's take a step back here. 05:34.480 --> 05:45.770 So it looks like we've got domain admin here right you've got domain admin administrator which is the 05:46.130 --> 05:49.240 local admin account but here we have a group. 05:49.250 --> 05:57.980 So it says security org and since it's all the way this is Jay Johnson. 05:58.050 --> 05:58.390 OK. 05:58.440 --> 06:04.620 So it looks like Jay Johnson is part of a group called security or which has which is a member of the 06:04.620 --> 06:06.240 domain admins group. 06:06.240 --> 06:11.810 So it looks like based on this Jay Johnson is going to be our entry point here. 06:11.820 --> 06:15.150 We're going to want to try to aim for this user specifically. 06:15.150 --> 06:20.640 So for now we're going to leave this alone but bloodhound is a very useful tool I suggest taking a little 06:20.640 --> 06:24.120 bit more time and investigating this tool and seeing how it works. 06:24.120 --> 06:30.030 Looking up tutorials it's a very very useful tool and it's very powerful but for what we need we just 06:30.030 --> 06:32.340 wanted to know what user we needed to its target. 06:32.340 --> 06:42.090 So in this case it's Jay Johnson so go ahead and clear this up and now that we've gotten are and we've 06:42.090 --> 06:46.860 gotten our next point we're going to take this a step further and move laterally in the next video.