OK.
Now let's configure our domain controller and we're gonna configure some policies create some users
and just take a general look at Active Directory.
So on your domain controller go ahead and log in.
Remember here that this is the clunky password that we set up with a capital P at $ dollar lowercase
W 0 R D exclamation.
This should be your administrator password.
So from here we are brought again to this server manager dashboard.
Now let's go ahead and click on tools up here and we're going to select Active Directory Users and Computers.
So go ahead and select that.
And if we click into this marvel that local here you can see we have a few different o use.
These are organizational units.
Now we've got built in.
We've got a bunch of built in security groups here.
We have computers.
If any computers are joined to the domain they will show up here.
We've got our domain controllers which is Hydra dash DC and we've got other things here we've got manage
accounts which you know have any foreign security principles or have any of those.
And then users.
So we've got security groups in here.
I like to describe a new group and we can just like right click in here and say new and then say group
or organizational unit actually.
And then we can say groups something like this say OK.
And then I like to take all these groups out of the users accounts and then kind of drag them over and
say Yes that's fine copy these drag these over say yes that's fine.
And now we've got it nice and cleaned out for our users area.
Now note this little down arrow next to guest.
You see a down there on account.
That means that the account has been disabled so from here we have our administrative user.
We could double click on that.
We can provide all kinds of little properties descriptions etc. We can pick what groups this person
is a member of.
So you can see that the administrator is a member of domain.
Happens which means that they are an administrator.
Enterprise admins as well schema admins and domain users.
So if you're a domain user that means you are able to log into the domain.
So we're going to create a couple of domain users and we'll create another domain admin as well or two
and just give an idea for what these accounts are going to look like.
So first let's go ahead and just right click and we're going to say new and then we're going to say
user and I'm going to go ahead first and create Frank Casserly.
So I'm just gonna say Frank Castle and then you're gonna want to pick your naming convention here.
So I'm just going to say f castle like this first initial last name.
Go ahead and hit next.
And then here you're going to pick a password.
I'm going to give him password one again just like I did before.
And then I'm going to say the password never expires.
This is bad.
I'm not going to have them change the next log in.
Not going to say the user can change the password should just be like that.
Finish and then you go OK.
So let's create a another user.
I'm going to right click on administrator and I'm just going to say copy and here I'm copying a domain
admin.
And so what's going to happen.
Let's create another user we'll say Tony Stark Tony Stark is going to be our domain admin we'll say
Stark hit enter for next and we can give him a more complex password if you want.
So I'm going to give him something like password 20 19 exclamation at Symbol pound sign.
It's not great by any means but it's a little bit better.
And then we'll the save password never expires next.
Finish OK.
Let's create two more users so let's create this user here.
And we're going to right click on Frank Castle we'll say copy and on this one we're gonna give we'll
say spider man we'll say Peter Parker and Peter Parker here OK.
And then we can have a different password for Peter we can to say something like password two and then
password two again OK.
Password never expires.
Good.
Next.
Finish in just to show you what's going on.
So let's click into Peter Parker.
You can see Peter Parker's just a member of domain users because we copy that property from Frank Castle.
Now if you looked at Tony Stark you could see that Tony Stark is a member of all the same group as this
administrator because we copied that from the administrator.
So Tony Stark is a domain administrator which is exactly what we want right now.
So we're going to create one more user.
Let's go ahead and create a fake sequel account.
So we're going to right click and we're going to copy Tony Stark and we're going to do a no no.
We're gonna make this sequel service account a domain administrator.
Now your service accounts should not be domain administrator accounts but I would say probably 70 percent
of the time that I'm doing a penthouse the service accounts are domain administrators and I'll show
you why here in just a few videos why is bad when what we can do to attack those service counts that
are domain administrators.
So from here let's just call the sequel service something like this and we'll just call this sequel
service just like that.
OK.
And we'll hit next and then on this we're going to give it a password.
I'm going to give it a password something like my password and we'll just call it one two three pound
my password.
Actually I'm messing this up so I'm going to give you a syntax capital M capital Y lowercase password.
One two three pound capital M Y lowercase password.
One two three pound.
Go ahead hit next and finish that so if you needed that one more time I'll open up a notepad and that
is my password.
One two three pound.
All right now I'm going to open up the secret service user and in the description let's say that I forgot
the password or just say password is and then we'll just say something like my password.
One two three pound.
Now you'll see why this is bad later on but a lot of domain administrators like to put passwords of
their service accounts in the description because they think that they are the only ones that can read
them.
Not true.
We'll see how we can read this later on.
But for now.
Well the safe password is my password one two three pound.
And we got a few users in here and we've kind of got this setup.
So this is good to go.
Let's go ahead and do a couple more things.
So let's go ahead and set up a file share.
So click on this down here.
And if I click on that to fast file and storage services under server manager and then we're going to
click on shares right here and then there's a task up here at the top.
Go ahead and just say new share and we'll just select SMB share quick share location is Hydra D.C. that's
fine C drive and we'll just say the share name is going to be hacked me something like that OK hit next
next next we're just going to use all defaults create and clothes.
So now we have this C shares Hackney share.
Why do they just do that.
Because most domain controllers have file shares and we've talked about this before but we wanted to
open up one thirty nine for forty five so that we have S&P enabled on this domain controller.
So if we were to scan against it we would see that there is one thirty nine for forty five and we can
leverage some attacks against this and we're going to enable that on our machines as well when we're
searching or having file shares on our on our personal user computers as well.
So for now this is good.
And we're going to do a couple more things.
So let's go ahead and let's open up a command prompt.
So go ahead and just type and command and run that as an administrator
and we're going to create what is called an SBN service principal name.
And don't worry too much about what we're doing right now.
We're going to talk about this way more when it comes time.
And we're going to talk about the attack related to this.
We're setting up an attack for Kerber roasting and that is an attack that attacks services.
OK.
So we set up the Secret Service.
We're going to attack the sequel service but we have to set up a service principle name which will cover
a bit later on in the course.
So first let's go ahead and get that set up so we're gonna say set SBN And then we're going to do a
dash a.
And we're going to say Hydra DC or whatever you named your domain controller.
And then we're gonna say sequel service whatever you named your sequel service should be the same as
mine.
Dot Marvel dot local like this and then we'll pick a port.
I'm picking 6 0 1 1 1 and then we're going to say Marvel like this and then we'll say sequel service.
So again set SPF and dash.
A hybrid AFDC which is the computer name sequel service stop Marvel dot local port of 6 0 1 1 1 and
then Marvel sequel service hit enter and then it's going to say checking it registering it and updated
that object.
Perfect.
Now let's make sure that it is set.
So we're gonna say set SBN dash capital T.
And we're going to say Marvel dot local like this dash Q And then a wildcard forward slash wildcard
hit enter and down at the bottom you could see that the sequel service has been set hydra a DC sequel
service stop marvel that Local 6 0 1 1 1.
Perfect.
Okay.
So now we have set up our users we have set up our Kerber roasting attack.
We have set up our SMB shares.
There's one last thing we need to do.
Let's close that.
Let's come in here and let's start typing in group policy so we've got group policy management here
right click and run as administrator and you could see that we've got the forest here of marveled that
local.
Go ahead and drill down into domains and you see marvel that local here I'm going to go ahead and right
click and say create a GPO in this domain and link it here in this GPO is going to be called disable
Windows Defender.
All right.
Now hit enter and I realize that some of you are going to be wondering why we're disabling Windows Defender.
So let's talk about this.
There are many courses out there that show you antivirus evasion and bypassing and I think it's great.
And it is important to know those topics.
The reason why we're not going into that in this course is because it changes so significantly so quickly.
A lot of these attacks are still going to work regardless of the antivirus that you have.
Most of these attacks are going to work.
So what is important is to know the fundamentals of the attacks.
If I show you a the invasion today within two to three months it's going to be obsolete and I hate to
have that in of course and then have people get upset or frustrated that it's getting detected because
it's always changing.
So I'd rather show you the foundations and the fundamentals and then let you learn the A.V. bypassing
as the techniques come up as the time changes.
Remember being good penetration tester is about sticking with the times and staying up to date as long
as you're staying up to date.
You're going to be fine knowing the foundations and the basics are way more important at this stage
than any Avey evasion or crazy fun technique like that.
So please bear with me.
We're gonna get through this and we're going to disable defender.
We're gonna work on all these attacks learn the basics and then you can improve upon that from there.
So go ahead and right click on this disable Windows Defender here and select edit and then we're going
to navigate in this computer configuration right here.
We're gonna click on computer configuration and we're going to go into policies and we're going to go
into administrative templates and we're going to select windows components down here and then if you
scroll all the way down there's going to be a Windows Defender
and we've got Windows Defender right here on antivirus and we're gonna click on that and then we're
going to turn off Windows Defender antivirus DoubleClick and it is going to select enabled here OK.
And then we are going to apply and select OK.
Now let's also go into Windows Defender exploit guard and see if there's any protections that we need
there's not defend a smart screen no detections that we need either.
So as of right now we are good.
We've got defender turned off.
We have the policy enabled.
So once we actually join our domain pieces to the domain we will have no windows defender enabled on
them which is perfect.
That's how we want to attack this.
So now let's go ahead and close this and we have successfully configured this part of our course.
What we're going to do next is we're going to finish setting up our pieces are user pieces we're going
to join them to the domain and we're going to enable some file shares on those and then we ready to
start attacking those some very very excited.
Once this lab is built we're going to be ready to roll.
So I'll see you over the next video when we join our pieces to the domain.