Clear-text credentials in the domain
In this section, we will discuss different ways to obtain credentials in clear text. However, we will not touch on things such as the password.txt file left on the share, the default set of credentials for some applications, and pushing the WDigest parameter so a password can be dumped in clear text from memory. We also will not discuss Internal Monologue attack[1] that allows to obtain credentials without touching LSASS[1]. Our focus is solely on Active Directory. We may find a very old pre-Windows 2000 computer in the domain or the domain may be vulnerable to MS14-025 with the local administrator password encrypted in a Group Policy file. We can try our luck with password spraying or by searching for a password in an Active Directory user’s comment field.
Old, but still worth trying
Recently, I came across some intriguing research published by Oddvar Moe regarding pre-created computer accounts[2]. Apparently, checking the Assign this...
