In this demonstration,
we're going to take a look at creating a rogue domain controller with DCShadow,
which allows you to manipulate Active Directory data.
This allows us to insert objects into our fake DC,
which is then followed by a push to the actual live domain controller.
Once the attack has been completed,
the rogue DC will be taken back down immediately.
This type of attack is very effective when attempting to evade defenses as
you can modify data within Active Directory, and there is a possibility
that security monitoring tools may not be configured to look for this type
of behavior. For this demonstration, creating a rogue domain controller
with DCShadow, it's important to understand that you need to have two
Mimikatz windows running.
So in this case,
I've got Mimikatz running once as a domain
administrator for Globomantics domain.
In this case I've got cmd running as Windows authority system,
so we're going to go ahead and browse over to the mimikatz directory.
All right,
so here we're at
c:\Users\olaf.jackson\Desktop\mimkatz_trunk\x64. We'll
run mimikatz,
do a privilege::debug, and here we are running the
mimikatz as NT AUTHORITY. Perfect.
So let's go ahead and use lsadump::dcshadow, and then object:CN=mary.smith,
so the domain object container for mary.smith, and then
comma, CN=Users, domain controller,
which is GLOBOMANTICS, and we've got the .LAB we've got to add there, so
DC=LAB1 for GLOBOMANTICS.LAB1. And now the attribute, in this case, is simply
the description. The value that we want to change for the description would
just be Pluralsight. So we've got lsadump::dcshadow /objectCN=mary.smith, and
CN users and the DC=GLOBOMANTICS and DC=LAB1 /attribute:description /value,
value that we're going to change.
Okay, the RPC bind is registered and the server is waiting.
So, in this other window where we're an administrator, mind you a domain
administrator, we can do lsadump::dcshadow /push. And there we go,
as you can see, after the change took into effect,
it did stop the server and now let's take a look at the user
info to make sure that it was actually changed.
After jumping over to the Windows 2016 server,
we can see that mary.smith here has the description
Pluralsight that's been added.