How can an attacker use a low-privilege user with DCSync rights to export domain hashes without interactive logon?

Using PowerShell, the attacker can start a process as the low-privilege user with Start-Process and -Credential, then execute mimikatz commands to dump hashes. Alternatively, runas with a batch file can run DCSync in the background, exporting results to a text file. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Use powershell to find a writable windows service](/news/use-powershell-to-find-a-writable-windows-service) - [Windows Shellcode Study Notes - Extraction and Testing of Shellcode](/news/windows-shellcode-study-notes-extraction-and-testing-of-shellcode)