HomeGitHubPortfolioTwitter/XMediumCont@ct

1 - LO 1️

Learning Object 1

Tasks

1 - Enumerate following for the dollarcorp domain:

  • Users

  • Computers

  • Domain Administrators

  • Enterprise Administrators

2 - Use BloodHound to identify the shortest path to Domain Admins in the dollarcorp domain. 3 - Find a file share where studentx has Write permissions.

Flag 1 [Student VM] - SID of the member of the Enterprise Admins group 🚩

Solutions

1 - Enumerate following for the dollarcorp domain

Start InviShell and PowerView

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\Powerview.ps1

1.1. - dollarcorp.moneycorp.local Domain Users

1.2 - dollarcorp.moneycorp.local Domain Computers

1.3 - dollarcorp.moneycorp.local Domain Administrators

1.4 - dollarcorp.moneycorp.local Domain Enterprise Administrators

No results, we need to check if it's present into a forest, check it:

Great, now we can update our command adding monycorp.local and retrieve Enterprise Admins:

2 - Use BloodHound to identify the shortest path to Domain Admins in the dollarcorp domain

Using the pre-built search filter we can identify quickly the shortest path to Domain Admin

3 - Find a file share where studentx has Write permissions

First to all enumerate all computer of current domain displaying relative dnshostname and save them in a file

Load PowerHuntShares tool importing PowerHuntShares.psm1 module and run HuntSMBShares:

Don't run HuntSMBShares after starting PowerView

Lab Machine hasn't a network connection, so transfer file generated into our local machine using SMB tools folder share and open it via browser.

Checking into ShareGraph the AI share has the write permission for everyone:

AI

Flag 1 [Student VM] - SID of the member of the Enterprise Admins group 🚩

Previous0 - Lab InstructionsNext2 - LO2️

Last updated