dcshadow
lsadump::dcshadow performs a DCShadow attack.
DCShadow is a feature in mimikatz located in the lsadump module. It simulates the behavior of a Domain Controller (using protocols like RPC used only by the DCs) to inject its own data, bypassing most of the common security controls and including many SIEMs. It shares some similarities with the DCSync attack lsadump::dcsync. More information for DCShadow can be found on dcshadow.com.
Command Line argument(s) to run as SYSTEM:
/kill: it is used when you want to delete an object/object: The Distinguished Name (DN) of the Active Directory object to modify/domain: the domain to target. The default is the current domain/dc: the FQDN of the domain controller/attribute: The name of the Active Directory Schema attribute to modify/value: the object's value which is depended on the specified attribute/replOriginatingUsn: The Update Sequence Number/multiple: an array of values (specifying multiple values)/replOriginatingTime: As the name instructs the replication originating time. More info can be found at this guide/replOriginatingUid: It specifies the UID of the domain controller which performed/requested the change. More info can be found at this guide
Command Line Argument(s) to run in push mode as Domain or Enterprise Admin:
/push: push the changes/stack: stack the changes and then replicate them all/schema: The active directory schema partition/config: The active directory configuration partition/root: The active directory root/domain: the domain to target. The default is the current domain/dc: the FQDN of the domain controller/computer: The FQDN of the computer to register. The default is the computer on which DCShadow is executed./viewstack: View the stack of the changes which are going to be replicated/clearstack: it clears the stack/manualregister: it registers the server manually/manualunregister: It unregisters the server manually/manualpush: it pushes the changes manually
Escalate a domain user
In the following example the low privileged user hacklab.local\optimus will be added to the "Domain Admins" group:
Obtain debug privileges
From a command line opened as admin, obtain an NT AUTHORITY\SYSTEM privilege.
Modify the group id
Push the changes
To push the changes a second CMD with Domain or Enterprise Admin privileges must be opened:
After the successful pushing the user is now part of the "Domain Admins":
Last updated