Previously in our previous skill we went through a manually enumerated out of Active Directory
and that gave us a whole lot of information and we expanded on ways that we could even go
further if we wanted to. Now all that being said manual enumeration does take time and while we
want to be as stealthy as possible whenever we're pen testing against any organization to avoid
capture time is kind of a balance because we only have so long per the rules of the pen test overall
yet at the same time we want to be able to achieve as much as possible and help the organization
secure even better and you know they may be already up there in the A plus category who knows
but that being said that manual enumeration took some time to be able to do and that's time that
could be better spent working on other things like more vulnerability assessments going in
and doing password cracking and finding systems that are hidden and exploiting those vulnerabilities
that you find in the other scans. So when we do enumeration it's one of those things that can be
automated very easily and in this skill we're going to basically take the same premise from
our manual enumeration and this time apply it to an automatic type field. Now there are some rules
and guidelines that we need to discuss and first and foremost is I've already been hitting on time
and the reason that I stress this is that even though we are scripting a lot of what we're doing
here it's still important to know that some of these scripts can't be run back to back to back
and we want to be as discreet as possible so it may be that you run one script here one script
there add a little bit of time in between and it may also help distinguish and identify if there
are any flaws in IDS and IPS detection on the network side of the house or even on the host
base side and when we step everything out and try to be as discreet as possible
it allows us to be able to go through and multitask when we're doing it using scripts
and that's the other thing here is that by scripting all this out it frees us up to do as
we previously discussed a whole bunch of other stuff. Now that whole bunch of other stuff is
contingent on a couple of things and this is where we get into the nitty-gritty as we did last time.
This is going to be done under the assumption that Eric was foolish enough to run dummy.exe
on one of his domain systems because we're keeping with the theme of what's been going
on throughout the course. There are absolutely other ways to do this you could be working on
passwords for credentials that you already know about and you may have you found that a user has
weak passwords and that's okay too but because I want to stay within the vein of what we've been
doing so far is that we already know Eric's credentials and we already know that he is a
domain user and nothing more. So when we run these scripts we'll be doing it inside of the client VM
that's on the Active Directory inside of our lab but we'll also be doing this through other
automated ways like Metasploit and we're going to be using Eric's credentials since we already
we already know those and just keep that in mind as we go throughout the rest of the skill
that we've already cracked one of the users but I will be pointing out along the way if there are
things that we can do using these scripts that may or may not take actual credentials to do.
In the last skill we queried the LDAP and we found that we can actually make a connection
to the LDAP with even without user credentials. It's when we start doing the more advanced queries
when we find that we need to bind against either 389 or 636 and that's dependent upon if LDAP is
using SSL or not domain configuration type stuff but you could still make that basic connection
and get basic information about the network itself. You don't need user credentials in the
domain to run let's say an NMAP or a vulnerability assessment because those vulnerability assessments
are based it off of the fact that we have just generalized access to the system as a non-privileged
user. So even if we did have Eric's credentials when we're running let's say OpenVAS against a
targeted system it wouldn't really tell us anything different than a privileged scan that
allows us to be able to go in and use administrative credentials to do so and that ties into the
automated enumeration. We're going to stay at the lowest level possible either with just domain user
or try to do this with no credentials because that way as a pen tester you can go in and make
a whole lot of discoveries without having to tip anybody off and you can take your time doing it
and spend your time or split your time up. I'm going to have a lot of these scripts available
in the VMs and I'm going to try to put them in the lab as well so please keep an eye out for that
as we continue. Now with all that being said let's go ahead and do it to it.