DACL Abuse - reg.py
We could do it manually if we had shell access. But we can also do it remotely with reg.py. With the Backup Operators privilege. This is the best post to explain it.
First we need to start the SMB server
sudo impacket-smbserver -smb2support share /tmp/sharereg.py works similar to reg.exe on windows to get registry keys and hives
It was failing for me when getting it to my machine properly. So instead I sent it to DC's C$ share as I have read access there
Then to retrieve it:
After getting them
We get ZSM.LOCAL Domain Administrators hash from previous logon.
Hash uncrackable. And local administrator hash doesn't allow PtH, atleast on .16 host.
We also get other hashes including machine accounts
This is the machine account for the internal DC. So it has privileges to dump hashes from the internal domain itself. And fully compromise it.
Internal domain controller pwned!
CME/netexec uses wmiexec.py for the above under the hood, according to this post. So I used it to get a shell.
Last updated