Automating Active Directory exploitation using the DeathStar

As explained by the creator:

"DeathStar is a Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Active Directory environments using a variety of techniques."

- (source: https://github.com/byt3bl33d3r/DeathStar)

To run DeathStar, we need to start Empire with a RESTful API. This can be achieved with the following command:

sudo ./empire --rest --username <username to access the API> --password <password to access the API>

Once Empire starts, we'll see the following message:

The message displayed in the previous screenshots indicates that the RESTful API is running on port 1337/tcp and an API token has been allotted. There's a huge security risk if we open port 1337/tcp for everyone. To avoid this, we will create a reverse SSH tunnel to connect to...