DCSync

Information

Includes the following rights:

1. Replication-Get-Changes

2. Replicating Directory Changes All

3. Replicating Directory Changes In Filtered Set (not always)

Default setting: Domain Admins, Enterprise Admins, Administrators, and Domain Controllers.

Exploitation

Enumerate rights.

Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs | ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll') -or ($_.ActiveDirectoryRights -match 'WriteDacl')}