[Raphgui]

Hello,
I recently did an active directory pentest. And I managed to go to the DC but the administrator user was in protected user. So impossible to do mimikatz to recover his hash nt. 

Anyone got any tricks? 

https://pbs.twimg.com/profile_images/462...00x400.png

[Raphgui]

If any body have idea ?

[god]

Hello,
I recently did an active directory pentest. And I managed to go to the DC but the administrator user was in protected user. So impossible to do mimikatz to recover his hash nt. 

Anyone got any tricks? 

https://pbs.twimg.com/profile_images/462...00x400.png

you didnt gave so much informations, so i assume you only have an user shell without any Administrator right.
There is 4 ways to interact with LSA :
processes; winlogon; kernel-mode; and CredUI.
In your case kernel an winlogon are ofc forbidden, so you will have to focus on credui.dll and processes.
taking a quick look at credui.dll reveals many things.

username@domain DOMAIN\username

are the credentials you should provide to interact efficiently with lsass and globally LSA from credui.
we can see the dll stores an username, a password, a PIN and a certificate.
You can try to abuse this dll, its not seriously protected, the imports table looks decent. You can also try to get more privileges by another way and then try a token impersonation or smth similar, maybe ProcDump, cme...

[Raphgui]

Hello,
I recently did an active directory pentest. And I managed to go to the DC but the administrator user was in protected user. So impossible to do mimikatz to recover his hash nt. 

Anyone got any tricks? 

https://pbs.twimg.com/profile_images/462...00x400.png

you didnt gave so much informations, so i assume you only have an user shell without any Administrator right.
There is 4 ways to interact with LSA :
processes; winlogon; kernel-mode; and CredUI.
In your case kernel an winlogon are ofc forbidden, so you will have to focus on credui.dll and processes.
taking a quick look at credui.dll reveals many things.

username@domain DOMAIN\username

are the credentials you should provide to interact efficiently with lsass and globally LSA from credui.
we can see the dll stores an username, a password, a PIN and a certificate.
You can try to abuse this dll, its not seriously protected, the imports table looks decent. You can also try to get more privileges by another way and then try a token impersonation or smth similar, maybe ProcDump, cme...

Thanks for ur answer. So i be admin with constrained delagation to s4u2self. But now i be Nc Authority system on the DC but the administrator user or krbgt be on the groupe protected user. So i look credui.dll.

[joepa]

Dump all AD hashes, and use pass the hash.