# Adding Users
If we access the Active Directory Users and Computers on our DC, we would see something that looks like this (if sorted according to type).

We have 2 or 3 users of type, "user". We want to add more users and configure a few of them to be Kerbroastable or ASREProastable.

Rather than do this manually like some sort os schlepper schlepping along, we are going to be adding users using the following PowerShell script. However, because our DC is currently isolated and I can't copy and paste into it due to [limitations of noVNC](https://youtu.be/y6EDlD_fWn0?si=DY7q3-2N7sy3DpXh)(something I only learned when I started on this Proxmox journey having never really used noVNC before) - we will be staging the file in the Kali VM, transferring it over to the Vulnerable Machine, and then transferring that over to the DC.

## PowerShell Script

Some of these passwords are found in rockyou and some of them are not. So some will be easily crackable, others not so much. This will be similar to what you might find in the OSCP.

#not in rockyou
New-AdUser -Name "Emmet Brickowski" -GivenName "Emmet" -Surname "Brickowski" -SamAccountName "emmet" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "R3xRul3z!" -Force) -Enabled $true

# in rockyou
New-AdUser -Name "Wyldstyle" -GivenName "Wyldstyle" -Surname "" -SamAccountName "wyldstyle" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Awesome24!" -Force) -Enabled $true

# in rockyou
New-AdUser -Name "Batman" -GivenName "Batman" -Surname "" -SamAccountName "batman" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "#1BlackBelt" -Force) -Enabled $true

#not in rockyou
New-AdUser -Name "Vitruvius" -GivenName "Vitruvius" -Surname "" -SamAccountName "vitruvius" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Bl0ckM@g!c" -Force) -Enabled $true

#not in rockyou
New-AdUser -Name "Benny" -GivenName "Benny" -Surname "" -SamAccountName "benny" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Sp@c3Sh1p!" -Force) -Enabled $true

#not in rockyou
New-AdUser -Name "Uni-Kitty" -GivenName "Uni" -Surname "Kitty" -SamAccountName "uni-kitty" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Un!K!tty!!" -Force) -Enabled $true

#not in rockyou
New-AdUser -Name "MetalBeard" -GivenName "Metal" -Surname "Beard" -SamAccountName "metalbeard" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Metal_9488!" -Force) -Enabled $true

#not in rockyou
New-AdUser -Name "Lord Business" -GivenName "Lord" -Surname "Business" -SamAccountName "lord_business" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "TAKOstuesday!" -Force) -Enabled $true

# in rockyou
New-AdUser -Name "IIS Service" -GivenName "IIS" -Surname "Service" -SamAccountName "svc_iis" -UserPrincipalName "[e-mail]" -AccountPassword (ConvertTo-SecureString -AsPlainText "Portland7@" -Force) -Enabled $true

#New-AdUser -Name "" -GivenName "" -Surname "" -SamAccountName "" -UserPrincipalName "@oscp.lab" -AccountPassword (ConvertTo-SecureString -AsPlainText "" -Force) -Enabled $true

#New-AdUser -Name "" -GivenName "" -Surname "" -SamAccountName "" -UserPrincipalName "@oscp.lab" -AccountPassword (ConvertTo-SecureString -AsPlainText "" -Force) -Enabled $true
# in rockyou
#New-AdUser -Name "" -GivenName "" -Surname "" -SamAccountName "" -UserPrincipalName "@oscp.lab" -AccountPassword (ConvertTo-SecureString -AsPlainText "" -Force) -Enabled $true 

## Transferring to Vulnerable Machine
We have the file in our folder
Start SMB Server
Access from Vulnerable Machine
Download and save into the setup folder on C: which also has the Autologon executable
Share the folder

## Downloading to Domain Controller
Access the share through file explorer
Because we haven't added the vulnerable machine to the domain yet, we will need to enter credentials (Vulnerable Machine user credentails)
Access the shared folder
We can create a new folder "setup" in the C: drive of the DC, and paste the file there

## Running the script
Open up PowerShell as administrator and go to the setup directory
Run the script
Click refresh in the Active Directory Users and Computers window
Observe the glory of the new users

## Configuring Groups

### Service Accounts
Create a new group and call it "Service Accounts"

#### Add Members

Right-click > Properties
Members > Add
Check Names
Apply

### IT Admins
Create a new group and call it "IT Admins"

#### Add Members
Add Emmet and Lord Business
- The semi-colon separates multiple names

Check names for autocomplete

## Configuring Users

### Lord Business - Path to compromise
Lord Business is also going to be a member of Domain Admins - he shall be the one we compromise.

### MetalBeard - AS-REP Roastable
We are going to make MetalBeard AS-REP Roastable

### IIS Service - Kerbroastable
Add Service Principal Name
We can check it with

# Password File to be discovered

## Directory Settings
Create a folder in C: called "backups"
Share with everyone (because it is the security permissions that matter)
Change security permissions by disabling inheritance to make it *a little more* secure.
Edit > Remove Users
Add > Service Accounts group
Let Service Accounts have modify permissions

## Making the password file
Create a text file with some credentials - only one of these will be a "current" set of credentials

Zip it behind a password (in this case, one that is also found in rockyou)

Transfer it over using the same technique we used with everything else
- SMB share on Kali > Vulnerable Machine > Domain Controller

- Kali VM

- Vulnerable Client

- DC