DCSync
Previously we got these credentials: mssqladm:DBAilfreight1!
We can see that this user has Generic-Write right over ttimmons user. But nothing else here is interesting.
And this user can RDP into our DEV01(172.16.8.20) host. So we can RDP into this host and abuse this right. But as we remember this host only has terminal access and there is no GUI.
I used /drive:share so I can transfer PowerView.ps1. We can check the location for this share with the net use command. And after it is imported:
Instead of just changing the password for the ttimmons user we can create a fake SPN on this account so we can kerberoast it can get the hash to either crack it or use it for PtH.
Thats it. Now we can get the hash for this user:
We now have a new credentials pair: ttimmons:Repeat09
This user has a Generic-All rights over server admins group.
And this group has a DCSync rights over the DC.
Step 1: Adding our user into the group
Step 2: DCSync
DC Admin
From there I got the hash for the DC administrator:
Couldnt crack it with hashcat so using it for pth to access the DC: RDP is closed but WinRM, SMB, WMI are open. All of them will work.
Last updated