text: what's going on YouTube this is IP doing certified from hack the box which is assumed to breach box meaning we start up with a set of credentials and you probably could guess based upon the name of this box it will involve active directory certificate Services AKA adcs so we start out by running certify and identifying the non-default users that can enroll certificates which is a great place to start thinking about an attack chain a lot of people that run certifi will just do the- vulnerable flag to see what um certificate templates are vulnerable to the user they're running it as but if you leave that flag out you can identify all the users that can roll things and looking at non default is a great way to identify high value targets which helps when you go into blood hound and map everything because we can take our user put the high value Target in

title: HackTheBox - Certified


text: and find a path to them and then eventually exploit the certificate template which is vulnerable to um esc9 which is an attack that requires writing a UPN to be administrator requesting a certificate then changing the UPN back and for some reason that allows a certificate we generated to impersonate the default domain admin and as a bonus at the end of the video we'll look into writing Cipher queries which helps greatly build paths to non- deault things so with that being said let's jump in as always we start off with an end map so- SCC for default scripts SV enumerate versions dvv for double verost this gives us things like the TTL OA output all formats put the end map directory and call it certified and then the IP address of 1010 11.41 this can take some time to run so I've already ran it looking at the results we have 11 ports open and the first one I see is DNS on Port 53 and

title: HackTheBox - Certified


text: it's got this Banner of simple DNS plus which is the default for Windows Active Directory so I know I'm dealing with an active directory server we have DNS Kerberos um some RPC ports elap and it's leaking the domain name which we have certified. hdb and the certificate also shows us the um host name of the box which is dc1 and we see it looks like we have a um time difference of 19 hours between the machine and us so if we want to do any Cur stuff we probably need to fix that time difference but that may come up later so let's add the host name to a host file so we'll do a pseudo V Etsy host 10 10141 dco1 uh let's do the machine name as well and then just the domain name so there we go we have all three names this box could potentially be in our host file and what's really sticking out is there's no web server on Port 80 just kind of have standard active directory

title: HackTheBox - Certified


text: Services looking here there's SMB as well more standard active directory Services that's ldap again um more ldap and more certificate stuff from ldap and that is it so um it is telling us there is a clock skew difference but that's all we have to go on now this is a assume breach scenario which means hack the Box did give us credentials so looking at it we have the first set is Judith mayor and Judith 09 so what I probably do first is just run net exec to make sure these credentials are good right so we'll do net exec SMB 1010 1141 username and password of Judith 09 just make sure we can authenticate and then we can do like D- shares list all the shares to see if there's any like file shares we need to pillage and looking at it come on let it finish um everything's default we don't have to anything sensitive I guess we could go and like pillage cisv which may have some crew policy stuff but that's

title: HackTheBox - Certified


text: generally not where I start because it takes a very long time to mainly go through all those files right and normally it's not that beneficial I think users will allow us to dump every user on the box uh let's see this flag real quick there we go so we're just seeing the usernames we have administrator Judith management SVC CA operator Alexander Harry and Gregory so those are all the users we have on the box we could go and run Blood Hound as well which we will do in a little bit but I'm not going to start there I'm going to start with certify because the names of the box is certified so I'm guessing it's adcs type vulnerability because that's active directory CER um certificate Services right so let's start with that I'm going to do a certify and then we'll do find specify the DCI IP of 1010 1141 let's show

title: HackTheBox - Certified


text: vulnerable templates of the user what was it Judith Mater and the password password I forget what that was Judith 09 and they'll go to standard out so looking at this it's going to um get the certificate Authority configuration and since we have it we know there is a adcs service it's printing out the certificate authorities we don't see anything for templates so um there's no vulnerable templates for a user now I also will run it without the DH vulnerable and just look at all the templates because there's still good information to find right um just because this user doesn't have the ability to exploit any templates doesn't mean there's not the ability for other users and we can kind of find out by just listing them all and then quickly going over it right normally for like ADC has vulnerabilities it's going to involve this enrollment rights and we can see domain admin domain user

title: HackTheBox - Certified


text: Enterprise admin um if we go through all these there are 33 templates so that is a lot um we'd find some that have the non default of just like domain admin and Enterprise admin we keep going up maybe we'll find it that's 12 I think it's near the top we'll show kind of a better way to go about this um let's see enrollment rights so here's the templates let's see right here the first template what is the name of this the the certific certified authentication template allows operator CA to enroll so that's a non- deault thing so when I go to Bloodhound I'd probably be looking for like Judith Mayer as owned and I'd put this operator CA as a high value Target and find paths to the operator CA um but if we want to do a better way to format this if we did DH we can look at other output options and oddly enough

title: HackTheBox - Certified


text: both of these are broken on on the community edition of Blood Hound um long ago Blood Hound made a breaking change in Legacy so that's why there's old blood hound and both regular blood hound but this is legacy and this is like older than Legacy uh certify itself I don't think it's been updated in two years like 2023 I think is the last time it's been updated or something so um it doesn't support Community Edition so we can't just output it Blood Hound uh format upload it and do everything in um Cipher queries but we can do it in Json and that will help us do some filtering and it's going to be a bit of a pain to write the JQ query but it is something I enjoy doing for just testing things because um we can do a lot of really good filters with JQ so I'm just going to copy this and we're going to do it in um filter. sh I guess and I'm doing it

title: HackTheBox - Certified


text: this way because I wanted to span multiple lines and I think it' be easier for you to read but but if I'm just typing this out myself I'd probably just do it as a oneliner right so we're going to do this JQ query if I um run filter we see everything so what I want to do is drill all the way down to the enrollment rights so we have to go into certificate templates so let's do this real quick so do um dot I think we can do it like this um certificate templates and from here we go into a list um let me close this off save we'll run it again and I want to kind of flatten this so we just have a list of items because I don't want to have to make my search like no to go into all these keys so you see right here we're going in like too deep I'm going to put a um two entries so we'll do two entries like this save

title: HackTheBox - Certified


text: that that did not work let's see we do certificate template oh I have I think my VI added a single qu for me there we go so now you see it's just one deep right it put the key like this so that just makes it a little bit easier for us to search so I'm going to now do a I want to drill down into every item and then look at the enrollment rights and then look for things that have something other than domain admins or Enterprise admins and what I'm actually going to do is just filter out anything that has the word domain or Enterprise but if I was on an actual like engagement I'd probably be a lot more granular in this and do a filters like domain admins Enterprise admins and go through a bunch of groups I don't care about so um we'll do a select all so this is going to mean both of these things have

title: HackTheBox - Certified


text: to be true and then what do we go through we want to do value and then after value we go into permissions then enrollment permissions and I'm using quotes there because there is a space so do enrollment wres now and that is a list so now we'll do a semicolon and we're going to use our filter words so we're going to test for the word domain and we're going to say case insensitive so we do an i or test Enterprise and case insensitive as an I close out that and then we're going to pipe it and say not because now we're in this select so we did all here we're saying go down in enrollment rights look for the word domain and Enterprise and then take those out and then show me what's left right so that's kind of what I'm trying to convey here and we'll see if we got it right um syntax error unexpected token we did not get it right because I

title: HackTheBox - Certified


text: think that quote goes on this side of that it does awesome so there we go we have key zero and the first one is let's see operator CA so R the bat we see the vulnerable certificate and then going down Keith three has another one and this certificate is Ras and I server I think this is like um provisioning Services I think I don't know exactly I think that's like remote maybe I'm thinking remote deployment service um remote access server I think is what R is um if we look here the reason why this one's showing up is because we took these two out but we didn't filter for this group so this group still exists right we could say um we could go back up to the filter if we wanted to and say uh test R I guess um I like that we need or there we go and we only have that one key now because we filtered out that group so

title: HackTheBox - Certified


text: hopefully this little JQ filtering kind of makes sense it's something I do it it's not needed you can solve the box without this but now we know um there's a high value Target of um what was it operator CA I think right what is that Target uh we want to get to operator CA so I'm just going to go my credentials and high value this okay so now that we have that let's go ahead and run Blood Hound so we'll do um I have blood hound and opt I think it's that's Legacy opt Blood Hound in gers Blood hound. and I'm on The Blood Hound Community Edition Branch so let's do a Python 3 blood hound. py uh the domain certified. hdb the user Judith Mater that's the one we started out with and her password um was it Judith 09 yeah Judith 09 like that and then collect everything name server of 10 10 1141 and we got a ceros so we fall back to ntlm because the time sync which we

title: HackTheBox - Certified


text: saw during end map but it looks like we're getting everything we found 10 users 53 groups two gpos so while that queries let's go ahead oh it's done so we have everything here um I should have put this in my thing so we'll do htb where is it certified there we go let's go back to that directory and then let's go opt Blood Hound server and we'll do Docker compose up- D and um if you use my parot install Playbook um I've changed it so Blood Hound starts on Port 8088 the default is port 8080 and I'll also save the default Blood Hound credentials to a file I forget exactly where um but I think it's just in probably the op Blood Hound directory it's starting the graph DB but we can start going over to it um Local Host 888 uh admin and I set my password to Please Subscribe one exclamation point I

title: HackTheBox - Certified


text: hope yes I am in awesome so let's go ahead and upload all the files so let's go to Administration upload files and first let's turn dark mode on and we'll go to htb certified and then upload all these Json files and it looks like this file may be oh this is from um my certifi command of course that doesn't work because we just outputed a Json format not The Blood Hound but that makes sense so now we're ingesting things it'll probably take uh 2 to 3 minutes so I'm going to pause it video and we're going to resume when it's done okay now that our ingestion is done we can go over to explore and look at things so the first thing I would do and this going to assume I didn't have any knowledge of where I want to go I would just search for Judith Mayer like the user we have definitely mark them as owned and then just click around this

title: HackTheBox - Certified


text: outbound object control and see what they can do so we can see Judith Mayer has right owner over management we look at management go to outbound control again see what they have unique things to management has right over this user this Management Service user so we can probably own them and then we again outbound control and we see generic all over CA operator and we see the display name is operator CA which is the user we saw in um the certify Command right right and if I was on Legacy blood Helm there's an issue right now with the blood Helm python andron Community Edition um it's not showing the PS remote flag um I think this user Can PS remote or this user Can PS remote um we go back to management user let's see member of I would also look at like what they're a member of management service a member of Remote Management so this user Can PS

title: HackTheBox - Certified


text: remote around the domain um but that is just going manually and if you have a large domain Um this can be very timec consuming to find and prone to missing things right but we knew we wanted to get over to what was the user right let's go cat CS that's why I put it we want to go over this operator CA user because that was the one that had a vulnerable certificate or they at least could enroll in a certificate and they were non default so I'm going to say show me paths between Judith and CA operator and blood hound is really nice and just just plants this all out for you right we see Judith WR earner over management generic right over the group which has generic all over this so this is what we're going to be exploiting now right so let's start out we're going to take ownership over this and because we take ownership over

title: HackTheBox - Certified


text: it that means we can then add users so we can add oursel to this group which then because we're a member of the group we can then go over and write on top of this user which then allows us to get like create a shadow credential and get their password or at least the ntlm hash of the password which is just as good for us and then we have generic all over this which allows us to do the same exact thing so let's go and do that whole like step so let's go and um first I guess we should say what we're doing so um let's go up here I'm going to use earner edit which is part of impacket and then we can say the action of write new owner I'm going to say is Judith Mater on the target is it just management yep the target is management and then we want to give our credentials so certified Judith Mater password of

title: HackTheBox - Certified


text: Judith 09 and I'm going to put dcip at the start of this 10 10 11 41 and before I run that let's go and I'll do a net RPC group later we're going to use this net RPC group to add a member but I just want to show the users in this real quick so do net RPC group and then members management and then the user like this um is that how we authenticate it maybe a percent we'll see if this works um server 10 10 1141 I think we go like that net RPC group members management then maybe a dash capital u that's it so we see there's only one member Management Service so I'm going to run this in packet script and we see the earner Sid has been modified successfully it was domain admins right this is what it was and now we changed it back over to us we run it we still see it's just Management Service because we took ownership we didn't add ourself to this group yet um we can run this again and

title: HackTheBox - Certified


text: now it's going to say what the CN was so it was Judith Mater so that's how we know we have changed the owner so the next thing we want to do is give our the right to add a user to this because if we just try to add oursel to this it's not going to work right away so we'll do net RPC group and then it's um I think add meem and then management Judith Mater like that access denied even though we own the group we still don't have it access uh we can use daal edit we'll just change this daal edit specify the DC Action right and we don't want this so we'll say um Das right we're going to give our the right members right and then the principle we want to give it to is Judith Mater the target is management and I think if you just did DH um it shows all the options right so you don't have to have everything memorized you can do wrs and

title: HackTheBox - Certified


text: tells you the rights right here full control reset password write members DC sync so we could give ourself full control if we wanted to um so management and then what else um oh we got to do the user so certified Judith Mater Judith 09 name server 10 10 1141 I should put name server at this front um is it dcip I don't think I need to I think that's it yep there we go so now we gave ourself the ability to add users so here we're listing still just have Management Service now we're going to run ad member this is the command that we got access denied before and there we go we suddenly added a member so now we do list members and we have two we have Judith and management so now that we've done the daal edit we are right here and we want to do generic take advantage of generic right over this Management Service and you should be able

title: HackTheBox - Certified


text: to um blun house is a way of telling you how to abuse all this stuff as well so we could click on the thing and then do Linux abuse and go that way right so let's see let's use certify Shadow Auto Target certified htb d C IP 1010 1141 username Judith Mater certified.

title: HackTheBox - Certified


text: htb password Judith 09 and then the account we want to take over is managementor service or not take over but create the shadow credential so this is adding a certificate to that user that lets us authenticate as them and then we're going to to grab the TGT which allows us to get the ntlm hash of that user and then we can just use that to authenticate um oh clock SK so this is using cose and since our time is too far out of sync it fails so I'll do a pseudo ntp date um log to CIS log I think we just specify the IP 1141 I think that worked so let's run this again and hopefully we don't get the um clock skew error so getting TGT this takes a little bit so we added the key credentials so we can authenticate as them come on give me the TGT there we go and then we restore the old thing so like that's an obsc thing but here we go

title: HackTheBox - Certified


text: we have a hash for Management Service so let's go ahead and V credentials Management Service and we have a hash so we're going to do the same exact thing um once we log in again and take advantage of the next privilege let's see where were we pathf finding was it Judith to C operator that should be it so we took advantage of the J right since we have all permissions to ca operator um for a Management Service we can get this nlm hash so let's do that real quick um we'll do the username this is going to be managementor service and then we don't have the password but we have the hashes right so we can do hashes and specify the ntlm and you always do colon and then ntlm hash because it does a split this is the regular landman hash that we just leave blank because it's not used then we have the new technology landman ntlm there so

title: HackTheBox - Certified


text: that's the hash and then the account we want to take over is CA operator or I say take over but get the password too try and get the TGT there and hopefully we'll get it in just a second and then after we do this whole exploit I'm going to take a step back and we're going to do some more blood hound stuff so that's going to be the Beyond route um normally once I get access to like the winrm it could run sharp Hound I would probably do that but since um ctii from the very beginning told us what it was vulnerable to I kind of skipped having to rerun Blood Hound with new credentials to get more information so um the Beyond route is going to be more blood hound stuff so hopefully that gets you excited to stick around to the end um let's go here CA operator and give it this hash okay so let's see now we can go all the way back to that certify command so we

title: HackTheBox - Certified


text: can do certify find and I was going to do STD out oh we probably should do the new user what was it um CA Operator Operator how do we do hash here hashes just like that hashes standard out oh we probably want the dash vulnerable so the ca operator we knew had the vulnerable certificate that's why I added this and this will just filter out all that and tell us um what we used to seeing with this right there we go vulnerabilities esc9 operator CA can enroll and the template has no security extension so there we go certify is telling us it is vulnerable so let's go over to google.com we'll search es9 I'm going to turn um dark reader on let's see certify certify maybe certify is the right word I'm try and find the blog post that is good is this it this is not it I don't think definitely not hacker

title: HackTheBox - Certified


text: recipes C9 this is talking about it but I want to find the blog post so I think I'm going to pause the video to find a article that I want to show off so um yeah let's do that real quick okay so how I got to it was like Googling certify ESC 99 and then go to this institute for cyber risk and then the blog post is certify 4.0 this one one and it's a 20-minute read so of course we're not going to read the entire thing but I would highly recommend reading it CU it was a really good article um if we go through this the real key piece is um how we're going to exploit it and let's see do we have an example okay so right here's where they start explaining it um we need to have generic right over an account because what we're going to do is take in account we're going to use the probably CA operator the one we had generic all over um and we're going to

title: HackTheBox - Certified


text: rewrite the UPN that's user principal name to be administrator and you may think that will conflict with the default domain administrator named administrator but the UPN for the default uh domain administrator is administrator at domain so we kind of create this duplicate scenario of um the UPN of administrator and then we're going to use the um write again to oh we're going to request a certificate on the behalf of the user and that certificate will have the UPN of administrator we're going to change that users's UPN away and then when we use that certificate later it's just going to magically work to The Domain administrator it's a little bit confusing but hopefully it'll work with the um demo we're about to show so let's go ahead and start things off so we're going to do a certify and then account

title: HackTheBox - Certified


text: update and we're going to do the Management Service hashes and let's C credentials we're going to use this hash paste that in we're going to take the user caor operator and change their UPN so we're going to write the UPN to be administrator and I'm going to put dcip at this front of this just because it's not going to change throughout all the commands so 10 10 1141 like that so here we have changed CA operator to be administrator so the next thing we do is request a certificate so we do certify request the user CA operator hashes we use this hash because we're authenticating as them and let's see the DC IP 10 10 1141 wait do I do that I did at the start that's fine uh the ca this is going to be from the certified output um it is let's see certify we have it here what was that find there we go here's the

title: HackTheBox - Certified


text: ca then after CA we do template and let's see that template name I think it was like certified authentication there we go template name like that so we're going to request the certificate uh request with the host timed out what was that talking to 10 11:41 did it only work with Okay I don't know why it timed out the first time but um if it times out I guess try it again so we see we got a certificate with the UPN of administrator we saved it to this now I'm going to attempt to use the certificate real quick to prove it doesn't work so we'll do uh certify off pfx administrator dcip 101 1141 domain certified. htb fix that and we have that error right so let's go back to the command where we do the update and we can set the UPN to anything we want right we could set it back to was it ca operator at

title: HackTheBox - Certified


text: um certified. htb that's the default value we'll set it run it again and then down here we can do evil when rm- I 10 10 11 41 administrator I think it's just das8 for hashes let's grab this hash see evil winrm Capital H and there we go we are now certified administrator um if we set this to be like definitely not administrator run it again we still get the hash but if we set this back over to administrator we don't and what I think is happening is um we run this off and then Windows go and it sees the UPN of administrator for CA operator and then sees something mismatches and just errors out right um when we remove the UPN administrator from this user Windows says huh there's no administrator UPN but there's a UPN of administrator certified. hdb let's go and use that one and then that's what lets us log in um we can look at the certificate um if we wanted to so we

title: HackTheBox - Certified


text: could go what is it open SSL and then pkcs12 in where is that file administrator pfx and we want to do CL Sears no keys out administrator. pem there is no import password so now that we have the pem certificate we can do openl x509 administrator pem I'll give it text out there we go this is a certificate so we can see the issuer we can see the subject so this certificate for operator CA and then you scroll all the way down I think all this stuff doesn't really matter we see the subject alternate name UPN administrator and this is what is doing the authentication right so um if we changed the UPN to something else made another uh Certificate request that's what it would put here right so this is where the exploit is coming in um we write our UPN to be administrator change our UPN away from administrator after we requester certificate and then

title: HackTheBox - Certified


text: we use it and it just pretends this UPN is um the administrator UPN of administrator at certified HTP like that right so yeah that is that um let's now go back and I want to get more information in blood hound and we're going to write a cipher query and then call it a video so we did evil winrm as the management user so we're not going to use the administrator we're just going to use management because that's the access we would have managementor service and this hash they member of the like remote operator group I think it was there we go and we could do get 80 user was it administrator and huh it doesn't show the UPN the blog post says let's see um it's not a constraint violation meaning like user principal name is a unique value so no two users can have the same UPN so that's what they're talking about constraint value here but

title: HackTheBox - Certified


text: since administrators UPN is the domain I thought it would show the UPN there that's interesting um what is another user I wonder if like if you UPN is um null then it does username at domain so that's what I'm trying to do and I think get ad user may require a username get ad user let's see it was like Gregory right Gregory Cameron we haven't touched this user nope the UPN is the full so I don't know exactly what's going on um administrator at certified htb we do see I'm wondering there's two administrators there's the like local and domain no that's not right we do star I'm not exactly sure what's going on um net users yeah there's only one administrator so okay I digress sorry for that tangent if it confused you more um I don't fully understand it but that's why we have to change the UPN away because it doesn't

title: HackTheBox - Certified


text: work otherwise so let's go ahead and run Blood Hound here so I'm going to go in up um was it lowercase b and gestures we do CP sharp Hound exe here upload sharp hound. exe and we're going to get a lot more data here so let's see I want to log in first try to think what we can show um the template let's do certified off there's no templates at all here um and if we go into Cipher let's see let's mark a few things as owned at this point we have owned that server uh user let's see actor directory hygiene where's owned short pass from owned objects so run this query and see what it looks like after the sharp Hound data so we see Judith right owner over this to um CA operator which is a pretty good um query right off the bat right but this user does have um KPS remote and we can't see that permission and let's

title: HackTheBox - Certified


text: do slash sharp pound.

title: HackTheBox - Certified


text: exe and let's see shortest path I wonder if I can show this easily is that one I think this should show me everything that can PS remote we'll run this after we import queries and see so di let's get or download administrator upload blound zip and this is going to take a minute or so to run so I'm just going to pause the video and we'll resume when it's done okay it is now ingested so if I run this query again no results match refresh uh let's do match uh the parameter we'll do match user so we going to take all the users that have canps remote over to the we sign a variable I don't think we have to sign a variable we'll just do computer okay and then we want to return P there we go so that shows this would not show before if um I didn't import the other thing I wish I ran this query before um I don't even think we need those

title: HackTheBox - Certified


text: variables right yep so we're going to get into a little bit of graphql in just a second but what I'm doing here is assigning this variable saying match all the users who have this um permission over to computer and we see that um so what did we want to see let's go back over to the shortest path from owned principles right here and it is is so much different with the more data right because we have a lot more like certificate templates and things like that that the python ingestor just doesn't grab yet um but you can see how much more complex this entire graph becomes so let's see what we wanted to show is we can now go Judith Mater and then let's say we knew the certificate template was it certified authentication and let's see oh it's that's silly I actually don't know how to fix this one

title: HackTheBox - Certified


text: um it's treating this whole KPS remote to us owning the DC so once it gets here saying oh now we can go on the DC and own everything I don't know how to say like match this but take away this permission um let's see shortest path coras owned okay so we can kind of explain what's going on here so this match it's going to take everything here and then Coes so it's going to pretty much do aware looking for the system tags that contain owned and returning P so I'm going to kind of go and modify this to be what I want right so um from that certify output we knew the certified authentication template was vulnerable this whole pathf finding thing um isn't really working for us because it's treating this kenps remote as um more High privileged than it really is right so let's go ahead and do a match and assign everything to S so I use S like that's going to be subjects

title: HackTheBox - Certified


text: right this matches everything I wonder if I can even like limit 100 does this even work um do we like have to return s yeah so we can just like match everything in the database like that's crazy um so we're going to use the coast that we saw before right so we're going to look through all the system tags and then if the system tag is null we're going to just assign it to be blank so two um quotes we're going to look for where it contains owned because we set the user as owned right so let's see where so now if we do this it should only show us the owned things um no alternative input cor L contains owned I thought that would work maybe it doesn't oh I don't think we did return s do we have to there we go so now it list the two owned objects we had right so what we want to do now is create a um another grouping so we do match I'm going to do T for template so

title: HackTheBox - Certified


text: assign the umt template to T where the name is equal to certified authentication at certified cert I hope I typed that right so right here we have all the users as s and now as t we're matching that if I return T yes we just get this one template right so now we want to take these two and find the shortest path so we're going to do a yet another match I'm going to do p is equal for path right these are all variable names so they don't really matter I'm going to say all the shortest paths starting from s and we want to go um what this is is a like variable length pattern so it's saying the star means like variable length at least one dot dot is meaning as many as possible right so we're saying show me every path that has at least one and go to infinity and then give me the shortest ones from s to

title: HackTheBox - Certified


text: T and then we're going to return that path if I click run there we go so that shows Judith Mater the management this CA operator over to this template right so um if we take a template that doesn't exist let's see I'm just going to copy this to my clipboard real quick um the main controller at certified. HTP let's try that one because that should not have anything there shouldn't be a path there right domain controller certified.

title: HackTheBox - Certified


text: htb run it this is going to be the shortest path um I guess we go Judith to management to management to KPS remote um and then users is local to the computer DC like these are not really great paths but this gets us over to DC that gets us to this template um we could also just if we wanted to specify a user here we could take this match s and say let's see s user and then name what is Judith Mater's name was it display name or just name uh we'll do Sam account name like that and it should be what um Judith Mater there we go so now this is only showing the path from Judith Mater over to that one we want to go back to certifi authentication there we go we want to change it we can go to managementor service right there's that path so hopefully um this gives you a little bit of information on Cipher queries hopefully I'll learn Cipher queries more in the

title: HackTheBox - Certified


text: next couple months and then I can do a specific video on it I'm still kind of just learning Cipher queries but it is definitely beneficial to um be able to run tools find things you want and then create your own Cipher to it instead of just um relying on all the default ones they have because things can get kind of hidden in the noise when you just do shortest pads and also a lot of these templates kind of just depend on all the um default things it'll often miss a lot of times when there's some small customizations that you just see but um yeah it's easier to be able to write your own so with that being said take care all and I'll will see you all next time

title: HackTheBox - Certified