# TryHackMe-THROWBACK-DC01(10.200.34.117) I used SSH to log on the domain controller

We can see that we are a normal domain user on this machine so we need to escalate our privileges and the only way to enumerate AD is to use bloodhound so by using the same loot we got from WS-01 we are going to utilize it Using the query `Find Principals with DCSync Rights`

Going into to the documents of jeffersd we find a notice

Here there's a backup account password and we already found that `backup` has DCsync rights ``` DCSync is a late-stage kill chain attack that allows an attacker to simulate the behavior of Domain Controller(DC) in order to retrieve password data via domain replication ``` By running secretsdump.py we dumped hashes from NTDS.dit

Now we have a bunch of user hashes but the problem how we can we know which user to target as we need to escalate our privileges so running a command `net localgroup` to see available groups on AD

We can see there's a group `Administrators`

So we need to crack `MercerH` 's hash

To crack the hash we will be using a rules in `hashcat`

Simply ssh with the current logged in user `ssh MercerH@localhost`

And you can see we are now a privleged user ``` THROWBACK.local\MercerH:pikapikachu7 JeffersD:Throwback2020 ``` Going back to bloodhound we can see that THROWBACK.LOCAL domain is trusted by CORPORATE.LOCAL