Skip to content

How to find a suitable CSID? #17

@CravateRouge

Description

@CravateRouge

I would like to try KrbRelay on a windows server 2022 but the COM class associated to the default CLSID for this attack is not available on it.

I tried finding one with oleviewdotnetv1.6 and adapting what you did with an older version but when I do:

Import-Module .\OleViewDotNet
Get-ComDatabase
Get-ComProcess -DbgHelpPath 'C:\My\Imported\dbghelp.dll' | select ProcessId,ExecutablePath,Name,AppId,User,AuthnLevel,ImpLevel

I only find processes running with my standard user and with AuthnLevel and ImpLevel DEFAULT.

I also tried using CLSID from those outputs:

Get-ComClass -server | Select-ComAccess
Get-ComClass | Select-ComAccess -Level ActivateLocal
Get-ComClass | SelectComAccess

But always get a COM exception.

Could someone help me to clarify what I should look for exactly in order to leverage the KrbRelay? And also why I'm only able to see processes running with my standard user?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions