Krbtgt hash
Last updated
Last updated
Once you gain Domain Admin privileges within the child domain its possible to get Enterprise Admin in the parent domain by generating a golden ticket in the child domain with the SID of the Enterprise Admin group.
The attack is executed from the perspective of already gaining domain admin privileges. This is done in the unconstrained delegation section:
For easy execution, login on WS01 as the Administrator user with the password Welcome01!.
Start PowerShell as Administrator and load a amsi bypass and MimiKatz into memory.
To execute the attack we need a couple bits of information:
The hash of the krbtgt user.
The SID of the Enterprise Admins group.
The SID of the child domain.
3. Execute a DCsync with MimiKatz and only retrieve the krbtgt hash:
4. Retrieve the SID of the enterprise Admins group, using PowerView:
5. Retrieve the domain SID from the child domain, using PowerView:
6. Create a golden ticket with MimiKatz and inject it into the current session:
7. The ticket injected successfully, now we can dir the c$ directory to check if our user has read/write access to the C disk:
