Part two.
Let's do this.
So here we are.
We have our user account and our password.
Now what can we do.
Well we can try to get on an account.
We can say something like we can say what P.S. exact pi and we can say active that HDTV and then it
was actually forward slash service TGIF like this and then we can just copy this password paste it here
and say at ten ten ten to one hundred and see what happens.
Nothing's right.
OK so we have valid user credentials but not readable.
Well what is an attack.
We talked about very very recently that we can use with user credentials and the TSA might have tipped
it off.
What about Kirby roasting.
Remember the TGA is the service ticket.
Well when we say service ticket we think well maybe that's Kerber us saying maybe we need to get a service
here.
That's kind of a tip.
And so we can do the get users SPF ends.
Right.
And we can say again we can say active HDTV and we say service to GSK just like this pace.
This will more time and we'll do DC IP of the same box address and then we'll just say request and then
look what happens.
This comes through.
Let's go ahead and make this a little bit bigger actually blow this up completely.
And now you can see that we have a service ticket here so I'm going to copy this service ticket and
I'm actually going to open up my hash cap folder live here.
Open up hashes for and we have our old one.
I'm just going to paste that in.
Save this ticket and I'm going to open up a command prompt and we're going to do this together.
So maybe a command prompt.
We're going to try to crack this.
So I'm going to see into my desktop slash hash cap and then a task at 64 that you see a module of 13
one hundred hashes for text and rocket attacks with a capital O.
Just like that.
That should be all familiar refreshers.
I'm going through just a little bit faster.
Hit enter and let's see what happens
should only take a second.
And look what came through Ticketmaster 1968 is our password.
We have successfully Kerber posted this account and you could see here that it is the administrator
account.
Oh that's lovely.
I love when the administrator is a is a service account.
So now let's just do an administrator like this case this in here and try.
Yes exact pie one more time.
It found the right evil share of admin.
And now we have who am I.
Authority system hostname active or D.C..
And we took down this box.
Easy as that.
So hopefully this was a fun challenge hopefully you actually tried it.
If not just get your wheels spinning if you have a credential and it doesn't have to be a it doesn't
have to be a credential that can get you onto a machine.
We could have a situation where this is a low level user or they just don't have local admins on their
machines so P.S. exact S&P exact w my exact.
None of those are working but we can try attacks like Kerber roasting on the network or we can try attacks
like the GP password attack and see if we can't find stored credentials somewhere.
So these are great attacks that we can try that are just default Windows kind of stuff.
So from here we're going to go ahead and talk a little bit about Mimi Katz.
We'll talk a couple of different ways we can utilize it in the network and wrap up this section so we're
almost through active directory I feel sad it feels like it's coming to a close but they're excited
to talk through Mimi Katz next so let's go ahead and move on to that video.