OK so I am now on the domain controller and I have many cats in the the three files that were in the
X 64 folder of the zip.
Just extracted here to the downloads and I'm just gonna go ahead and go into a command prompt.
And something I should point out to let me bring back up edge is if you go up top to the wiki the wiki
is a great place to learn a lot about me me cats and what it's capable of and all the different things
that it has here.
So please please please look through the different modules that are available to you in exactly what
they're doing.
So from here let's go ahead and I'm going to see these to my downloads folder and then I'm going to
go ahead and execute many cats.
And it should bring up something that looks just like this.
So the first thing that we're going to do and this is the first step that you should always do is you
should run this privilege and privilege is the module the first part is the module and then we're going
to use to Collins and then we're going to say debug.
And we're looking for a privileged 20.
OK.
Now debug means that it's allowing us to debug a process that we wouldn't otherwise have access to and
this is per the wiki.
So we're going to attempt to dump some information out of memory.
Right.
And if we're going to do this we need to be able to bypass this.
So if we don't we don't have the privilege debug on.
We're not gonna be able to bypass these attacks or the memory protections that are in place especially
for the LSA Ellis assess that EMC which we need to bypass protections on that to be able to dump the
Alsace and take the credentials that are stored there.
So we're going to run a few attacks against this so the first attack I'm going to show you is a very
common attack.
So we're going to type in S E K you are LSA and then we're going to do two colons here and we're in
type in log on password
now for this one.
I want you to imagine that not only are we compromising the domain controller here and I'm going to
scroll up just a bit but imagine that maybe we just compromised a regular computer.
Now the log on passwords when we dump this for a regular computer are going to show us the computer
you see the computer username and the A.T.M. hash for that as well as any user that has logged in since
the last reboot and that's stored here in memory.
All right.
So we're we're taking advantage of this stored in memory and say for example you saw earlier with man
in the middle six where we actually used a computer to pull down information.
Well it's possible that we have mis configuration in our environment where a computer is capable of
logging into the domain controller and running exploits.
So it's always good to check this hash and this hashes entail them not until and b to so we can pass
this hash around and try to utilize it in attacks.
This would be taking advantage of Mimi Katz past the hash feature.
So keep that in mind here.
The other thing that we're looking for is accounts that I've logged in so let's scroll down until we
find the administrator.
So the administrator is the only account I've logged in with on this domain controller.
And we also pull down the administrators hash.
So if there was a machine where say for example a domain admin have logged into and it does have to
be the domain controller but that domain admin had logged into then we can possibly get their hash and
use that to pass around and potentially we could take advantage of this WD digest here.
So what is the W digest.
Well it is a feature that on Windows 7 and before was enabled by default.
And what it did was it stored your password in clear text.
Thank you windows from Windows 10 on they have patched or Windows 8 on their patch this.
And what that means is they just turned it off.
The feature still exists.
So what can we do.
We could actually turn on w digest with Mimi cats and then we can go ahead and wait for somebody to
log onto the computer so it does require somebody to log all off or log out and then log into the computer.
But if we're patient or waiting through something for a couple of days this isn't a bad idea to turn
on w digests because that's a registry feature.
So even if they reboot the computer it's still going to come back on.
We go in there we wait we find the clear text password and then we're good to go.
So this is a really really useful tool that we can use here or a command that we can use.
So other commands that we can use and not all of these are going to work but one of them is trying to
dump the the.
Sam so we can just say something like LSA dump and then we could say sand like this and try to dump
that.
And this one doesn't work and that's ok sometimes it doesn't work.
We could try a SAM WE COULD TRY patch.
See if that works that doesn't work.
OK.
Let's try something else though.
So backing up just briefly just because we're not able to dump the Sam doesn't mean we're not able to
obtain it in other ways.
We can get a shell with Metis boy and dump the Sam we can use secrets dumped up pi and dumped the Sam.
We could also just download the Sam and dump it as well.
So just because mean me cats can't do it here in this situation doesn't mean it's not something you
should know.
And it's also something that you should know there's alternative options that you've seen already in
the course.
So the big one that I really want to show you then I'm excited about is this.
It's LSA dumb LSA and then we're gonna say patch like this and watch what happens.
And I should note that the patch is important.
If you don't put the patch look so happy.
Look what happens here.
So the patch allows us to actually get to the information.
So here you can see the information was coming up through an error.
Now here we're actually able to dump the LSA so the LSA briefly is the local security authority.
So what that is is a protected subsystem in Windows authentication and it authenticates and create log
on sessions to the local computer.
Well we're on a domain controller and we're dumping the LSA here.
So this is one option that we can do.
Now the other option is if we want to we can download or try to download the anti DNS that get.
Remember this file from a long time ago.
What seems like forever ago in the course the A.D. is that debt will contain all the credentials as
well.
But what we're looking at here is we're looking at usernames and entail them hashes.
Guess what.
We could take these hashes offline and try to crack them and we could try to crack these.
And this is important.
Why do we do this.
There's.
OK there's two reasons we're doing this dump here.
One is we're going to take these off line and try to crack these passwords.
If we're capable of cracking these passwords we need to know what percentage that we're capable of because
you've got to think in a real environment we're going to dump probably hundreds of different hashes
and we're gonna take those we're gonna try to crack them and let's say we crack 10 percent or 30 percent.
Well that is a number that we can relay back to the client and say look your password policy is either
strong or it's weak or somewhere in between right.
If we're cracking 50 percent of the passwords we know that that client has a poor password policy.
If we're only cracking like one or two passwords then their password policy is pretty good and we can
kind of identify what passwords we're weak in how they can improve upon it but it gives a concrete number
to the client to say hey look this is how bad your password policy is or how good your password policy
is.
So this is one of the best practices that you will do as a penetration tester.
The other thing and what we're going to kind of lead into and why I'm showing you Mimi Katz is we can
run an attack called a golden ticket attack and I'm going to cover that in the next video but we need
this Cobra's ticket granting ticket to be a little pull that off.
So we're going to pause here and this is really the the rundown for Mimi Katz what I'm going to do when
we're done with the next video is we're gonna have one final video in this active directory section
and I'm going to provide you a bunch of resources that are very very good for learning actor directory.
So we'll cover some of the Web sites and then we'll put them all down in the description below.
So that way you have references for all these Web sites and you can go check them out and learn more
about active directory pen testing at a deeper level.
So from here.
Let's go ahead and talk about Golden Ticket checks and I'll see you in the next video.