99% of Corporate networks run off of AD. But can you exploit a vulnerable Domain Controller?
Use nmap to find open ports in the machine.
Task 3 Enumeration Welcome to Attacktive Directory
What tool will allow us to enumerate port 139/445?
Enum4linux is a command-line tool used to gather information from Windows and Samba systems in the same network. It can enumerate user accounts, groups, shares, policies, and password hashes, among other things. It is commonly used by network administrators and security professionals to identify vulnerabilities, but it can also be misused by attackers.
What is the NetBIOS-Domain Name of the machine?
What invalid TLD do people commonly use for their Active Directory Domain?
Task 4 Enumeration Enumerating Users via Kerberos
Download Kerbrute from Github.
What command within Kerbrute will allow us to enumerate valid usernames?
What notable account is discovered? (These should jump out at you)
What is the other notable account is discovered? (These should jump out at you)
Task 5 Exploitation Abusing Kerberos
We have two user accounts that we could potentially query a ticket from. Which user account can you query a ticket from with no password?
Looking at the Hashcat Examples Wiki page, what type of Kerberos hash did we retrieve from the KDC? (Specify the full name)
What mode is the hash?
Now crack the hash with the modified password list provided, what is the user accounts password?
Task 6 Enumeration Back to the Basics
What utility can we use to map remote SMB shares?
Which option will list shares?
How many remote shares is the server listing?
There is one particular share that we have access to that contains a text file. Which share is it?
What is the content of the file?
Decoding the contents of the file, what is the full contents?
Task 7 Domain Privilege Escalation Elevating Privileges within the Domain
What method allowed us to dump NTDS.DIT?
What is the Administrators NTLM hash?
What method of attack could allow us to authenticate as the user without the password?
Pass The Hash
Using a tool called Evil-WinRM what option will allow us to use a hash?
Task 8 Flag Submission Flag Submission Panel
Use Winrm to enter the Administrator account
Check the desktop of the required users to find the flags.
Leave a Reply