So to begin this attack we need a few things here.
We need man in the middle six are going to go ahead and just say and my team six and we're going to
say it domain name my domain here is Marvel dot local.
So we'll do a domain a marvel that a local will spin that up and we're going to just start getting replies
coming in from different devices in our network.
OK.
So from here what we need to do is also set up a relay attack.
So now that relay attack is going to look something like this NPL and relay X stop pie.
This should look familiar.
We're going to do a dash six because we're only going to work with IP six.
We're going to do a dash T for our target and our target is going to be V L that secure.
This is why we set up that certificate we could have done all that.
Most environments have that certificate running so it's important to do all that secure.
And we're just going to point this right at the Domain Controller.
So whatever your domain controller IP addresses mine sitting at one forty four This w h word is going
to use a W pad so I'm going to call this fake w pad dot Marvel dot local and then we're going to do
a dash L and I'm just gonna call this loop me dash L is for loot.
So we set up loot we can dump out some information that'll be useful to us and we'll see how that works.
So let's go ahead and just hit enter on this and this is still getting some spoof replies but we're
going to speed this along.
So I'm going to go ahead and go over to my Windows 10 machine.
I'm just gonna reboot this sucker and this is going to allow us to see this in action.
What's happening is ITV 6 is sending out a a reply right.
And it's saying Hey who's got my who's got my DNS.
And it sends it out about every 30 minutes I believe.
So what we're gonna do is we're just going to speed it up by shutting a computer down and then restarting
it.
It's going to actually go ahead and make this go a little bit faster.
So we're going to try to authenticate when we restart it's going to try to authenticate first as the
Punisher machine.
You could see this by the Punisher dollar sign and you could see that it's enumerating the relay credentials
it's going to take a while on large domains that's fine.
And it's just succeeding right now.
It's trying to see what kind of privileges it has right now.
So might take a minute and it's dumping any info into the loot Dir.
So if we open this up let's see if there's anything in here right now.
We can go ahead and just say yes and there's this loot me folder so we can see in the loot me.
And this is so exciting.
So look at all this here domain computers domain computers but operating system by just domain computers
domain groups domain policies domain trusts domain users by a group.
Now I love this because we can come in and we could say something like Firefox I want to see the domain
users by group and we can just look at the Domain users by group and I'm right after the domain admins
on top of that.
You know when you have a crappy kind of admin going on.
What about the sequel service that we set up.
And remember when we put in the description that password is my password 1 2 3 0.
You know people think that these descriptions aren't visible.
And look we we it's visible to us and we barely did anything right.
We just succeeded with an account we succeeded with a computer.
The computer was capable of accessing this domain controller via L that s logging into it and dumping
out any useful information to us.
That's scary right.
We have all this information our hands now.
We can see who the domain administrators are.
And in enterprise admin who are the users are who do we need to attack in this environment for this
to work in our favor.
Now let's do one more thing.
Let's go ahead and go into our windows 10 machine and we're just going to say password exclamation like
this and you're going to see what's going to happen.
So let's go ahead and my mouse will come back to me we'll go ahead over here in here shortly it should
attempt to log in as this user and we'll see if it works.
And there it did.
And it's so fast it just blazed through let me go ahead and control see.
So what just happened here an ad they logged into a computer.
That's what happened.
That's it.
And you can see the administrator logged in somewhere on this network.
It succeeded.
It targeted all that.
OK.
And then it comes through and it tries to make a new user for us first it sets up an access control
list for us.
And that's awesome.
And then it tries to create a new user and then it says hey adding new user and here's a user name and
here's a password.
OK.
Now we own this domain because what it's going to do is it's going to try to go in and it's going to
try to grab all this information for us.
And it's it's amazing what we can do.
So let's say this information out and just see how it works.
Another thing.
Look at this.
Let's go ahead and go to our domain controller.
If we go to our domain controller here and we go to our users and groups let's refresh it.
This is before the attack.
Let's go ahead and do a refresh really quick if I can find the refresh button or all this refresh from
here.
And now look the NF SMG whatever this user is now in here and there are domain user but they set up
a policy for us to have exclusive privileges with that access control.
And what happens is if we actually control see and we just see these dot dot we Alice it puts this ACL
pone restore here so we can actually restore the ACL to what it was before.
But as of right now it's allowing this user through and a special ACL that was created with this with
this attack here.
So this is a fantastic attack and this isn't the only thing that it can do.
It does so much stuff.
I'm going to actually link down below.
Some amazing things that you can do with this.
And I want you to read up on this because it's so fantastic.
So I'm going to put this in here.
Paste this real quick and just scroll down a little bit and show you this blog post and this is one
of the ones I use all the time so you can run this man the middle six with what is called the delegate
access and say for example that you can't get an administrator to work maybe this computer succeeds.
Look at this.
I caught W. 10 dollar sign succeeds.
You can still add a new computer not just a user a new computer with the user name and password and
you can utilize that to attack the computer that authenticated you.
You can impersonate users on that computer that you use to set that up with.
It's an awesome attack.
It's called delegate impersonation or delegate access and it is it's amazing.
So I do recommend checking this out again I'll put this down in the resources below.
Great blog.
So that is it for this attack and the next video.
We're going to cover how to actually defend against this attack and what you can do.
It's fairly simple but we'll still cover it.
So that's it.
I'll catch you over in the next video.