Attacktive Directory

Prompts and answers

• What tool will allow us to enumerate port 139/445?
  enum4linux
• What is the NetBIOS-Domain Name of the machine?
  THM-AD
• What invalid TLD do people commonly use for their Active Directory Domain?
  .local
• What command within Kerbrute will allow us to enumerate valid usernames?
  userenum
• What notable account is discovered? (These should jump out at you)
  svc-admin
• What is the other notable account is discovered? (These should jump out at you)
  backup
• We have two user accounts that we could potentially query a ticket from. Which user account can you query a ticket from with no password?
  svc-admin
• Looking at the Hashcat Examples Wiki page, what type of Kerberos hash did we retrieve from the KDC? (Specify the full name)
  Kerberos 5 AS-REP etype 23
• What mode is the hash?
  18200
• Now crack the hash with the modified password list provided, what is the user accounts password?
  management2005
• What utility can we use to map remote SMB shares?
  smbclient
• Which option will list shares?
  -L
• How many remote shares is the server listing?
  6
• There is one particular share that we have access to that contains a text file. Which share is it?
  backup
• What is the content of the file?
  YmFja3VwQHNwb29reXNlYy5sb2NhbDpiYWNrdXAyNTE3ODYw
• Decoding the contents of the file, what is the full contents?
  backup@spookysec.local:backup2517860
• What method allowed us to dump NTDS.DIT?
  DRSUAPI
• What is the Administrators NTLM hash?
  0e0363213e37b94221497260b0bcb4fc
• What method of attack could allow us to authenticate as the user without the password?
  Pass The Hash
• Using a tool called Evil-WinRM what option will allow us to use a hash?
  -H
• svc-admin
  TryHackMe{K3rb3r0s_Pr3_4uth}
• backup
  TryHackMe{B4ckM3UpSc0tty!}
• Administrator
  TryHackMe{4ctiveD1rectoryM4st3r}