Part 2: Hacking Active Directory - (StellarComms)

Part two of the Stellar Coms AD lab shows how to turn a found default password into a foothold, then use BloodHound to map an attack path to domain compromise 2:13-2:57.

Key Takeaways:
• Net Exec SMB confirms junior.analyst/galaxy123! works, granting initial AD access 2:13-2:57
• BloodHound ("Google Maps for AD hacking") maps attack paths; Net Exec's LDAP collector pulls domain data (DNS flag needed) 4:19-7:16
• Saved Cypher queries reveal Kerberoastable user SATLink Services with DCSync privileges—compromising it means dumping all hashes, including KRBTGT 15:44-18:18
• junior.analyst has WriteOwner over Stellar Ops Control group, allowing ownership takeover and self-addition 19:59-22:19
• Full chain: own the group → add self → ForceChangePassword on ops.controller → WinRM shell via Remote Management Users 22:29-24:39
• Viewers are challenged to attempt the attack path themselves before part three 24:44-25:42

The video shows how one weak default password escalates through chained AD misconfigurations to full domain compromise, with BloodHound visualizing each hop.

Sources:

• 2:13-2:57 Validating credentials with Net Exec SMB
• 4:19-7:16 BloodHound intro and LDAP data collection
• 15:44-18:18 Kerberoastable user with DCSync
• 19:59-22:19 WriteOwner over Stellar Ops Control
• 22:29-24:39 ForceChangePassword and WinRM path
• 24:44-25:42 Recap and viewer challenge