WEBVTT 00:00.360 --> 00:00.850 Hey everybody. 00:00.850 --> 00:01.740 Welcome to next video. 00:02.130 --> 00:04.900 So we're at the we're at the final stretch. 00:04.950 --> 00:08.370 Give me the last feel so we're going to be working getting domain at this point. 00:08.370 --> 00:11.380 So we've compromised two machines now. 00:11.490 --> 00:18.280 We've gotten user Curt we've gotten access as the user John Smith or Smith and what we're going to do 00:18.280 --> 00:23.850 now past this point is we're going to go ahead and dump passwords from memory. 00:23.860 --> 00:27.580 So we're going to try to see if we can get anything from this machine because right now we haven't had 00:27.580 --> 00:32.090 any luck actually usernames and passwords which might be very useful. 00:32.110 --> 00:37.720 We do have the admin accounts but if they change those then the domain users we can't get access to 00:37.720 --> 00:41.920 them or if they log out of the machine we can no longer gain access as that user. 00:41.920 --> 00:46.450 So let's try to grab us a little bit more persistence here. 00:46.450 --> 00:51.010 So the first thing we want to do is we'll check what directly we're and we'll see here where it looks 00:51.010 --> 00:51.700 like we're in that. 00:51.730 --> 00:54.430 So we'll see users 00:57.890 --> 01:02.150 let's see here where's a good one so we're system right now. 01:02.150 --> 01:06.170 So we'll do we'll do administrator 01:12.500 --> 01:17.530 administrator and we'll probably dump it on the desktop desktop. 01:17.590 --> 01:18.160 Right. 01:18.200 --> 01:28.580 So first of windows when upload many cats which is under user share maybe cats X 64 and maybe cats Daddy 01:28.590 --> 01:28.900 XY 01:32.580 --> 01:41.900 perfect gonna and dump into a shell so and you and I are we can see we do have many cats. 01:41.900 --> 01:42.530 Perfect. 01:42.530 --> 01:43.470 So we'll do. 01:43.610 --> 01:44.450 Go ahead and launch it 01:47.850 --> 01:49.580 we should blame this on its own prompt. 01:49.590 --> 01:50.440 Perfect. 01:50.520 --> 01:51.990 Now we're gonna set our privilege level 01:56.830 --> 01:59.980 to debug looks good. 02:00.270 --> 02:11.730 I'm going to go ahead and dump the passwords all misspelled that S E K you are L as a log on passwords 02:11.910 --> 02:12.210 for 02:17.090 --> 02:19.870 so let's go to the top here 02:23.870 --> 02:32.600 let's see where we got oh OK looks like the user I.T. support on the domain. 02:32.600 --> 02:37.880 Red team nation with the log and server are tenacious DC 1 which is our domain controller and most likely 02:37.880 --> 02:42.020 the one the dot one hundred we can see the password is password 1. 02:42.170 --> 02:42.950 Awesome. 02:42.950 --> 02:50.600 So with this we don't have to try to impersonate another user we can log in directly as them if we wanted 02:50.600 --> 02:56.960 to with SMB against any machine on the domain which is really nice. 02:56.990 --> 03:00.560 However we don't need the password at this point. 03:00.650 --> 03:06.650 I don't think to actually go ahead and get ourselves domain admin but it's nice to have that little 03:06.650 --> 03:09.070 extra bit there. 03:09.500 --> 03:16.790 So what we need to do is we're going to go ahead and load ourselves up as the I.T. support user because 03:16.790 --> 03:18.170 that seems pretty interesting. 03:18.170 --> 03:25.820 It's it's it's a very useful named account which kind of tells me that it's possible that based on what 03:25.820 --> 03:31.730 we saw in bloodhound Jay Johnson is has a potential path to a domain admin. 03:31.730 --> 03:38.930 However if this I.T. support character can reset the password of that user let's say foo delegation 03:39.050 --> 03:42.140 on over the 80 some 80 tree. 03:42.140 --> 03:46.190 If this user happens to be underneath that we'll be able to reset the password and if we can reset the 03:46.190 --> 03:53.710 password that domain user we now can then log into the domain controller as domain admin so what we're 03:53.710 --> 03:57.610 gonna do is we're gonna impersonate the users so what do load incognito 04:00.490 --> 04:02.800 will do list tokens 04:05.380 --> 04:13.520 to and court we see sports or impersonate token go ahead and grab this guy. 04:15.370 --> 04:18.390 Paste and we'll add our extra slash in 04:20.970 --> 04:24.160 perfect so if we do Shell why am I. 04:26.280 --> 04:27.920 Perfectly I.T. support. 04:27.930 --> 04:32.970 So now let's do a quick check so we can actually we don't need an alt at browser to reset a domain admins 04:32.970 --> 04:33.560 credentials. 04:33.630 --> 04:35.640 If we have the ability to reset it. 04:36.180 --> 04:37.380 So let's go ahead and give it a try. 04:37.380 --> 04:44.870 So if we do not user Jay Johnson slash domain to notify that it's a domain user 04:47.880 --> 04:53.280 domain I can spell correctly and then whatever password we want we'll do we'll do password 1. 04:53.430 --> 04:54.250 Right. 04:54.360 --> 04:56.980 Just to make things a little bit consistent for us. 04:57.180 --> 04:58.000 Easy to remember. 04:58.020 --> 05:04.080 So go ahead and set that and if that allows us to be set that means the delegation on this user to be 05:04.080 --> 05:10.200 able to reset passwords happens to have this user as its delegate as well even though it probably shouldn't 05:10.200 --> 05:14.260 because it's a domain admin poof. 05:14.280 --> 05:19.150 Look at that request we process it the domain controller for ventilation not local. 05:19.150 --> 05:19.560 Awesome. 05:19.570 --> 05:28.120 So we've now changed the password for Jay Johnson So what we can do is we'll kick this bad boy into 05:28.120 --> 05:30.390 the background and we'll use P.S. exact. 05:30.520 --> 05:32.060 So if we do already have it. 05:32.080 --> 05:35.190 So show options. 05:35.290 --> 05:36.410 Show Options. 05:38.390 --> 05:43.160 So we'll do set our hosts to 1 9 2 1 6 8 1 Top 100. 05:43.190 --> 05:54.290 So this is the domain controller only or set SMB user to Jay Johnson and we'll set SMB pass 2. 05:54.280 --> 05:56.380 Password 1. 05:56.410 --> 05:59.440 Just what we set it to so go ahead and run that 06:02.810 --> 06:03.460 awesome. 06:03.470 --> 06:09.200 So we've gone ahead and logged in as Jay Johnson but let's check the EU. 06:09.590 --> 06:10.010 OK. 06:10.100 --> 06:15.650 So it went ahead and noticed that interpreter shall notice that Jay Johnson was an admin on that machine 06:15.650 --> 06:17.150 so it automatically bumped us up to route. 06:17.180 --> 06:27.130 So if we do see this info we can now see we are on our tenacious DC one as anti system authority. 06:27.260 --> 06:31.990 Which then means we can take this domain controller we can already be to it if we really wanted to. 06:32.000 --> 06:35.420 We have full control over the organization's domain. 06:35.420 --> 06:41.540 So every Windows machine on the domain every server on the domain we now have full access to everything 06:42.620 --> 06:43.550 on this domain. 06:43.550 --> 06:49.290 For this organization which is a very very great place for a red team to be but a very bad place for 06:49.290 --> 06:53.790 a red team to be from an organization standpoint because that means something's messed up. 06:54.170 --> 06:58.760 And this is just kind of been a short module to kind of show you guys what the process would look like 06:59.000 --> 07:05.930 when you're attacking a full domain from no access at all to eventually gaining a full domain Edmond 07:05.930 --> 07:10.280 rights which is what we have here and we could take this step further and pull down all the password 07:10.280 --> 07:16.640 hashes for every mission for every user on the system so that's kind of how you would go ahead and go 07:16.640 --> 07:17.030 about it. 07:17.030 --> 07:19.050 Now this is again a simulated environment. 07:19.070 --> 07:25.400 However it's stuff like this does happen in the real world so it's it's something you always have to 07:25.400 --> 07:26.060 look for. 07:26.090 --> 07:31.760 Getting used to working with an attacking Windows Active Directory infrastructure is a very important 07:31.760 --> 07:36.770 concept and it's good to kind of show you guys a full path from start to finish on how you're going 07:36.770 --> 07:38.580 to go about this. 07:38.580 --> 07:43.670 So I hope you guys had a great time doing this module it's a little bit less of a hands on more of a 07:43.670 --> 07:49.550 watching how something is done so hopefully you took a lot of notes learned a few new tips and tricks 07:49.640 --> 07:55.840 throughout the module take a few minutes and if you understand if you didn't have it if you had a problem 07:55.840 --> 08:00.490 understanding any concept that was done here go ahead and do some additional research or throw yourself 08:00.490 --> 08:03.920 over the Facebook group and throw a few questions at us we'll be more than happy to help.