Disaster recovery specialists tend to focus on things like restoring from tape drives in a hurry.
I do general IT consulting, and all that was required was some "general security knowledge".
There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line.
If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back."
We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there.
This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks:
dir \\domainname\SYSVOL -Recurse | Select-String 'password'
The other trick is that the Configuration Manager client (or any similar agent) is often mis-configured to use the same account and password across the whole network. That, or it deploys packages with similar embedded passwords that can be read from any workstation. These type of accounts are very nearly domain admin accounts, and their password hashes are typically available on every workstation and server. Any user granted local admin rights to their own workstation can obtain it with a short PowerShell snippet.
Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3]
I do general IT consulting, and all that was required was some "general security knowledge".
There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line.
If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back."
We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there.
This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks:
The other trick is that the Configuration Manager client (or any similar agent) is often mis-configured to use the same account and password across the whole network. That, or it deploys packages with similar embedded passwords that can be read from any workstation. These type of accounts are very nearly domain admin accounts, and their password hashes are typically available on every workstation and server. Any user granted local admin rights to their own workstation can obtain it with a short PowerShell snippet.Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3]
[1] https://github.com/byt3bl33d3r/DeathStar
[2] https://adsecurity.org/?p=2288
[3] https://www.tomsguide.com/us/8-character-password-dead,news-...