Hacking A Bank... (404 Bank - Part 2)

[BLUF]
This video demonstrates the second phase of an Active Directory penetration test on the "404 Bank" lab, focusing on initial access through username enumeration and password spraying to compromise the user Carl Hackerman 2:15-3:00. The presenter then collects and ingests BloodHound data to map out potential attack paths within the domain 12:00-13:00.

Key Takeaways:
• The attacker first generates a list of potential usernames based on known employee names using a Python script, then uses the curbroot tool to enumerate valid accounts against the domain controller, identifying robert.gra and carl.hackermanman as valid users 5:10-8:20.
• To avoid account lockouts, the attacker performs a password spray using netexec, testing a single common password against the valid user list, which successfully compromises the account carl.hackermanman 9:10-10:50.
• After gaining initial access, the presenter attempts to collect BloodHound data using netexec but encounters errors, then successfully uses RustHound to query the domain controller and collect the necessary JSON data files 13:10-18:10.
• The final steps involve installing the BloodHound CLI, resolving port conflicts with other services, and ingesting the collected loot into the BloodHound interface to visualize graph-based attack paths 19:00-23:00.

The video concludes by assigning the viewer the task of analyzing the ingested BloodHound data to determine the next steps for lateral movement or privilege escalation, emphasizing the importance of independent problem-solving.

Sources:

• 2:15-3:00 Generating a list of potential Active Directory usernames from employee names.
• 5:10-8:20 Using curbroot to enumerate and identify valid usernames in the domain.
• 9:10-10:50 Performing a password spray with netexec to compromise a specific user account.
• 12:00-13:00 Introduction to BloodHound for mapping Active Directory attack paths.
• 13:10-18:10 Collecting BloodHound data using RustHound after netexec fails.
• 19:00-23:00 Installing BloodHound CLI, resolving port conflicts, and ingesting data.