No computer object acls about sharphound2

[rvazarkar]

As far as I'm aware, if you reset the password of a computer account, it becomes de-synced from active directory, and can cause several issues. I'll have to test again, but that's my understanding of the issue

[JoernHe]

You are right. But you can authenticate as a domain controller to another domain controller after the reset and perform a dc sync (and get the history of the DC object password). After that you could reset it to the old password. The same with an exchange computer object.

[JoernHe]

I just saw that issue #230 in bloodhound is almost the same.

[rvazarkar]

Can you design a Proof of Concept of this attack? What risks are involved?

[HarmJ0y]

"you could reset it to the old password" - as you only have the hash, does that mean you would need to use the mimikatz lsadump::setntlm or dcshadow approach to plant the previous hash into the AD database? My gut feeling is that this approach would be fairly disruptive to a normal environment with a lot of things that could go wrong operationally.