Hey everybody welcome to the next video.
So we've gotten access to the machine and we just happen and we happen to have a patched Tomcat running
as administrator which means it gives us straight to system access on a domain registered machine which
is good.
This kind of gives us an initial entry point to the domain.
However the first thing we're going to want to do when working specifically with an attacking a Windows
domain we're gonna want to look and try to find out.
Can we access a user.
And the reason for this is because there's a nice tool called bloodhound which we go over in the next
video that works pretty well at trying to figure out how to get to domain admin from what you have.
And the only way to do that is to have an initial user account in some way shape or form.
We don't have to have the password per say but we need the access of that user.
So what we're going to do is we're gonna go ahead and list the tokens we're going to dump the hashes
first and then we're going to list the tokens.
So so we'll do hash dump.
Now what's interesting here is the operation has failed.
The reason for that is because we are in a 32 bit process so when we attacked comp Apache Tomcat we
were accessing A's 32 bit process since this is a 64 bit machine.
We need to launch so as we can see appear 64 bit.
We need to access a process that is a 64 bit process.
So if we just take a look here find a system process let's do it let's do one log on right.
So we'll migrate over to PIB 1000
perfect and if we get you I.D. We are still system perfect and then we'll do hashed up.
Now what I want to do is take a copy of this admin hash because we might need it in the future specifically
because a lot of
the hashes hash a lot of admins tend to use the same username and password on the windows.
Local administrator accounts.
This is due to make automation and fixing things a tad bit easier now that we've gotten our hashes.
Let's go ahead and see what we can do what tokens are available on the machine.
So if we do load incognito perfect we'll do list tokens.
You so we can see here we've got AI user a local service local server network service system administrator
the windows manager and we look like we have Jay Smith.
So Jay Smith happens to be on the domain Red Team nation that is actually exactly what we want so we'll
go ahead and grab this.
We'll copy that.
And then what we're gonna do is we're gonna go ahead impersonate the user and that's as simple as impersonate
token and we pop in that.
But we need the extra slash in there to escape the first one.
Perfect.
So if we do get system or get system shall and we do.
Who am I.
It looks like perfect.
We are Jason.
So at this point we can start loading up a bloodhound and working with that and starting to get all
of that running into our lateral movement and gaining our next level of access.