Ways to exploit AD in context of Domain Computer account not as Domain user account?

Question

There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account.

Now I am here to ask what can be the attack ways of AD in the perspective of a domain computer account, or more specifically, suppose "You got ACCESS to AD Joined Domain Machine but the user you compromised is Local Administrator NOT Domain User/Administrator?"

How will you approach?

This might be a generic question, but I have segregated it down to only for computer joined machines.

Or in other words: Ways to exploit Non-Domain users to become a Domain User?

Answer 1

I will answer the following question: "You got ACCESS to AD Joined Domain Machine but the user you compromised is Local Administrator NOT Domain User/Administrator?"

Before starting, I think that this is a very interesting question and not wide at all.

Here is the deal, you started as a LA which basically means that you can perform almost anything you want on the current BOX. Great! Let's analyze this:

• You are LA therefore you could have a look at the secrets stored in the computer. This includes tickets from the users that logged there, the LSASS process (and the users that interacted there), and of course the NTLM of the machine account ( you can identify these because they have a $ at the end of their name, like WS001$ , also it would be possible to check for PowerShell history files, or browser's bookmarks. Basically run local checks in order to enumerate local information that might be useful to elaborate further attacks
• Now I assume that the computer where you are working from is domain joined. Lucky you, you have the NTLM of the local Administrator account and therefore you can perform actions like if you were the host. This is your lucky day because AD treats computer accounts and user accounts very similarly, therefore you can perfectly execute bloodhound and obtain relevant data! Thanks to a bloodhound, you discovered that one of the users that had a Kerberos ticket in memory, Larry has GenericAll permission over the user ADM-Larry which is a Domain Admin! Then you will grab the ticket, inject it with Rubeus, modify the password of ADM-Larry and finally impersonate ADM-Larry. Now you are free to do whatever you want including a DC-Sync in the DC!

Reference about the GenericAll attack:

https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces