# Weaponizing Windows Pt-1

Lets assume you have an IP address `10.129.208.61,` Domain `absolute.htb,` and Domain Controller `dc.absolute.htb.` \
You want to run SharpHound to collect data for Bloodhound. Twist is there is only kerberos authentication. We can use our Windows VM to do this easily.

1\) Setup the DNS. \
The DNS points to the `dc.absolute.htb`

<figure><img src="https://3517022440-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7AiL05qubQhf0RoEOXWw%2Fuploads%2FbaxcLXyyIKMbZbTzGMce%2Fimage.png?alt=media&#x26;token=6503a5ba-d53c-4beb-83b5-20da49d49ffc" alt=""><figcaption><p>DNS Setting</p></figcaption></figure>

2\) Set up Host File\
Path => `C:\Windows\System32\drivers\etc\hosts`\
Append the IP and host names.

<figure><img src="https://3517022440-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7AiL05qubQhf0RoEOXWw%2Fuploads%2FEcEiGvleMk3TnuLCPOf5%2Fimage.png?alt=media&#x26;token=70a47211-0da4-40e4-bf15-14c9f45c4d4a" alt=""><figcaption><p>IP And Host name in Hosts file</p></figcaption></figure>

3\) Create the Ticket\
Command => `.\Rubeus.exe asktgt /enctype:AES256 /user:<username> /password:<password> /domain:absolute.htb /dc:dc.absolute.htb /ptt`<br>

<figure><img src="https://3517022440-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7AiL05qubQhf0RoEOXWw%2Fuploads%2F10kDO65bhCbSuplDFGpl%2Fimage.png?alt=media&#x26;token=46d3cdda-b9d9-459b-94f7-eb3c11dd0e4d" alt=""><figcaption><p>Running Rubeus to get the ticket</p></figcaption></figure>

4\) Run SharpHound\
Command => `. .\SharpHound.ps1; Invoke-BloodHound -Domain absolute.htb`\
After a while we do get the zip file! :tada:

<figure><img src="https://3517022440-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7AiL05qubQhf0RoEOXWw%2Fuploads%2FaLLY3NwLGX1r0NLKTAP8%2Fimage.png?alt=media&#x26;token=e633644d-1404-4ad5-9429-04d0ac8c6a21" alt=""><figcaption><p>Running SharpHound!</p></figcaption></figure>

<figure><img src="https://3517022440-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7AiL05qubQhf0RoEOXWw%2Fuploads%2FHoRysGedUYJgrip1TQ0f%2Fimage.png?alt=media&#x26;token=7be8775a-b893-4a81-9b83-2ec36e2c5054" alt=""><figcaption><p>SharpHound collects the zip!</p></figcaption></figure>