Some of the prerequisites we need to get out of the way
is a better form of enumeration of accounts
and other bits of info from the domain
that we're about to be playing with.
Now, I want you to know that some of these
could have been coming in real handy in the last skill,
but they were moved here,
and actually they happened about halfway through the skill,
but they were moved inside of this skill
because it pertains to the golden ticket stuff.
And I wanted you to be more familiar
with the ASREP and TGSREP techniques.
So that way, if you started off
with a little bits of information,
you could build upon that as you made your way
through the actual target network and organization.
So what we're taking a look at here
is our actual terminal window inside of Kelly.
And one of the first things that we can do
since we have bits of info about our domain already
through our recon and enumeration bits
and looking at client computers,
however you want to put that together
for storytelling purposes,
we're gonna be using sudo impacket,
but this time look up SID.
Because one of the things that we're gonna need
in order for us to be able to complete
the actual creation of a golden ticket
is the SID of the domain itself.
Now, SIDs should be common terminology to us.
They're the basic identification number
assigned uniquely to accounts,
not just the actual users or computers,
but in this case, the actual domain itself.
The reason this is is because it's possible out there
that there's multiple domains that are geo-dislocated,
not even tied into the same network,
but have the same domain name.
Let's say test.local is a very common name.
But that being the case,
so next we want to say look up the SID for texas.local,
and we're going to forward slash and use Eric in this case
since we already know Eric's password.
And we're going to be using at the actual IP address
of the DC, or it could be any DC
that you know the IP address of within the organization.
In this case, 0.49.
And when we run this, it's going to be asking
not only for the pseudo password, but also Eric's.
And that's P at dollar dollar capital W-O-R-D.
And whenever this is ran,
not only are you going to get the SID
for the actual domain itself,
but also all the users that are within the organization.
And you may notice too that we have
our service accounts down here that we created
and were able to do Kerberos-ing against
in the previous skill.
Now here is where we actually have our SID
for the domain itself.
And you can see that it looks like a normal
as I highlight that and zoom in for you.
It honestly looks like a normal SID.
So if you were to just look at the SID by itself
with no other context of information,
you would just look at this and think,
ah, it's just a user's SID.
But, you know, that's not the case.
Now, the reason that you have all the other numbers
with the actual accounts below this
is because at the end of the domain's SID,
you have a dash and then let's say 498
would be Texas slash enterprise,
and then 500 would be Texas slash administrator,
but that would be appended
to the actual domain's SID as well.
Now, fun fact, this is where that whole SID comes from.
This is just one of the first portions of it.
So now that we have that information,
it'd probably be nice if we had some different
avenues of approach to be able to get this
just in case we can't run this against
the domain using mcap or mpacket for whatever reason.
And for that, we're going to be taking a look
at another method of doing this inside of MSF console.
Again, all commands below,
but here we're going to be using auxiliary scanner
for SMB and then we'll be using the SMB lookup tool for SID.
Now, inside of here, if you're like me,
don't be afraid to always do your show options
to make sure that you understand
that there are certain things that are going to be required.
This is just using your basic SMB port.
So TCP 445, and unless there's something catastrophic
that we don't know about,
this should be open on all domain controllers
because you have to have those standard default shares
within the domain itself.
Now the R host, which we are going to set by set R host
is going to be the IP address
of the actual domain controller,
or it could be any of the others.
So in this case, 049,
then we'll set the SMB domain to texas.test,
set the SMB user,
and this is where again,
we'll need the actual user that we've infiltrated.
And it could be just a regular domain user
like Eric is inside of there.
And then we'll actually set the SMB password for that user.
And you can sit and type this in plain text
and it not be a problem
because it's not your password to worry about.
Now, when you run this by simply typing run,
it's going to check default RIDs
or different versions of SIDs,
but right away it's going to give you the SID
for the actual domain itself, which is right there.
And I'll zoom in for you to show you what this looks like.
Now, if you want to sit around and wait,
which I will fast forward to when this completes,
you'll get more information about the domain overall
when this completely runs,
but this is just one of three ways
we can actually get more information
about the domain, specifically the SID.
And I told you we fast forward through this
because as you can see here,
it is a little bit prettier of a printout
as far as the data is given to us for the actual users,
because it distinguishes between
whether it's a user or a actual group.
And based on that, you can also go down
and see that some of these are aliases.
And again, this is shooter's preference,
if you will, for those army folks out there.
And then we have a long shot.
I want to show you inside of PowerShell here.
If you're running it inside of PowerShell,
you have the Active Directory tools loaded
and modules for PowerShell loaded.
And by that point, if you have enough permissions
to do that and gain access to the data
within Active Directory, at that point,
don't you already have enough access
to do what you need to do?
So that being said, again,
the command is in the code box below.
This is just a simple get ad domain, domain SID value.
And this is just a straight output
of the actual domains SID.
So that way we can use this moving forward
for our get the golden ticket exercise.