# OSCP A -> AD
## 0x1 Recon
### Rustscan
* 

### Nmap
* 192.168.194.141(MS01)
* 
* 
* 
* 

* 192.168.194.142(MS02)
* 

* 192.168.194.140(DC01)
* 
* 
### Website
* Maybe GPO setting script under `script` path
* 

### SMB
* 192.168.194.141(MS01)
* 
* Using rid brute got domain users
* 
* 

## 141(MS01)
### Shell as `Eric.Wallows`
* Use initial credential login to MS01(.141)
* 
* 
* User `Eric` has `SeImpersonatePrivilege` priv,so upload `Juicypotato` and `nc`
* 
* 
* Execute Juicypotato and got shell of admin
* 
* 
* Upload mimikatz and got user hash
* 
* `secredump.py` got hash
* 

secretsdump.py administrator@192.168.194.141 -hashes :3c4495bbd678fac8c9d218be4f2bbc7b

## 142(MS02)
* Using winrm login to 142 as `celia.almeda` from `securdump` leaks password
* 
* 
* A floder called `windows.old` under `C:\`, and it stored the SAM and SYSTEM allows we read
* 
* 
* Download with winrm, and use secretdump got the user credential
* 
* 

## 140(DC01)
* In bloodhound we saw the `tom_admin` is the domain admin on DC01, so I login with winrm and got proof.txt
* 

* `tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f2`
*