Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
Why can't I add users directly via PyPSRP in ProxyShell exploitation, and what is the workaround?
Directly adding users via PyPSRP fails because passing a password requires executing the PowerShell `ConvertTo-SecureString` command, which is not supported by Exchange PowerShell Remoting. The workaround is to invoke local PowerShell by first setting up a local Flask proxy server to handle load balancing, then configuring WinRM, `allowunencrypted`, and `TrustedHosts` on the target system. After that, you can establish a PowerShell session and use `Invoke-Command` with the `-ArgumentList` parameter to pass the secure password string, as demonstrated in the [ProxyShell exploitation chain](/news/proxyshell-exploitation-analysis-2-cve-2021-34523).
What is the purpose of AdFind in the context of obtaining DNS records?
AdFind is a non‑open‑source C++ tool used for querying domain information, including domain controllers and active computers. It can help identify machines in the domain, which complements DNS record collection. However, its query efficiency is lower in some scenarios. For command examples like listing domain controllers or active computers, see the [AdFind section](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges#adfind) in the article.
How does dns-dump.ps1 work, and what fix was needed for newer Windows systems?
dns-dump.ps1 obtains DNS records by querying LDAP for DNS zones and decoding the binary DNS record data to extract actual content. The original script failed on Server 2008 R2 and Server 2012 R2 because its LDAP query statement needed modification. The article provides a patched version and links to the updated script. For the implementation details, see the [dns-dump section](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges#dns-dump) and the related [PowerView article](/news/domain-penetration-dns-records-and-machineaccount).
What is the difference between SharpAdidnsdump and adidnsdump?
SharpAdidnsdump is a C# tool for Windows that directly queries LDAP for computer names and then performs DNS lookups, while adidnsdump is a Python-based tool that requires the impacket library and is typically used on Linux systems. Both can obtain DNS records with regular domain user credentials (plaintext password or NTLM hash). For more details and examples, refer to the [original article](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges) and the related [DNS Records and MachineAccount article](/news/domain-penetration-dns-records-and-machineaccount).
How can regular domain users obtain DNS records without DNS admin privileges?
Regular domain users can obtain DNS records using two main approaches: first, by querying LDAP for computer names and then resolving their IP addresses via DNS queries (tools like [SharpAdidnsdump](https://github.com/b4rtik/SharpAdidnsdump) and [adidnsdump](https://github.com/dirkjanm/adidnsdump) implement this); second, by directly extracting DNS records from LDAP and decoding the binary data (as done by [dns-dump](/news/domain-penetration-dns-records-and-machineaccount) and PowerView). These methods are covered in detail in the article [Domain Penetration - Obtaining DNS Records with Regular User Privileges](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges).
How does the USN Journal relate to NTFS file time attributes, and what additional insights does it provide?
While NTFS file time attributes (like last modified, creation time) can be modified by attackers, the USN Journal provides an independent chronology of file changes that is harder to alter without specialized tools. By cross-referencing the journal’s timestamps and reasons with the file’s metadata, investigators can spot discrepancies that reveal tampering. This complements the time attribute modification techniques discussed in [Penetration Techniques - Time Attributes of NTFS Files in Windows](/news/penetration-techniques-usn-journal-of-ntfs-files-in-windows).
What are the recommended forensic methods to detect tampering with the USN Journal?
Forensic investigators should first read and list all USN Journal records using tools like `fsutil usn enumdata` or specialized utilities such as ExtractUsnJrnl and UsnJrnl2Csv, then look for gaps or anomalies. However, because sophisticated attackers may modify the journal directly, additional cross‑checks like parsing $MFT records from memory with tools like MftCarver are recommended. These approaches are detailed in [Penetration Techniques - USN Journal of NTFS Files in Windows](/news/penetration-techniques-usn-journal-of-ntfs-files-in-windows).
How can an attacker clear or tamper with the USN Journal to hide their tracks?
Attackers can try using the `fsutil usn deletejournal` command or the `DELETE_USN_JOURNAL_DATA` API, but these may not succeed due to system protections. Alternatively, they can directly modify the $Extend\$UsnJrnl metafile using tools like WinHex after bypassing driver signing restrictions, or they can brute-force overwrite records by performing many file operations until the journal wraps around. For related evasion techniques, see [Penetration Techniques - Backdoor Exploitation of Junction Folders and Library Files](/news/penetration-techniques-backdoor-exploitation-of-junction-folders-and-library-files).
What is the USN Journal and what kind of information does it record?
The USN Journal (Update Sequence Number Journal), also known as the Change Journal, is a feature of NTFS that logs all modifications to files and directories on a volume, including creation, deletion, renaming, and encryption changes. Each entry contains a timestamp, reason code, file name, and references to the file and its parent. For more context on NTFS forensic techniques, see [Penetration Techniques - USN Journal of NTFS Files in Windows](/news/penetration-techniques-usn-journal-of-ntfs-files-in-windows).
Can DCSync be executed from a machine outside the domain? If so, how?
Yes, the approach is the same as from a domain host but performed externally. The attacker must have network access to a domain controller and valid domain credentials (e.g., using secretsdump.py with a password or hash). Tools like Mimikatz can also be used remotely if a high-privilege ticket is imported. The core requirement remains the same: possession of sufficient privileges on the target domain. For complete methods, see the [Domain Penetration - Method to Export All Domain User Hashes Using DCSync](/news/domain-penetration-method-to-export-all-domain-user-hashes-using-dcsync) article.
What defense recommendations are provided to detect or prevent DCSync attacks?
The primary recommendation is to monitor Windows Event ID 4662, which logs directory service object accesses. Since DCSync requires high privileges (Administrators, Domain Admins, Enterprise Admins, or domain controller computer accounts), limiting and auditing these groups is critical. Additionally, restrict replication rights to only necessary accounts. For more on DCSync exploitation and detection, refer to the [Domain Penetration - DCSync](/news/domain-penetration-dcsync) article.
How can an attacker execute DCSync from a domain-joined host that is not a domain controller?
The attacker first obtains a high-privilege ticket—either by generating a Golden ticket with the krbtgt hash using Mimikatz or by using Rubeus to request a TGT for a privileged user. After importing the ticket with SharpTGTImporter, they run SharpDCSync to export hashes. Alternatively, Mimikatz itself can perform DCSync after ticket import or Over pass the hash. For related privilege escalation tactics, see [Domain Penetration - Obtaining DNS Records with Regular User Privileges](/news/domain-penetration-obtaining-dns-records-with-regular-user-privileges) and [Domain Penetration - Using Specific ACLs in Exchange Server for Domain Privilege Escalation](/news/domain-penetration-using-specific-acls-in-exchange-server-for-domain-privilege-escalation).
What tools can be used to execute a DCSync attack and how do they differ?
Common tools include Mimikatz (C implementation), secretsdump.py (Python), MakeMeEnterpriseAdmin (PowerShell/C#), and modified C# versions like SharpDCSync. Mimikatz can export all or single user hashes, while secretsdump.py is a Python alternative. The C# implementations offer a .NET-based approach requiring a prior high-privilege ticket. Each tool ultimately performs the same replication request but differs in execution environment and command syntax. Refer to the main article for detailed command examples.
What permissions are required to perform a DCSync attack to export all domain user hashes?
You need permissions for any of the following: Administrators group, Domain Admins, Enterprise Admins, or the computer account of a domain controller. DCSync exploits the Directory Replication Service (DRS) protocol, which demands these high privileges. For a full breakdown, see the [Domain Penetration - Method to Export All Domain User Hashes Using DCSync](/news/domain-penetration-method-to-export-all-domain-user-hashes-using-dcsync) article.
How can I use Advanced Query Syntax (AQS) to search for emails within a specific date range using exchangelib?
Exchangelib supports AQS via the `querystring` parameter. For a date search, you can use syntax like `sent:>=2021/1/1 AND sent:<=2021/12/30` or `received:>=2021/1/1 AND received:<=2021/12/30`. However, note that AQS cannot be used for keyword searches directly; you must first retrieve emails and then perform string matching in Python. The [open‑source downloader](/news/exchange-web-service-ews-development-guide-5-exchangelib) demonstrates this by implementing an AQS‑based search feature alongside folder enumeration and attachment extraction.
When compiling an exchangelib-based Python script into an executable with PyInstaller, I get a 'No time zone found with key UTC' error. How can I fix this?
The error occurs because PyInstaller excludes the `tzdata` package that exchangelib needs for time zone handling. As mentioned in the [guide](/news/exchange-web-service-ews-development-guide-5-exchangelib), the solution is to compile with the `--collect-all tzdata` flag and `--onefile`: `pyinstaller --collect-all tzdata --onefile test.py`. This ensures all time zone data is bundled into the executable, allowing the script to process email timestamps correctly.
How can I log in to an Exchange server using an NTLM hash instead of a plaintext password with exchangelib?
To use an NTLM hash for authentication in exchangelib, pass the hash string directly as the password argument when creating a `Credentials` object. For example: `Credentials('DOMAIN\\username', '00000000000000000000000000000000:7C451851EA87B63EC7692126416D01EB')`. This enables pass‑the‑hash attacks in penetration testing scenarios, similar to the approach described in the [requests_ntlm guide](/news/exchange-web-service-ews-development-guide-6-requests-ntlm). The library automatically uses NTLM authentication over SOAP XML.
What is exchangelib and how does it simplify Exchange Web Service development compared to lower-level SOAP XML methods?
Exchangelib is a Python library that abstracts the lower-level SOAP XML communication with Exchange servers. As covered in this [guide](/news/exchange-web-service-ews-development-guide-5-exchangelib), it allows developers to access Exchange resources such as emails and attachments using simple Python objects, eliminating the need to manually construct SOAP messages. This is especially useful for automating tasks like email downloading or attachment extraction, whereas earlier articles in the [series](/news/exchange-web-service-ews-development-guide) focused on raw XML for understanding protocol internals.
How do I perform a SOAP login using pre-authentication and retrieve an auth token?
To perform a SOAP login with pre-authentication, send a POST request to `/service/soap` with a body containing the username and the preauth token (`<preauth>` element). The server responds with an `<authToken>` if successful. You can then reuse this token for subsequent SOAP operations like listing folders. Code examples for both the login request and folder retrieval are in the [Zimbra SOAP API Development Guide 6 - Pre-authentication](/news/zimbra-soap-api-development-guide-6-pre-authentication1). For more SOAP basics, see the [Zimbra SOAP API Development Guide](/news/zimbra-soap-api-development-guide).
How can I compute the pre-authentication token using Python?
The article provides a Python 3 script that computes the preauth token. It takes the target server URL, PreAuthKey, and mailbox (e.g., `[email protected]`), then constructs an HMAC-SHA1 hash using the format `{mailbox}|name|0|{timestamp}`. The script outputs a URL that you can open in a browser to log in automatically. Full code and usage are shown in the [Zimbra SOAP API Development Guide 6 - Pre-authentication](/news/zimbra-soap-api-development-guide-6-pre-authentication1).