DCSync does not work with PAM feature enabled about mimikatz

[asolino]

Hey @MichaelGrafnetter thanks for pointing this out! I'm downloading TP5 now and will give a try with impacket. Right now I'm expecting receiving DRS_EXT_GETCHGREPLY_V6. Cannot you control that through DRSBind.dwFlags?

[MichaelGrafnetter]

@asolino It seems that once PAM is enabled, DC only returns DRS_MSG_GETCHGREPLY_V9 and fails if the client does not support it, because otherwise it could not tell the client about the expiring links.

[gentilkiwi]

more than just fun with flags

[MichaelGrafnetter]

@gentilkiwi You read my mind!

[asolino]

All right.. fair point.. that for the clarification @MichaelGrafnetter!

[MichaelGrafnetter]

There are still a few undocumented flags, because TP5 returns this in DRS_EXTENSIONS_INT with RB+PAM enabled:
dwExtCaps = 2047
dwFlagsExt = 526
dwFlags = 1073741695

[gentilkiwi]

I get it work, you need 0x200 ;)

[gentilkiwi]

Flag validated 👍

[MichaelGrafnetter]

So it was fun with flags after all... Sorry for spreading unverified info, @asolino . But to my excuse, even the doc is somewhat smoke and mirrors.

[gentilkiwi]

It could have been much more complex.
Fortunately, the structures have very compatible unions (Req v8/v10 & Rep v6/v9)

[MichaelGrafnetter]

I have fixed it in DSInternals, too, but you beat me to it. Nevertheless, I just learned something and I had fun doing it. ;-)

[gentilkiwi]

Because I don't want to give a fuck about future flags:

• DRS_EXT_RECYCLE_BIN
• DRS_EXT_PAM
• ...

ac09c27 (pDrsExtensionsInt->dwExtCaps = MAXDWORD32)

Thank you for nice exchanges @MichaelGrafnetter & @asolino

[asolino]

That's uber potential! ;) ;) :)

thanks for the quick turn around.. and likewise @gentilkiwi & @MichaelGrafnetter

[MichaelGrafnetter]

@gentilkiwi Hopefully, your cannonball approach will turn out to be futureproof. And Ben, you really are a meme machine! ;-)