CrackMapExec VS laps-web

Let’s walk through a typical attack against the Administrator account using a popular tool, CrackMapExec.

Attackers like to use crackmapexec to exploit Windows networks and machines. It can achieve various goals like enumerating users, cracking SMB shares, and injecting shellcode into memory.

After gaining a local administrator NTLM password hash using SMB relay attacks, Redbot Security used the “CrackMapExec” tool to pass the local administrator hash to all systems and found multiple systems using the same password:

ntlmrelayx2proxychains aims to connect the tool of the SecureAuthCorps' impacket suite, ntlmrelayx.py (hereafter referred to as "ntlmrelayx"), along with @byt3bl33d3r's tool, CrackMapExec (hereafter referred to as "CME"), over proxychains, developped by haad.

CrackMapExec - Swiss army knife for pentesting networks.

Regarding network shares, I personally tend to use crackmapexec with a list of systems. It won't list the ACLs but it is very good at finding out what a standard domain user could access (if this is what you are after) https://github.com/byt3bl33d3r/CrackMapExec

Bleh, use this instead which logs access and also can forcibly rotate the password in a time of your choosing after a password is accesed. https://github.com/lithnet/laps-web

Also, a couple of people have mentioned LAPS web: https://github.com/lithnet/laps-web This is a friendly interface for dealing with LAPS. I personally have not used it, but folks in this thread are reporting good results. This sort of thing may reduce the level of resistance.

Have a look at - https://github.com/lithnet/laps-web

Change workstation admin to LAPS Admin - get your staff to use https://github.com/lithnet/laps-web to easily retrieve creds on the go.