HomeGitHubPortfolioTwitter/XMediumCont@ct

2 - LO2️

Learning Object 2

Tasks

1 - Enumerate following for the dollarcorp domain:

  • ACL for the Domain Admins group

  • ACLs where studentx has interesting permissions

  • Analyze the permissions for studentx in BloodHound UI

Flag 2 [Student VM] - ActiveDirectory Rights for RDPUsers group on the users named ControlxUser 🚩

Solutions

1 - Enumerate following for the dollarcorp domain:

Start InviShell and PowerView

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\Powerview.ps1

1.1 - Get the ACL for the Domain Admins group

Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs -Verbose

1.2 - Get ACLs where studentx has interesting permissions

No results, we can try to check student867's groups:

student867 is a member of RDPUsers group, so we can check interisting domain in ACL using that group:

1.3 - Analyze the permissions for studentx in BloodHound UI

Take a look at the 'Outbound Object Control' for the student867 in the BloodHound CE UI:

Search: STUDENT867@DOLLARCORP.MONEYCORP.LOCAL

and check node info into section "Outbound Object Control":

Flag 2 [Student VM] - ActiveDirectory Rights for RDPUsers group on the users named ControlxUser 🚩

We can filter the last task matching Control867User as ObjectDN and retrieve relative AD right.

Previous1 - LO 1️Next3 - LO 3️

Last updated