Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Getting Started with WMI Weaponization – Part 4

netspi.com | blog | #active-directory | #wmi | #ntds-dit | #credential-dumping | #volume-shadow-copy

Summary

Replicates ntds.dit dumping with pure WMI Win32_ShadowCopy calls instead of vssadmin, remotely snapshotting a domain controller to pull password hashes while trimming the tool-based IoC footprint.
Published
Collected

original ↗

Related coverage

blog · netspi.com
Hashdump without the DC using DCSync (because we all wanted it)
Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.
blog · netspi.com
Auto-Dumping Domain Credentials using SPNs, PowerShell Remoting, and Mimikatz
Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.
blog · semperis.com
NTDS.DIT Extraction Explained
NTDS.DIT, AD's core database, stores password hashes for the whole domain; extracting it lets attackers crack them offline or reuse them via Pass the Hash. Defenses and detection covered.
blog · netspi.com
MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings
Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.
blog · netspi.com
ADIDNS Revisited – WPAD, GQBL, and More
Kevin Robertson expands on ADIDNS attacks, covering why WPAD records fail against the global query block list and demonstrating GQBL bypasses with wildcard, DNAME, and NS records.
blog · netspi.com
Beyond LLMNR/NBNS Spoofing – Exploiting Active Directory-Integrated DNS
Kevin Robertson argues ADIDNS beats LLMNR/NBNS spoofing for MITM attacks in AD environments: attackers with unprivileged access can add wildcard records that intercept name resolution domain-wide.
back