Force NTLM Privileged Authentication
Last updated
Was this helpful?
Last updated
Was this helpful?
If the Print Spooler service is enabled, you can use some already known AD credentials to request to the Domain Controller’s print server an update on new print jobs and just tell it to send the notification to some system. Note when printer send the notification to an arbitrary systems, it needs to authenticate against that system. Therefore, an attacker can make the Print Spooler service authenticate against an arbitrary system, and the service will use the computer account in this authentication.
Using PowerShell, get a list of Windows boxes. Servers are usually priority, so lets focus there:
Using a slightly modified @mysmartlogin's (Vincent Le Toux's) , see if the Spooler Service is listening:
You can also use rpcdump.py on Linux and look for the MS-RPRN Protocol
You can compile.
or use or if you're on Linux
If you are already inside the Windows machine you can force Windows to connect to a server using privileged accounts with:
If an attacker has already compromised a computer with , the attacker could make the printer authenticate against this computer. Due to the unconstrained delegation, the TGT of the computer account of the printer will be saved in the memory of the computer with unconstrained delegation. As the attacker has already compromised this host, he will be able to retrieve this ticket and abuse it ().
If you can capture . Remember that in order to crack NTLMv1 you need to set Responder challenge to "1122334455667788"