Fundamentals of Penetration Testing
AD and domains, NTDS.dit file and cracked domain controller
Active Directory and Domains
Congratulations, you have achieved the "crown jewels" of a typical Windows network penetration test, i.e., you have managed to breach the Windows domain controller with SYSTEM privileges.
We have not yet delved deeply into what AD (Active Directory) actually is in the course, but you may have seen references to it when discussing NTLM authentication. In this case, it was mentioned that if a user is not found in the local SAM database, but is a domain user, NTLM authentication is forwarded to the domain controller.
At its simplest, AD can be thought of as follows:
- Without AD, computer users, groups, and settings are local.
- There are still local users, groups, and settings with AD, but now the settings are also centrally managed, and there are now also different types of users and groups called "domain" models, whose information is not on the computer but on the AD network.
- And the Active Directory network is controlled by domain controllers like the server you just hacked into. And all those users and passwords (or actually their hashes) can be found in a file on the server's disk called "ntds.dit".
NTDS.dit file
ntds.dit is the database file of AD (Active Directory). It is a central part of the Windows domain controller, which is a server that manages information about users, computers, groups, and other network resources in the organization.
The ntds.dit file contains information about all users, password hashes, groups, computers, and other objects that are part of the active directory. This database stores the information in a hierarchical structure, which facilitates fast retrieval and management of the data.
Domain Administrators (Pääkäyttäjät in Finnish)
Domain Admins group users typically have rights to administer the entire domain. You can determine who belongs to this group by dropping into the Windows command line with meterpreter and executing the command:
net group "domain admins" /domain
Decompressing NTDS.dit File
The Meterpreter hashdump command is now smart enough to detect that it is operating on a domain controller and retrieves NTLM hashes from the NTDS.dit file instead of the SAM file.
Exercises
The Domain Admins group has two members, one is "Administrator". Who is the other one?
What is the NTLM hash for that user?
Ready to become an ethical hacker?
Start today.
As a member of Hakatemia you get unlimited access to Hakatemia modules, exercises and tools, and you get access to the Hakatemia Discord channel where you can ask for help from both instructors and other Hakatemia members.