3 ms·
I agree this reads like fiction. Strange capitalization, and no technical person I know or know of would write this way; it all seems very cavalier and not the
by corndoge 8y ago
I agree this reads like fiction. Strange capitalization, and no technical person I know or know of would write this way; it all seems very cavalier and not the careful writing of someone who actually does this for a living. Not that I know better.
- CPLX 8y agoIt’s a twitter thread, it’s worth noting.
- detaro 8y agoThe style seems fairly normal for public stories from that type of work.
- emmelaich 8y agoI found this odd: > spent some time hunting the Domain Controller The DC address(es) are trivial to find.
- crankylinuxuser 8y agoThey can be. But here's the problem: You have a GPO that turns on command and ps logging. Ok, so if you type those commands, you alert script logging engines. And then you search how to find the DC: https://serverfault.com/questions/78089/find-name-of-active-directory-domain-controller https://serverfault.com/questions/78089/find-name-of-active-... It's all PS or cmd. Trapped. You might find the DC listed in the registry if you look for key "DCname". However again, that's another thing you'd use app whitelisting for, and catch every invocation of regedit. A lot of unattended driveby attacks attempt to do bad things here, so you catch/trap them. Again, dead end. So, I'd love to see a good walkthrough how to find the DC if these avenues don't work.
- brazzledazzle 8y agoI think this one won’t get you caught: Explorer address bar (or start>run) > %logonserver%
- crankylinuxuser 8y agoTrue, for smaller orgs. When you get to larger orgs, the DC doesnt always have to be the logon server. In fact, you're liable to see a slew of logon kerb redirectors talking to a few ldap backends running as pri and secondary AD.
- brazzledazzle 8y agoI have to admit I’m not familiar with anything in your comment. Is this different terminology for a RODCs? I was also under the impression that AD didn’t have a primary DC, the only vestige of that is the PDC Emulator FSMO role.
- emmelaich 8y agoYou can just do a SRV DNS lookup. For PDC it is _ldap._tcp.pdc._msdcs.<DnsDomainName> See https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-records-that-are-required-for-proper-functionality-of-active-directory/ https://blogs.msdn.microsoft.com/servergeeks/2014/07/12/dns-... [edit: I see the SO link mentions SRV. Still]