Restore Steps

[clintonm9]

Can you provide an example of how to use secretsdump.py to dump the plaintext machine password? I see that the restorepassword.py needs the hexpass, but I can not figure out how to get that.

Thanks

[dirkjanm]

If you run secretsdump.py with the "Administrator" domain user (so not the DC account!) with the latest impacket version it should give you the plaintext account password in hex. The recommended method of exploiting this is described on my blog, which does not involve resetting passwords: https://dirkjanm.io/a-different-way-of-abusing-zerologon/