## Active Directory and Domains

Congratulations, you have achieved the "crown jewels" of a typical Windows network penetration test, i.e., you have managed to breach the Windows domain controller with SYSTEM privileges.

We have not yet delved deeply into what AD (Active Directory) actually is in the course, but you may have seen references to it when discussing NTLM authentication. In this case, it was mentioned that if a user is not found in the local SAM database, but is a domain user, NTLM authentication is forwarded to the domain controller.

At its simplest, AD can be thought of as follows:

- Without AD, computer users, groups, and settings are local.
- There are still local users, groups, and settings with AD, but now the settings are also centrally managed, and there are now also different types of users and groups called "domain" models, whose information is not on the computer but on the AD network.
- And the Active Directory network is controlled by domain controllers like the server you just hacked into. And all those users and passwords (or actually their hashes) can be found in a file on the server's disk called "ntds.dit".

---

## NTDS.dit file

**ntds.dit** is the database file of AD (Active Directory). It is a central part of the Windows domain controller, which is a server that manages information about users, computers, groups, and other network resources in the organization.

The ntds.dit file contains information about all users, **password hashes**, groups, computers, and other objects that are part of the active directory. This database stores the information in a hierarchical structure, which facilitates fast retrieval and management of the data.

---

## Domain Administrators (Pääkäyttäjät in Finnish)

Domain Admins group users typically have rights to administer the entire domain. You can determine who belongs to this group by dropping into the Windows command line with meterpreter and executing the command:

```sh
net group "domain admins" /domain
```

![](sanity:image-f858ed4fdd75df2547826e4adb14e1c546cd1a6e-1348x708-png)

---

## Decompressing NTDS.dit File

The Meterpreter hashdump command is now smart enough to detect that it is operating on a domain controller and retrieves NTLM hashes from the NTDS.dit file instead of the SAM file.

![](sanity:image-f173e5327314a59283508052641c5e30ffe8183b-1472x658-png)

---

## Exercises

@exercise ff3b7cce2339

@exercise 1942528fdfe5

@exercise bc1726175516


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

AD and domains, NTDS.dit file and cracked domain controller

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

AD and domains, NTDS.dit file and cracked domain controller

Learn to hack — start here