Hello, guys, in this video, we are doing some more numeration, like I said before, enumeration
is key, either local numeration domain enumeration or any kind of a numeration accent or enumeration
network enumeration, any enumeration.
They do just, you know, just do it a bunch of different ways.
It is the more information they do, the better it's going to be for you, because the more information
that you're going to have for you to be able to attack, there's the server on this network or you know
that this router, the switch or whatever side you are attacking, you always want to do some good enumeration,
either just hands on enumeration, attacking it, you know, getting information, external information
from the outside.
Yes, yes.
Use Google.
I just use exploit DB see what you can find you and a lot of tools and merchant is key before you start
attacking.
Always, always do a lot of a lot of enumeration.
So that's why we are using crack map exec.
We have, we have done a bunch of different tools already, not a bunch, but we have done a couple
of different tools where you can get, you know, domain information.
So we are going to continue crack map, which is an awesome tool and we are going to use in this time,
like always SMB and the password ranges.
Is that one that the other way to that one six eight thousand fifty five and they use them is upset.
The password is password one, two, three, four, five.
And the first thing that I want to enumerate is the basically the ah ID.
And what is this going to do, guys?
Well.
What this does is that what is the idea if you don't know what the idea is, let's go out and look for
our ideas.
Um, active directory.
Go to Imagists.
Are the.
So there is a good picture here.
Let's go ahead and.
Copy, image, location.
Let's put this up.
Oh.
There we go like this bigger.
And are the verses as I.B.?
There you go.
This is a better.
There's a better picture here.
Very much location, I always.
OK, so let's start with the security principle aside, so the the right the user acidy, that the only
objects that group acidy.
So the S.A.T. is composed of the domain inside the and the our I.D. So the domain names like the Domain
is what identifies the domain.
And then we have the idea, which is basically what identify that object.
So this one is always going to be the same if they are on the same domain.
But this one is going to be different for objects.
So every object has a different ah, ID.
Right.
And the increment increments and also, you know, now Windows has by default, whenever you create
active directory, they create defaults.
Are ID right.
So there is the right, the five hundred which is for the administrator and then they have only the
five or one.
Five or two and five, four, three one is the default account, one is the cat's account.
So by default there are always the same numbers.
But every time you create a new user, I believe it goes up to the thousand and a thousand and then
a thousand and one.
Right.
And then you can see over here on this picture, you can see the domain identifier that is the domain
acidy.
And then we have the idea here.
Right.
So what we're going to do a work map is going to do is going to do a brute force.
So what is going to basically do?
Crack crack mach?
It's going to take a look at a domain inside the and then it's going to try to force the are.
So it's going to try to guess the idea because it's not really hard to guess because they are just basically
numbers that increments.
And so you can see over here.
There we go.
So you can see, like I told you before, the five hundred already is for the administrator.
The five one is for the gas and the five or three look at the four.
Count em, you know, and every every object in an active directory has to has a R inside.
Right.
It's an object identifier.
And then you can see over here, this one was basically probably the first the first object that was
created by us.
And it was the ADD or that was created by whoever made that server.
Right.
And then we also have the DNS admins, which is the type alias.
So this is the DNS update proxy.
And this is a group Web admin, which is a user, the admin, which is a user.
And Jenkins admin is like when I was a user, it said, you can see our ID and it's a user.
So you can see that it was able to brute force because it's not really hard.
They just increment.
So what?
Greg McKissack is going to do.
It's going to basically, you know, just to start from five hundred and increment from there and see
if we get some hints and see if we can clear that data.
And that's what it's basically doing.
All right.
Awesome.
So another one that we could do.
Is that we can get the groups just like we did for the just like we did for the users, we can do groups
and we can get that information from it's going to be from the domain controller, as you can see right
here, all that is going to come from the domain controller.
It's not going to come from like that 50 or that that it's not going to go for that 55 or that 54 because
they're not a domain controller.
But what this is going to actually give you is going to give you the local groups that they have.
And you can see over here, the local groups, you can also see the members.
How many members are you can see there is seven domain admins, there's one enterprise admin.
And I believe that enterprise and managers, the administrator user with the idea of five hundred that
were so so there you go.
So more ways to do to do an operation against that domain.
Um, and another one that I want to look at, if you want to look at local admins instead of just all
the groups, you can also do that.
You can do a local groups like this because so you guys can see for some of you that are blind like
I am, let me go.
We can just if you want to enumerate local groups, you know, you could do that.
You could enumerate just local groups instead of all of them, even though since the activity is a domain
controller, there are other other groups that you see here.
Are there are local groups.
Right.
Which is all of them or even that the, um.
So, yeah, you can see the administrators.
You see, yep, even for the yep, let me see this.
And now it's actually only taking the yet.
Awesome.
So yeah, this one, it's only taken the local groups even for the.
Even for the domain controller, so that's cool.
Awesome.
So other ways we could do another one that you could do is the password policy that you can to some
numeration, no password policy, and this one could come handy pass.
O l and this one could come handy because whenever you want to do know brute force, if you are able
to prove force or if you have, let's say, like an ACL or you are able to change the password for another
user.
And this is a good way to take a look and see what the password complexity is so you can just get a
one shot at it.
You can see the edge of it.
You know, the risk that I can look out counter so they have a resay counter.
So every time you locked you account after 30 minutes, it's going to be unlocked.
Basically, so, yeah, you know, just just do some of them, and that's that that's what the key the
key to hacking to be a good hacker is to do an operation, just do an operation a bunch of ways.
Or if you just like one tool, you can just keep using that, too.
If you're stuck, you know, just go ahead and move to another to just use a bunch of tools, use all
the tools to enumerate, just do a lot of information.
OK, so this is set for this video, guys.