circle-check
Visit official github page
Certified Red Team Professional (CRTP) - Notesarrow-up-right
search

vial1 - Learning Object 1️

hashtag
Tasks

1 - Enumerate following for the dollarcorp domain:

  • Users

  • Computers

  • Domain Administrators

  • Enterprise Administrators

2 - Use BloodHound to identify the shortest path to Domain Admins in the dollarcorp domain. 3 - Find a file share where studentx has Write permissions.

Flag 1 [Student VM] - SID of the member of the Enterprise Admins group 🚩

hashtag
Solutions

hashtag
1 - Enumerate following for the dollarcorp domain

Start InviShell and PowerView

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\Powerview.ps1

hashtag
1.1. - dollarcorp.moneycorp.local Domain Users

Get-DomainUser -Domain dollarcorp.moneycorp.local | select samaccountname

hashtag
1.2 - dollarcorp.moneycorp.local Domain Computers

hashtag
1.3 - dollarcorp.moneycorp.local Domain Administrators

hashtag
1.4 - dollarcorp.moneycorp.local Domain Enterprise Administrators

No results, we need to check if it's present into a forest, check it:

Great, now we can update our command adding monycorp.local and retrieve Enterprise Admins:

hashtag
2 - Use BloodHound to identify the shortest path to Domain Admins in the dollarcorp domain

Using the pre-built search filter we can identify quickly the shortest path to Domain Admin

hashtag
3 - Find a file share where studentx has Write permissions

First to all enumerate all computer of current domain displaying relative dnshostname and save them in a file

Load PowerHuntShares tool importing PowerHuntShares.psm1 module and run HuntSMBShares:

circle-info

Don't run HuntSMBShares after starting PowerView

Lab Machine hasn't a network connection, so transfer file generated into our local machine using SMB tools folder share and open it via browser.

Checking into ShareGraph the AI share has the write permission for everyone:

circle-info

AI

hashtag
Flag 1 [Student VM] - SID of the member of the Enterprise Admins group 🚩

Previous0 - Lab InstructionsNext2 - Learning Object 2️

Last updated