-
Notifications
You must be signed in to change notification settings - Fork 131
Open
Description
I would like to try KrbRelay on a windows server 2022 but the COM class associated to the default CLSID for this attack is not available on it.
I tried finding one with oleviewdotnetv1.6 and adapting what you did with an older version but when I do:
Import-Module .\OleViewDotNet
Get-ComDatabase
Get-ComProcess -DbgHelpPath 'C:\My\Imported\dbghelp.dll' | select ProcessId,ExecutablePath,Name,AppId,User,AuthnLevel,ImpLevel
I only find processes running with my standard user and with AuthnLevel and ImpLevel DEFAULT.
I also tried using CLSID from those outputs:
Get-ComClass -server | Select-ComAccess
Get-ComClass | Select-ComAccess -Level ActivateLocal
Get-ComClass | SelectComAccess
But always get a COM exception.
Could someone help me to clarify what I should look for exactly in order to leverage the KrbRelay? And also why I'm only able to see processes running with my standard user?
Metadata
Metadata
Assignees
Labels
No labels