So as you can see here, I actually went through and ran
sudo mpacket with the getusers SPNs again.
And I did it with Zaphod because you only need to be a user
within the Active Directory domain in order to be able to
enumerate the actual users from within the LDAP.
And that's essentially what we're doing here.
So if you wanted to, you could actually go a different way
and do enumeration through the actual LDAP itself,
like we've done in previous skills.
But I didn't find it necessary here and just ran the same command twice.
As you can see, it went through and found not only the actual
service account itself that we've done previously,
but it also found the actual target of what we're taking a look at here.
And that is svc underscore target.
I know, very creative.
So inside of here, you can see that we have the exact same printout type
that we got from the actual service account.
Now in this point right here, all I did for me was just copy this
and from where it was $KRB5TGS all the way down to the bottom of the output.
And I saved it to a new text file called target.
And that's how I did it.
And once I did that, I also went through and modified the short.txt
so that way it wouldn't take all day to guess this password
and added the password to it.
But I ran it against in John for the actual target file.
And as you can see, the actual password for the service account
that we're taking a look at here, the svc target, is WiffleBat.
And there ain't nothing fancier and more effective than a WiffleBat.
And that's really all there is to it.
Once we have gained access to the actual LDAP itself
and the Active Directory users and computers ability to list components
and do enumeration, we're past that ASREP portion of login in
and we can go in and start doing Kerberos attacks
to be able to get passwords for actual service accounts
or more specifically, high profile accounts
because service accounts have elevated permissions in order to run those services.
Or you could cripple the actual network itself
to do a little bit more stress testing on the overall environment.
Now, does this conclude our method of being able to go in
and break Active Directory? Absolutely not.
As you remember back in the beginning of this skill,
I've been jumping back and forth behind the scenes
between this skill and the next one
where we'll actually be getting into pass the hash
and also messing with the golden ticket.
So we can actually go through and do a little bit more deep dive in there
on how to mess with Active Directory authentication.
And I wanted to get the prerequisites kind of out of the way
so that way we had a better understanding of the Kerberos login process
and the actual components of that, what it covers
and prepare us for what's actually going to be happening next
because we'll see that our logins, the ability to get passwords
don't necessarily require us to be able to capture data.
We can do this a whole lot more effectively in different manners.
But with that, we'll close this one out and start moving along
into deeper dive so we can gain persistence in Active Directory.
I hope this has been informative for you
and I'd like to thank you for viewing.