HTB CPTS: Living Off the Land ( question 3)

hello guys today i have little bit challenge with the question 3 from the Active Directory Enummeration and Attacks of the CPTS certification : question 3 : Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.

so the first thing we need to see the need in this question 1- disabled account 2- administrative privileges so in this case and like what the hint tell us we need to use DSQuery and ldap filter to get the flag

for the first needs or requirement is a disabled account ==>

(userAccountControl:1.2.840.113556.1.4.803:=2)

the ‘2’ is definning the disabled account

then the second needs is administrative privileges so for this ==>

(memberOf=CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL)

so finally the final commande that combine these two requirement is :

dsquery * -filter “(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2)(memberOf=CN=Domain Admins,CN=Users,DC=INLANEFREIGHT,DC=LOCAL))” -attr samAccountName description

the option -attr is for desired attribute that we wanna be outputed .

thank you and happy hacking .