PowerMad

Powermad's New-MachineAccount cmdlet creates a new computer account in the domain over LDAP/SAMR from a Windows foothold, abusing the default ms-DS-MachineAccountQuota (10) that lets any authenticated user add machine accounts. The resulting account, with a password you supply, is the controlled principal for RBCD and shadow-credential chains carried out with SharpAllowedToAct or Rubeus. Run it in-session as any domain user; verify the quota is non-zero first. Command Reference: Domain: test.local New machine account: EVILPC Password: password123

# Import Powermad and create a new machine account
Import-Module .\Powermad.ps1
New-MachineAccount -MachineAccount EVILPC -Password $(ConvertTo-SecureString 'password123' -AsPlainText -Force)

Evidence

Upstream reference

Environment

Active Directory

Native

Exploitation, PrivEsc

Requires

PowerShell, Shell

Services

LDAP

Refs

github.com/Kevin-Robertson/Powermad

www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota

book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation