To summarize, DNS is offered as a service during active directory creation. I’m not going to get into the hows and whys of why is the DNS service typically installed on the DC in this post.
The DNS server is typically configured on the same server as the DC.
Assuming you have gained an IP address via DHCP, you will have also been assigned an IP address for the local DNS server. The simplest way to identify a potential DC is via the windows ipconfig / all command from your own laptop. Typically, people have multiple DCs and these multiple servers replicate the contained data, this offers resilience and load balancing. Think of it as the most important server in a windows environment. So what is a Domain Controller? Now I’m no MCSE, but what I can tell you is the DC is used to centrally manage and administrator (via active directory services) all domain joined machines in one central place. So if you want to use a nuke, and potentially survive, this is the guide on how you could do it. And let’s be honest everyone loves the pentester who bounces a DC, right? Now anyone can use it (you could even teach your Nan to do this), but without a little respect, or understanding, you will most likely reboot your target. WANNACRY used the ETERNALBLUE exploit The fallout of WANNACRY massively affected the NHSįollowing this the MS17_010_eternalblue exploit was added to msf. NSA had toys, Shadow Brokers found / stole / hacked the toys, then released the toys, and for a few days the world nearly stopped. The back story, let’s be honest it’s no longer interesting. I like to earn it, but we can no longer bury our heads in the sand and I can no longer ignore MS17-010.
I’ll be honest, I hate this idea, I love tools, I love the chase of the DA, this is not something I like to rush. If all goes to plan (and this is a very big if), there is no requirement for any other typical pentesting tools or techniques. It is now possible to simply walk in to a client’s office, plug in your own laptop, gain an IP address and using the Metasploit Framework’s (MSF) ms17_010_eternalblue exploit, target a domain controller (DC) and gain access to accounts belonging to the Domain Admins (DA) or Enterprise Admins group. In fact, just to prove this, there is a recording of me saying this very statement Enemies of the West – Neil Lines – Bsides London in front of a few hundred people at 2017 Bsides London. So in my typical, backwards, and slightly broken style, I’m just going to open on a subject which details a process, that I said I would never use. Well, I have ideas, quite a few if honest, but nothing seems worthy of a post. Now I can happily talk for ages on security, but this, writing a blog, I felt stuck, so why? This is my 1st blog post for 1337red, so I wanted it to be good.
0 kommentar(er)
