Hello, guys.
We're going to continue with the domain and numeration, and this time we are going to use an old tap
domain dump and this one is my favorite because it actually works.
It's not like when that search, which we were not able to do the full dump for some reason it didn't
work.
I don't know why.
But this one, it's a lot easier, I think, to to work or a lot easier to retrieve information from.
So we are going to be using this old domain dump.
So let's go out and do a get.
Let's go to this repository.
There we go.
It worked out last year.
Here's the other one.
They don't work.
Don't use it.
I mean, it worked whenever you were trying to do one item at a time.
But we don't want to do that.
Let's go ahead and see.
To hear, to see what we have.
So we have the pilot and you need Partan three for that, so I should go and do analysis again, we're
going to be easy doing Python three.
We can do all that, Tom zappy, so we can see the commands that we can use.
You can see now a lot of commands.
So what this actually does is that it dumps all the domain information.
I believe if we go over here, it tells you what it does.
He dumps the main groups, use their computers, policy trusts, you know, users, my group as well,
you can do computer software.
So it does a lot of dumping.
It dumps a lot of good information.
That we can use to to our advantage, so and also the thing is that if you do, a regular one is going
to dump a case on file and small file and it also dumps a file.
So since we're not going to use using data on file or crap file or we're going to be doing this, we
are only going to use in the e-mail.
So are we going to tell it on our command?
Is that one?
We want to we don't want to say anything.
We, Jason, or grep would want to use any of those.
What we want to do is just do the demo.
So we want to say at the end, no Jason and no Greb.
So let's go ahead and do that.
So we want you to.
Python three over here, the first one is the user.
They need to specify in the user that we got we need to put the domain in here.
Double backslash exec, then the password, password one, three, four, five, hold up, colon, double
forward slash.
Then we need to specify the, uh, the server where we want to gather this and we're going to in thirty
nine, which is out the up and we're going to say no I think it's double.
Yeah.
No case on and no.
Correct, and then we want to chalupny another one over here and then we want to say that, director,
we want to save that.
We are going to be data, but we haven't.
We need to create that folder, but we want to export all the data.
So let's go ahead and copy this.
Let's go ahead and make the directory data.
And let's go ahead and run the command so they come in, it's going to be using the username Itzik with
this password.
We're going to send out that through every night for the server, which is the I believe is that active
directory.
So an active actor because he has three eighty nine open now that we are going to say we want to export
any Jassam files and we want to export no files either or we want to export its ASML files because if
we don't say no, Jason, I know grep it is going to export Jason ASML and also crap.
So we only want to export HDMI and it's going to export everything to the Datafolha.
Ron and there we go, is done, we can go to the data folder clear and we can see that we have the domain
computers that make computers by us, the main groups, the main policy trust users and the main users
by.
OK, awesome.
So what we could do is we can go ahead and just open this with a with Firefox or Chrome, whatever,
whatever browser you like to use.
So let's go out and go to documents.
Head to.
Out at the main dump, and we have everything in the data folder and there they are, so we can just
go ahead and click and open with Chrome so we can see all the computers, you can see all the computers
that are in that domain.
We have that student file, Web, DC and ADD and you can see it over here.
You can see the always version the service back and when it was created.
You can see if it is for the location or not, these two are.
And that's because they are the main controllers and that's why they're there for the location.
If it was a non domain controller for the location, then we would be able to do a unconstrained delegation
attack.
OK, let's go out and see the man by OS as well.
It's growing up and all of them open this one week from.
Open the policy with Chrome, Firefox and Chrome.
This one as well, I don't think we're going to have anything in there anyways.
Users.
And the money by group.
OK, so we have all the information over here.
The first one is just all the computers or the servers.
This one has it by OS, so twenty sixteen and just one eight.
We can see all the domain groups, we have a lot of groups in here.
OK, we can see that the users.
Oh, this is actually the domain policy lock out directions every time there is an account that is locked,
it's only going to last 30 minutes.
Every 30 minutes it is going to go back to unlocked password H is forty two days minimum pass or at
least one minimum possible length is seven.
Password history is twenty four password complexes.
So the property is possible, complex machine account quarter is 10, so this is good, good to know
because if we are doing a.
Brute force, you want to.
You know how many times you could do it if you have to change a password as well?
You want to see what's the minimum length for the password and the age and all that good stuff.
Is good to know if you're going to be doing brute force.
I believe we're not going to be doing any brute force in this course.
We don't have any domain trust, meaning that there's only one domain.
You can see other domain users.
You can see some of the flags like that, this a doesn't expire, don't require pre authentication.
This is for heat atoms.
So and this is he's part of the domain.
And so this means that this account is Rosillo.
So we are going to be able to acquire the basically the credentials or the hash and we're going to be
able to crack the hash.
So offline, so we are going to be able to do that and I see anybody else has done.
Now there's a kind of disable disable.
No matter what, the password doesn't expire for this guy the administrator likes, go out and take
a look at domain users by group.
So they're the main users, you can see the domain admin, so this is good, you know, our DP group,
Keith Adams users, domain users, the Hilton group.
John Hammond.
Deny our D.C. system so you can see whoever has access to this one.
I want to take a look at it over here that the main elements, because that's what we want to basically
go after the domain admin.
So it's quite an open, I don't know, and domain enumeration.
So we are going to put it here.
Or the domain Ammon's, and we can see that we have stood in five.
STUDENT one as well, we can see that we have heat atoms, Savitar.
Jenkins minutes were Savitar, Jenkins, Amin administrator and also hidden, so hidden, so whoever
is part of the hidden group is also a dominant one because this group is part of the Minutemen.
So whoever is in this group, in the hidden group is also part of the Minutemen.
So let's go out and see who is part of the hidden group.
So, Jane Harman, so this guy over here is also at the Minutemen.
OK, so we are just adding this notes in here.
So we have the dynamics.
Let's see what else I found something.
What was its users we can see that doesn't require pre authentication, so that means that we going
to be able to roast this user in the heat items and he is a domain admin.
Over here.
But the
House has applied to we are going to be able to you that.
Awesome.
Let's see what else we can get over here.
You know, we can get other domain computers as well.
This is good information.
Um.
Pace everything in here.
Cool.
Uh, we don't need.
Oops.
So we don't need this information over here.
OK, so we have to the computers awesome.
Let's see what we have over here.
Passover doesn't expire.
I kind of say, well, look at the description over here, Passover, one, two, three, four and five
instead of five is part of the domain admin.
So, look, that's a quick win.
So you see how easy it is to basically get domain admin on a.
On a network, so if you guys if you see that in your.
You know, new domain, if somebody puts the password to this question, please just remove that and
put it somewhere else, because if somebody gets a credential from anybody, from any user online,
it's like we got the credentials for ABC and it is basically just a regular user.
So if we go to.
Uh, it's not here it is he's not part of any really like any groups, so only part of the main users.
So we were able to get his credentials and to get to dump the entire basically dump the entire domain.
And we were able to extract the password for a domain user.
We can also see jenkins', amulets, jenckes and and part of that domain as well.
Yes, he is.
There we go.
So this is how easy it is to get in.
I've seen this a lot, I see this everywhere, almost everywhere I go.
I usually see a password in the description.
No, no.
So you can see how easy it is to get the admin access.
I already have two domain I'm going to access for Sutent five.
And also I mean, we're not going to take that path.
We are going to go another path.
We're just going to continue as we have just the jenkins' not take your time and we have to Itzik credentials.
So we are going to continue with that because it's just a low hanging fruit over here that a lot of
companies do that.
So if your company is doing that, please advise them to stop doing that, because you can see how easy
it is to get domain admin just by dumping.
All the information from the domain, which also has the information of the description.
OK, as we saw here, a one three.
OK, awesome.
So these this for this video on the next video, we are going to keep enumerating just different ways
to enumerate active directory.