Enumerating Active Directory

Setting environment

set /etc/hosts

sudo vim /etc/hosts

└─$ cat /etc/hosts                     
127.0.0.1       localhost
127.0.1.1       kali
10.200.71.101   thmdc.za.tryhackme.com
10.200.71.248   THMJMP1.za.tryhackme.com
10.200.71.202   THMMDT.za.tryhackme.com
10.200.71.201   distributor.za.tryhackme.com
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

ssh connect

http://distributor.za.tryhackme.com/creds

Username: mandy.bryan Password: Dbrnjhbz1986

 
 ssh [email protected]
 whoami /priv
 
  PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

Set credentials for the network

runas.exe /netonly /user:za.tryhackme.com\\mandy.bryan cmd.exe

Check the connection and list the special dir SYSVOL(GPP)

dir \\\\za.tryhackme.com\\SYSVOL\\ 
 Volume in drive \\\\za.tryhackme.com\\SYSVOL is Windows 
 Volume Serial Number is 1634-22A9 

 Directory of \\\\za.tryhackme.com\\SYSVOL

02/24/2022  09:57 PM    <DIR>          .
02/24/2022  09:57 PM    <DIR>          ..
02/24/2022  09:57 PM    <JUNCTION>     za.tryhackme.com [C:\\Windows\\SYSVOL\\domain]
               0 File(s)              0 bytes
               3 Dir(s)  51,591,741,440 bytes free

Connect RDP

xfreerdp3 /v:10.200.71.248 /d:za.tryhackme.com /u:mandy.bryan /p:Dbrnjhbz1986 /dynamic-resolution

Enumeration

Net Commands for Operating Systems - Windows Server

net users /domain
net accounts /domain
net user /domain