I'm going to take a look at a couple of these that caught my eye. One of them is AV,
and if I'm thinking correct, that is the check of antivirus on that particular system.
You can see that it is. This gives us a lot of information about that particular
system that we're on right now and not necessarily anything else on the Active Directory itself,
but it's also a good bit of piece of information to note.
Now that being said, I would like to go in and see what the domain underscore tokens is.
If we run this, you can see that we have a few different things going on here.
Let me scroll up to the top so we can take more of a detailed look at it.
Account in local groups with domain context, and it gives you a list of users there,
administrators and users, and tells you what group they're in and if they're a domain admin.
Well, that may or may not be accurate to that particular system,
because I'm showing false on domain admin. That's not right.
But you also get processes running under domain users, and if it is a domain admin. Now,
none of these are running under domain admin, but it does give you the PIDs along with the fact
that who's running them. So if you had multiple users on this system, you can see not only the
other PIDs, but the account name that it's falling under with the domain in front of it,
the NetBIOS domain name. Then down at the bottom, you can see impersonation tokens
with domain context. Now, impersonation tokens is something we'll definitely come back to,
but I wanted to point this out for a second because these two
users are this one particular user that's logged in domain Eric has a token on this system through
Kerberos login. And based on this token, Eric, the user on that domain is able to go in and log in
and do whatever he needs to do and access resource services and stuff. But if we're able to capture
these tokens, but potentially we're able to go through and do a whole lot more stuff on the
domain overall, not just have to go through and crack passwords because cracking passwords takes
time. But when you're doing enumeration and you're seeing things like this on the particular system,
not only does it give you more possible pivot points within the architecture of that organization,
but it also gives you more viable options for being able to have backup methods of getting
back yet in case that primary method gets messed up. Now, knowing the different methods
of enumeration and the type of information that you can get from enumerated something
plays directly into where we're going in the next couple of skills. And it is starting to perform
attacks on Active Directory based authentication. Now it's something that's going to be a little
bit time consuming and requires a lot of patience on on our part, because sometimes
passing the hash is easy. Sometimes it's not. Sometimes getting the golden ticket is easy.
Sometimes it's not. But it plays into how much research we're doing on these different systems,
because I've been a victim of trying to crack into a computer that's not even online and not
even in the domain because I didn't do my proper research in enumeration. And that was on my part.
Now, that's something I've learned from and has taught me that research, research, research,
and always go in and make sure those systems are actually there and running and get as much info
on them as you can. Recon in the pentesting life cycle. I hope this has been informative for you,
and I'd like to thank you for viewing.