I kind of want to start off by apologizing and that's because I'm actually recording two skills
at once. We'll be bouncing back and forth between this skill and the next one. Not in this skill,
but like behind the scenes recording wise. I'll probably be recording this video,
getting everything sorted out in the first section of this skill, and then bouncing over
to the next skill to work on that one. Because there's a lot of stuff that's going on back and
forth between this skill and the next one. The good thing though is that we're going to have
this all lined out to where everything makes sense from start to finish as we begin to close
out this course together. We're saving the best for last in this course and that is really attacking
Active Directory and stealing credentialing information and tying everything in that we've
learned thus far in the entire course in bits and pieces to be able to help us get to where we are
right now. But I do kind of want to give a little bit of a pretext for this because there is some
stuff that we need to understand. First and foremost, this is a lab environment. In this
lab environment, we've kind of pulled the safety controls off of everything and set this up in
accordance with making it easier for the learners and basically everybody inside of that lab
environment. That way we can go through and practice these techniques and prepare ourselves
for the real world that exists out there. What we do in these labs is not too far different from
the real world scenarios, but there are some considerations that we'll take into account and
I want to show you one of the primary ones here momentarily. See this? We're inside of our lab
here. Now I'm taking a look at the actual Hyper-V Manager and I will be zooming in and out to show
you what exactly I'm talking about. Primarily, we're talking about all these VMs that we have
inside of our Active Directory lab. Now if you remember there was a skill or two earlier on in
this course where this will seem very familiar to you and that is I'm monitoring traffic from
the actual VMs and sending it all over to Kali. I have a screenshot below that shows you kind of
what that looks like in port mirroring for the actual Hyper-V Manager. So if we take a look at
our client VM for instance and go to settings and go into the actual network adapter I'm going to
expand that and go to advanced features and then scroll so that way I can zoom for you and show
you where we're at here. What we're taking a look at is where it says port mirroring up yonder
and mirroring mode for the actual client VM that we do a lot of tests on that Windows 10 system
is is mirror mode source and the destination is going to be our Kali box and that's the screenshot
that I have for you below. Now the reason for all this is is because we're going to be doing some
pass the hash attacks and also messing with Kerberos a little bit and I want to make sure
that we have the capabilities to see this traffic pass back and forth. You see in an actual pin test
you would actually have some sort of network sniffer out there or ears to the ground on an
individual system. Let's say for instance that you have attacked a Windows workstation and you have
started copying traffic from them to you at one of your Kali boxes. Now yes this is going to raise
suspicion with those IDS and IPS systems but you get the general idea and to further add to this
in that by doing this particular course of action we'll go inside of our Kali box and I'll show you
what this looks like inside of the actual Wireshark itself. You can see there that I'm playing around
with something that's coming up not in this skill but the next one. Now inside of our Wireshark I
have a second NIC on the actual Kali system Ethernet 1. There's no IP address assigned to it
but if you go ahead and listen to Ethernet 1 in promiscuous mode what you'll see is a lot
of traffic going between those virtual machines in Hyper-V that we've already set source on all
the VMs and set Kali as our destination. So we can see here that we have a lot going on between
the Active Directory server and some of the other servers and clients and things like that.
Specifically if I go to my search bar and start typing in Kerberos you'll see that in
pretty much the last skill that we did where we were going through here and taking a look at the
actual traffic going back and forth for the TGS and the AS tickets for Kerberos authentication
you can see those tickets being passed back and forth between the client and the actual
server. What I did was is I recorded the traffic and then went to the actual client logged in as
Eric to the domain and while that traffic was going back and forth made sure that Wireshark
captured it and you could do the same thing in your lab environment as well. I just wanted to
make sure that we understood what exactly was going on here and why Kali had access to all this.
Again the difference between this and the real world is is that here in our lab we already have
it pre-positioned for us in order to see and capture all of this traffic but in the real
world we need to be able to stage this ourselves using the skills that we've learned throughout
this course already. So what does all this mean right here? Well between this skill and the next
we're going to be covering a lot of basic attacks for Active Directory itself. Up to now
we've gone through and learned how to bust into those individual systems, mess with some accounts
and even gain administrator access on some of these individual systems. But in order for us to
really gain that persistence of making sure that we never go away in our organization that we're
pen testing, you know while the pen test is actually going on, while it's allowed,
are we and all that stuff, that we have a way for us to be able to maintain administrative rights
for us to be able to go through and cause even more security testing. That's right, security
testing. So we're going to go through in this particular skill and start understanding the
hash behind the Kerberos account for getting everything ready for past the hash attacks.
We're going to do some passive harvesting which is why I started getting the network set up and
everything like that. And it's going to lead us into having a good foundation of doing the golden
ticket attack that's going to allow us to maintain that persistence inside of Active Directory as we
get ready to close everything out.