search

Dec0ne / KrbRelayUp

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
1.54k stars 205 forks source link

Request - Exporting the TGT to disk #15

Closed jsdhasfedssad closed 2 years ago

jsdhasfedssad commented 2 years ago

Hi. Thank you for this tool! I am testing obfuscation of this binary and while your tool evades Defender afterwards, CMD is not spawned. Or perhaps the service is not started. There are no errors in the output from the tool. I also tried setting "binpath" to "net user test Password123! /add && net localgroup Administrators test /add" but that also does not work. If the tool could write the TGT to disk I could use that instead of relying on having RDP access and features that may not be compatible with obfuscation. Would that be something you would be interested in adding?

Dec0ne commented 2 years ago

I added --Verbose flag which will display all the tickets generated with this tool as base64 for further use. Thanks for the suggestion.