[Feature Request] Interesting MS-DRSR calls missing

[MichaelGrafnetter]

Hi, first of all, thanks again for this cool project! I just cross-referenced the supported MS-DRSR calls against what I am currently using, and these seem to be the gaps:

• IDL_DRSCrackNames - Useful for doing lookup of accounts to be replicated in a subsequent call, e.g., by UPN or SamAccountName.
• IDL_DRSWriteNgcKey - Provides an alternative way of doing the shadow credentials attack.
• IDL_DRSAddSidHistory - One practical use is intra-domain SID history cloning, which is not even exposed through the corresponding WIN32 API.
• IDL_DRSGetReplInfo - Exposes replication metadata, cursors, failures, etc. Useful for replication troubleshooting. Seems to be the hardest one to implement, because of the complex union of structures it returns.

[codewhisperer84]

Regarding IDL_DRSGetReplInfo, are there any particularly common or interesting scenarios that I should set up in the testing environment?

[MichaelGrafnetter]

Common but boring examples are:

• DS_REPL_INFO_CURSORS_FOR_NC
• DS_REPL_INFO_METADATA_2_FOR_OBJ

[ThatTotallyRealMyth]

Hey @MichaelGrafnetter and @codewhisperer84 think you guys might also find MS-DFSRH pretty interesting as it also providers alternatives to do a lot of established things(including Shadow Creds attack) in a different way by abusing the calls exposed in

[MichaelGrafnetter]

@ThatTotallyRealMyth This is definitely interesting and worth a separate request. Some research on the required permissions and pre-conditions should be done first, though, as the documentation references cluster virtual computer objects.

[ThatTotallyRealMyth]

@ThatTotallyRealMyth This is definitely interesting and worth a separate request. Some research on the required permissions and pre-conditions should be done first, though, as the documentation references cluster virtual computer objects.

Very good point! I think the idea is that the computer account/object you have local admin over can be made to make certain calls and take certain actions using those calls

[codewhisperer84]

The mentioned DRSR calls have been implemented. I don't have an environment set up yet to test the SID history functionality, but I did verify that the call is marshaled properly and returns the expected error codes.

[MichaelGrafnetter]

Thanks, @codewhisperer84, I will test it ASAP. I am not sure if AddSidHistoryCommand is semantically correct. See the documentation of my Add-ADReplSidHistory cmdlet, which supports both intra-forest and cross-forest migration and its semantics supports user, group, and computer accounts to be migrated, hence the Principal in parameter names.