Category: Security Articles

Active Directory Hacking with Kali: Attackative Directory

OluwatobiLeave a comment

Introduction

For my fifth machine in the Active Directory hacking with Kali series, I’ll be pwning attackative directory from tryhackme. Attackative directory is an easy active directory machine that teaches the basics of active directory enumeration and ASREPROASTING attacks.

Recon

Initial Nmap scan

Detailed Nmap Scan

SMB Enumeration

Crackmapexec RID brute

Found some domain users

Save users into a text file

Try ASREPROAST on discovered users

We discover the user svc-admin is Asreproasteble and save the obtained hash into a file to be cracked

Exploitation

SVC-Admin’s password cracked with john

Let’s spray this password with crackmapexec, we have access to SMB

Enumerate share access with SMB Map

We have access to three shares, backups is a non-default share so lets check it out first

Interesting a credentials file… download locally and open

decode the base64 text

Try evil-winrm with back creds …

No luck..

Try dumping secrets with Impacket-SecretDump.py

We get admin hash!

Use evil-winrm to pass the hash and profit

Finding Your Feet in Cyber Security: Part One

Oluwatobi

My Motivation

Rewind three years, I was fresh out of the university, undecided on what do with my bachelor’s degree and knew next to nothing about Cyber Security. Truth is, like the average Nigerian graduate, my knowledge was limited to what I had learned in the classroom. In school, I was only ever interested in network functionality, implementation and security, and had never made any serious efforts outside of class. My curiosity about hacking computers led me to Cybrary (was almost free at the time) where I embarked on a journey to learn about ethical hacking and penetration testing (this didn’t end well). This culmination of self-study, multiple setbacks and the drive to learn provided me the bedrock needed to get where I was going.

I have barely just gotten my feet wet in the massive ocean that is Cyber Security, but lately, I’ve been asked quite frequently on how to get started, so I figured to turn it into a blog post. The following suggestions are as per my experience so far and the things that worked out for me. My two scents on this subject should only serve as a friendly advice rather than an ultimate winning formula.

Building Blocks

Before diving into Cyber Security it’s extremely important to identify which specialty or work role interests you, because, in numerous ways, cyber security is similar to engineering or healthcare. There are so many different paths you can specialize in, from digital forensics and incident response to penetration testing, security governance or security awareness. (trust me, there are way more than you think.)

Read more “Finding Your Feet in Cyber Security: Part One”