All right now let's set up the situation here.
We've got our Windows server running and we've got every machine running.
So I've got my two windows 10 machine my Windows server running and we're going to use this tool that
we just installed cracked mapping ZEC and it's gonna look something like this.
We can say track map exact.
We can do dash dash help and take a look at what it's got to offer us.
And I can make this a little bit bigger.
We could scroll up to the top and really what it does is we need to provide it with a target.
Typically we either provide target IP addresses a range or a cider notation we can do a bunch of different
things.
My favorite is just just give it a cider notation and you're going to see what that looks like.
Then we're gonna have to provide a user name a domain and a password.
Well we can provide it username and password and do a dash dash local if it's a local account.
But from here we're going to provide a username domain password because as of right now we have just
captured the user account of f Castle password 1 and there's so many different things that we can do
here.
There's actually a lot of models that we can run now the models are kind of finicky but I must show
you some cool little tricks that we can attempt to do here.
So first of all let's just check our status.
How about we do that.
So we're going to do something like this.
We're gonna save crack MF Zac and we're going to say a user actually let's go ahead and specify the
domain or where we're going to be attacking so 1 9 2 1 6 8 fifty seven zero slash twenty four for me.
So it's gonna sweep the entire network with this.
We're gonna say user of f Castle domain of Marvel dot local and password of password 1.
So go ahead and fire that off
and there we go.
So it has gone ahead and attempted to attack my dot one machine which is my local machine here but it
also attacked the network that we have right.
So you've got the Hydra DC you've got Spider-Man and then the Punisher here and you could see that it
came through it tried this username and password on Hydra DC it did not work.
What does it tell us.
That means that this user does not have SMB access because this is trying to access SMB here doesn't
have SMB access to the domain controller.
Unfortunately we don't win that easy all the time.
We've also tried Spider-Man.
Right.
And we knew about the Punisher but we didn't know about Spider-Man.
So that's nice.
So we've got Spider-Man now and the punisher.
So we've owned a second machine when it says pone here.
That means we now have access to a second machine.
So can we do.
We could go P.S. if Zack that pie and we can use these credentials and do it to adopt one forty two
as we did with DOT 141.
We can also do something which this is kind of cool.
We could do something like dash at Sam and if we get on it sometimes it will work for us.
It's going to try to dump the Sam file and here it didn't work.
That's OK.
So it tries to go in and this is successful a lot of the time where it goes in and they'll try to dump
the Sam file out of these machines.
And if we look up here there's a few different things that we can do with it.
We could try to dump the Sam or LSA A.D. S which we talked about way in the beginning or and talk about
it again here and a little bit we could enumerate shares.
There's all kinds of things that we can add on.
Again there's all these modules which we're not going to even cover.
I do recommend reading the documentation on this because it can go really deep and it's surprising how
deep this can actually go.
But from here let's just talk about what we can do.
So we were able to dump the Sam here but we can utilize a tool called Secrets dump which we're going
to cover in the next video on how to get the Sam file and we can just do that.
Yes exactly right.
So we had P.S. exact pi and we could say marvel and we could say F Castle password 1 and we could put
that at 1 9 2 1 6 8 fifty seven dot 142 and try to get a shell there.
And wouldn't you know it.
So am I.
Hostname where authority system on Spider-Man so this is a quick win here.
We can take advantage of this as we're going to see in the next video dumping some hashes out getting
some more information extracting this.
We could also go try to get a shell on this machine via the return fritter.
P.S. exact as well and utilize those.
So that's just a quick overview of how useful passing the password is.
This is if I get a credential the very first thing I'm doing is I'm passing it around the network because
I know it's valid.
You can also utilize this the password spray but I would recommend against doing that on domain accounts
because what happens is say we have 50 machines here.
You take this username you could put any password you want here and try to spray it across a network.
And what's going to happen is you're going to get failed logging attempts and if you get so many in
a row you might lock out your user account.
However if you have a local account what you're going to see here in a couple videos you can actually
try password spring against it and you could just throw anything you want at it to see if it sticks
and you might get lucky and the local council have that same lockout policy like domain accounts do
so.
I always like to do some password spraying on local accounts as another strategy if you're kind of stuck
in not getting anywhere or if you've come across them different passwords or different password phrases
or patterns that you might have noticed in the network.
It's another good thought to have to just try it again some different accounts or even just admin or
an administrator.
So that's it for this lesson.
We're going to go ahead and move on to the next lesson which is how to dump hashes.
Now that we have this here.
So we've got a user account.
Let's dump hashes with this user account especially on the two machines that we found.
And we'll store those hashes.
We'll even try to crack those hashes and I'll move on to passing the hash as well just as an example.
So I'll get you over in the next video.