We just did some hand jamming inside of LDAP using LDP.exe and I've refreshed it here to show you
a clean copy of a brand new connection. And that's because that hand jamming that's not going to fly
all the time because that's a lot of typing that has to have perfect syntax all the time.
So I want to show you something new and that's where we go into the view and go into tree or
you can just hit control T. And when you go in there, you want to make sure that your base DN
is set to the actual domain or whatever level that you're at. You can go all the way down to an OU
if you want to, but generally I do this at the base level. So DC equal Texas, DC equal test.
We're going to click okay. And on the left, you see here that you have now have a expandable box
there with DC equal Texas. And that's because you can actually now start expanding this. And let me
move that over for you real quick. Like you would be inside of the normal active directory. So that
makes things a little bit easier. So like if we go into OU equal domain controllers, we can double
click on that and we can see the actual devices or containers, the CN, inside of the actual OU
of domain controllers. So top level be a test, next level be in Texas. There's actually Texas
dot test is top level. And then one down is the OU of domain controllers and CN server one
dash VM. And we can prove this further by going in and looking at the active directory itself.
There's Texas dot test and there's the OU of domain controllers and there's the CN server one dash VM.
Now I'm going to tell you all that to tell you this, you can get a lot of information based on
all the different systems by going in there and getting information about them. For instance,
I'm going to double click on CN server one VM. And you'll notice that we have a whole lot of
info that just came up. And if I scroll, look, move it all the way over, you can see that there's
two different ones here and you can double click on them as well. And all the information is going
to be on the actual right side as I move back over. And I may have to make this full screen for us,
but the overall CN is just going to give us the basic information that we've had already,
you know, operating system, which is right there. The actual SUID, GUID, SAM account name type,
you know, service principal names, what, where, where it's located last login time. This is all
great information, but if you go into it even further, you can actually get more configuration
information about this particular system as well, too. So I just wanted to show you that real quick
before we start moving into the actual networking portion of this. Now, I just showed you how you
could look at the actual domain inside LDP.exe as a tree viewer, but you can even go further
by looking at the different components of Active Directory itself inside the domain controller.
Let me show you. You click on view and you go to tree. And yes, we just did this, but wait,
there's more. You can add CN equals configuration comma, and then the rest of the domain DC
equals et cetera, et cetera. And then you can actually get into the configuration tree of
the actual domain itself. Now, if this is how it should, because now you're looking at the schema
and this is where we can get a whole litany of different information across the entire directory
domain itself. And so much so that I'm not going to go into the actual nitty gritty. I just want
to point something out very specific here. And that is if you go into the actual CN services
and you look through here and look at CN equals net services, and I'll take a screenshot,
don't you worry. Expand this over just a little bit and make this a little bit wider.
You go and see a CN equals DHCP root. Well, wouldn't you know it, this particular server
is a DHCP server inside the domain. If you double click on that, you can go in and I'll zoom in for
you. You can see that CN equals DHCP root, CN equals net services, et cetera, et cetera. And
it will tell you that this is a DHCP root itself and you should have the actual domain in there
also. Now, we know that we're on a 49 server one dash VM. So we're looking at the schema of
that particular domain controller and it should be the same. But if we were to connect to another
domain controller or even let's say like a read only DC that did not have a DHCP server on it,
you would still see this in here, but it would not identify it as a root. So that's just something
to keep in mind too, as we start our dive into understanding where these different things are.
So you could even go and double click on the actual CN server one itself. And you can see,
as I highlight here, right below it, you see CN server one dash VM. So if you were on a different
DC and you saw the DHCP root, it may list it for the directory or active directory itself,
but right below it would be the actual server that is the DHCP server and the actual IP
information as I'm about to zoom in for you right there. 192.168.0.49. And it gives you all the
information for that. Can you do anything with this? Well, yes, a whole lot of different things.
You know where the DHCP server is. You can start crafting packets. You can start sending in
DHCP requests and start scouting out for where that option is going through on the different
Cisco devices out there for DHCP requests. And it works on actual workstations too. I'm just
picking off Cisco just for a second, but this allows you to identify different server components.
And that's the same as any other components that you see in there as well too. Because let's say
you have a file server, you could start searching for that. You can start searching for other
different sites and services, and that would be right below that in CN equals sites.
And this is where we start breaking down where the actual locations of the different networks are
inside of Active Directory. Now, there are no sites and services configured inside of our lab
here. I just wanted to point this out because this is a location that you will need to refer
to sometimes if the domain that you're pentesting against is geo-dislocated over different areas of
the globe. Now, I'm going to tie this into the networking side here because I want to show you
real quick that inside of our view tree, you can go back to your base, the end of DC, Texas, and
local. And on the left, we're going to go into CN system down to CN policies. And inside of here,
as I zoom in for you real quick, you can see here that these are all the domain group policies.
Now, you're not going to be able to read the individual policies themselves, but let's say
that you were in client one VM on the domain and you were in Eric's account. You can then do a
group policy export and start being able to tie in based on the actual
CN number that you see there for machine and user because I don't have any group policy set
up in this lab. I just want to show you where they are and how to be able to find them and
see how they're applied to the different OUs within the actual structure itself.
Because using this right here, you can get a feel for where the policies reside and start
gaining more information as we continue in the course.