Now in our challenge I was asking if you could go through the LDP.exe program to browse LDAP to see if you can find the actual non-Windows system.
Now I happen to know where it's at and I wanted to show you what it actually looks like before we start doing a couple of search methods.
Now inside of LDP.exe I am doing the tree viewer under view tree and I'm using the base DN.
And this is querying the domain controller on server1-vm and I am under the CN of computers at the top level.
Learner-virtual is the one that we're taking a look at here because I want to highlight it here and then show you there and zoom in.
Under operating system we have PC-Linux-GNU.
The reason I wanted to point this one out in particular is because Windows being native with Active Directory and all is really quick to update all the operating system information inside of Active Directory as you saw.
Because you could see Windows 10, Windows 11, Windows Server, etc.
But when it comes to POSIX based systems we don't always get all of that information because of a couple of reasons.
One, Windows just really didn't care because it's a POSIX based system and Linux is Linux is Linux as far as Windows is concerned.
Part two is that the POSIX based system, in this case Ubuntu, is not necessarily configured to do anything past just join the Active Directory domain.
So it doesn't know what information to send past what is only base required.
So it's only going to send just enough to be able to get onto the domain and be there.
And so when it comes to operating system as you see here all you get is PC-Linux-GNU.
So you know it's a POSIX based system but you're not really sure what type or how much further it goes other than it's just Linux.
And the same thing happens with Kali.
And that's why I wanted to bring this up in particular because if you so happen to get a Kali Linux box added to the domain this is all it's going to come up with.
So inside of Active Directory no matter how many rules you set up about this you're going to see that Kali will hide itself just by the simple fact that it's a Linux based operating system.
And Windows won't be able to sit there and differentiate between Kali and Ubuntu.
So you can hide broad daylight if you just so happen to get a Kali box added to the domain.
Now there are other concerns that that actually happens and so should be written inside of your executive summary at the end of this pen test.
But I just wanted to point that out and use our Ubuntu system as a prime example.
Now I happen to know that this is on the domain mostly because I added it when I was setting the lab up.
But also inside of the Ubuntu system if you run Realm list you can see that I have already added it to the domain under Texas test.
And it even gives you information concerning type Kerberos, Realm name, domain name and how it's configured and the server software is Active Directory.
So it just got the baseline whatever it needed to meet the minimum requirements to connect to the actual domain itself.
And as you can see it has all the right information but nothing really changes on here because when it comes to things like group policy for instance.
Group policy does not affect the actual POSIX based system like it does in Windows because Ubuntu is not looking for group policy when it connects.
So as an administrator this might be something to keep an eye on and limit use or contain them inside of their own OU.
As a pen tester this is a pivot point. I just want to point that out.
Now in the code box below I have the search string that we're using for our filter and if you notice we're at the base of Texas and test.
And what we're doing is focusing on the second portion of this because we've already searched for computers and Windows before.
I want to zoom in and show you what I'm talking about here is that in the operating system and specifically in the code box below is this and I'll follow along if you will.
Is that we are searching for Windows but with an exclamation point at the beginning of it which means not.
So we're searching for not an operating system that equals Windows. Basically everything else.
And if you notice that when we run this I already ran it and you can see over here that we have learner dash virtual which is the Ubuntu system inside of our domain.
I point this out because this is a way for us to be able to browse through Active Directory not only as a pen tester but something to keep in mind once we go back to the administrator and defensive side of the realm.
Now in the skill following this one I know we did everything manually here but next one we're going to be doing automated filtering and searching through Active Directory using scripts and such make things a little bit easier on us.
But I wanted to make sure that we had the basics down and understood how enumeration worked what we were doing and what data we could get from it before we started scripting everything and kind of losing the plot if you will.
I hope this has been informative for you and I'd like to thank you for viewing.