harmj0y.netPublished
Mimikatz and DCSync and ExtraSids, Oh My
Excerpt
Benjamin Delpy is constantly adding new features to Mimikatz. In June, he added the ability to include ExtraSids in golden tickets. This was built in coordination with Sean Metcalf‘s work on the subject, and something I talked about here.
Benjamin also recently added the ability to abuse the MS-DRSR protocol for domain controller replication, in order to recover hashes from a DC without code execution. I touched on this briefly in the post detailing Empire’s v1.2 release (and in a demonstration video) but I wanted to revisit the subject and show how these two new…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by harmj0y.net on harmj0y.net.