Hey, so now we're going to start getting into actually searching Active Directory use of LDAP, but I want to show you something first, and that is inside of our lab. We have the actual Active Directory domain controller pulled up and I have highlighted in their Eric who has the same password as everything else. So he had dollar dollar capital W or D. Now, as I go into Eric's account.
I'm going to go into member of and then show you real quick. So that way we know that there's no tricks up my sleeves on this. We have domain users Texas dot test slash users. So Eric is a domain user inside of this environment. Now, why are we going through this? Well, this is where we start tying in skills from previous in the course and getting to where we're at now.
So we can either say Eric had a weak password and we were able to infiltrate that user account or Eric is running dummy dot exe and we're using this information through Metasploit or and not yet. Well, that's part of the automation stuff.
Part of the automation stuff, but we were using his credentials since we know them because he ran dummy exe and we were able to get into a system as the workstation and we were able to get into LDAP. Now, the reason I bring that up is is because inside of LDAP is where we're going to be making our money out of this. Now, as we remember, LDAP is LDP dot exe inside the system 32 folder. Let's go ahead and double click that real quick.
And you can see that it is pretty straightforward. There's nothing in here, but that's because we have to establish the connection ourself. And do remember, I am running LDAP from the lab itself and not in the Active Directory environment.
We go to connection first, which is on our top left, and we're going to go into connect. At this point, we put in the IP address or you can use FQDN if you have DNS set up in your pen testing system, but IP address works best and you want to make sure that it is port 389.
Why not anything else? And why is there an SSL box there? Well, that's because some domains out there, not a lot, but some have the ability to also do LDAP secure. And you'll definitely see this on the DOD side of the house because that's kind of a default feature that they're required to enable for a variety of reasons.
But it uses a different port as well. So when you're doing your NMAP scan and you see port 636, LDAP TCP 636 inside of your NMAP suite, instead of 389, you know that you're using LDAP secure and you would have to use SSL. You can still do everything that we're doing here. You just need to know what the playground is that you're going into.
That being said, our domain controller, as we found out from our sweeps and being discreet and discovering everything, is 0.49. And we're just going to leave it at 389 with no SSL enabled because this is a default configuration.
Now, you can see here that there's a lot of information. And of that information, you can see that LDAP was opened at the very top over 389 and it was getting the information for the domain itself. At this point, you can tell the entirety of the FQDN. I'll highlight it for you right here, if I can highlight for you right there.
And you see that you have DC domain controller Texas and then followed by another DC equals test. So the FQDN of the domain is Texas.test. So the server that we're connected to 0.49 is server1-vm.texas.test.
And this is where you're putting the pieces together. And you can see that even lower at the DNS hosting. And I'll take a screenshot of this and post this below the video to make it a little bit easier for you to see because I know it's kind of pixelated a little bit as we're taking a look at it inside of our zoomit.
Now, that being said, since we already know Eric's credentials and we're wanting to get a little bit more information, we're going to have to bind this connection. And by bind, I mean use a user account. It does not have to be an administrator because everybody and anybody in the domain has to be able to see the directory structure in order to be able to know if they are allowed to use resources or not.
So under the connection tab, now you go into bind. Now you have a couple of options in here, but you really just want to bind with a do a simple bind. And at that point, you could just type in Eric and his password. So Eric and then P at dollar dollar uppercase W O R D.
And then at the very bottom, you'll see as a highlight here authenticated as Texas slash Eric. And because we have a user of the domain now bound inside of LDAP, we're able to communicate with the domain controller and get the entire bit of pieces of information that we're actually looking for. And that's what we're going to start diving into as we continue.
Now, you may be wondering, how is it that we actually search and figure out what it is that we're looking for here? Well, I'm glad you asked. You could even do one of two things. You could go up to the browse and go down to search, or you could actually go through and hit control S and come up with the actual search itself.
Now, we're going to do a simple search for computers within the Active Directory structure. And to do this, we need to identify the base DN or basically the top, the highest level or the top level that we want to search from.
So this is where that DC equals comes into play at, because as we know, Active Directory could be broken down into organizational units as well. But since we're at the top, we're going to say DC equals Texas. And I need to watch my text here because I'm trying to make sure that we're staying as clean as possible.
And then comma DC equals local. Now, our object class, we're going to filter by object class. There are a couple different ones that you could use in there, but we want to filter by object category. And the default is class.
So just go ahead and delete the class part and just type in category. And I'll have this for you below in the code box. And we're going to replace the asterisk with computer. And then we're going to run.
Now, you saw a couple of errors pop up on mine, and there's a reason I left that in there is because remember, I was mentioning the actual text and making sure it's clean. It is case sensitive. So basically, I just went up and copied the DC equals Texas comma DC equals test and make sure it was correct and then pasted it in there.
And as you can see inside the search, I'm going to zoom in for you here. We did this at top level. So it's going to list every single computer that's in the Active Directory structure, regardless of OU. And if it is inside of an OU, it will indicate such as I highlight an area for you and kind of give you an explanation here.
So we have server three that we're taking a look at here. And this is inside the container of the actual server three dash VM name itself inside the container of computers. If there was inside of an OU under computers, you would see OU equals in there as well too.
And then it falls under DC Texas and DC local and you get all the information about that particular system in the drop down below and all the information following that.
Last logon, supported encryption types, object category, object class, and then basically the account name that's listed as the actual computer itself according to actual Windows. So something like you would get an MBT stat or something along those lines.
And then or you would also get basically the overall information about it. So would you get an IP address in here? No, but you could get enough information to where you can like ping it or even further query the Active Directory LDAP even further later on for other stuff that will come up later in the skill.
Now below this, I mentioned in the code box below that I would have some sample queries and stuff like that. And I'm going to put in there other uses of it too. So that way you could find users, groups, and all sorts of different things that may or may not come up in the challenge of this skill itself towards the end.