-
Notifications
You must be signed in to change notification settings - Fork 131
Open
Description
I would like to try KrbRelay on a windows server 2022 but the COM class associated to the default CLSID for this attack is not available on it.
I tried finding one with oleviewdotnetv1.6 and adapting what you did with an older version but when I do:
Import-Module .\OleViewDotNet
Get-ComDatabase
Get-ComProcess -DbgHelpPath 'C:\My\Imported\dbghelp.dll' | select ProcessId,ExecutablePath,Name,AppId,User,AuthnLevel,ImpLevel
I only find processes running with my standard user and with AuthnLevel and ImpLevel DEFAULT.
I also tried using CLSID from those outputs:
Get-ComClass -server | Select-ComAccess
Get-ComClass | Select-ComAccess -Level ActivateLocal
Get-ComClass | SelectComAccess
But always get a COM exception.
Could someone help me to clarify what I should look for exactly in order to leverage the KrbRelay? And also why I'm only able to see processes running with my standard user?
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels