Question

During an internal engagement, you have compromised an account that is a member of a group with the 'Replicating Directory Changes' and 'Replicating Directory Changes All' extended rights on the domain object. You want to obtain the NTLM hash of the KRBTGT account without executing code on a domain controller or triggering endpoint detection on the DC itself. Which technique should you use?

Accepted Answer

Run a DCSync attack using mimikatz 'lsadump::dcsync /user:krbtgt' from your foothold to request replication of the account's secrets

Answer

Upload and run secretsdump against the local SAM hive of the compromised workstation to extract the KRBTGT hash

Answer

Deploy Mimikatz directly on the domain controller and run 'sekurlsa::logonpasswords' against LSASS memory

Answer

Perform Kerberoasting against the KRBTGT SPN and crack the resulting ticket offline