Open xorded opened 1 year ago
Hard to tell. Is the powershell.exe
elevated (Run as Administrator)?
Hard to tell. Is the
powershell.exe
elevated (Run as Administrator)?
yes
OK. What about Get-SamPasswordPolicy -Domain westworld
, does it work? And net user /domain
? Had NetCease been applied to that environment? Or any other hardening? Does the Security log on the DC tell you anything, if you enable all Advanced Auditing categories?
MinPasswordLength : 8 ComplexityEnabled : True ReversibleEncryptionEnabled : False MaxPasswordAge : 31.00:00:00 MinPasswordAge : 8.00:00:00 PasswordHistoryCount : 24
net user also works fine, i even changed the password expiry with wmic and same domain admin user
its a red team so i actually stopped the auditing, i found another way to set the hash with smbpasswd but i am just confused as to what would block your set-samaccountpasswordhash
That is strange. I only have a limited AD lab, just re-tested the cmdlet and had no issues. If you figure it out, keep me posted, pls. I would also be curious what mimikatz lsadump::setntlm
does, as it seems to be using the same function.
do you know what type of permissions are needed by set-samaccountpassword hash , maybe i can check the permissions or something
Only the Reset password
permission should be required. Just tested it in a clean AD environment with a fully updated Windows Server 2022 21H2 DC:
Command:
Set-SamAccountPasswordHash -SamAccountName joe -Domain contoso -NTHash e19ccf75ee54e06b06a5907af13cef42 -Server dc.contoso.com
hi
i can execute the Get-ADReplAccount without an issue. the user being used is an ad domain admin
set-samaccountpasswordhash -domain westworld -samaccountname adadminuser -nthash ba17e001e5467d85d16ae7247947929c -server W8AAAADS01
set-samaccountpasswordhash : Access is denied At line:1 char:1