GNU/Linux xterm-256color bash 6 views

The goal here is to force the usage of the scenario AddKeyCredentialLink when we have the permission to write on a user.

With a GenericAll on a GMSA account the scenario priority is:

  • GenericAll -> AddGMSAReader -> ReadGMSAPassword
  • GenericAll -> AllExtendedRights -> ForceChangePassword
  • GenericAll -> GenericWrite -> AddKeyCredentialLink
  • GenericAll -> GenericWrite -> WriteUserAccountControl
  • GenericAll -> GenericWrite -> WriteSPN
  • GenericAll -> GenericWrite -> SetLogonScript

More recordings by shellinvictus

GriffonAD demo 3:34

by shellinvictus