gMSAbuse

PS script designed to enumerate gMSA(s) in an AD environment and identify overly permissive accounts that the current user can abuse.
Script follows this articles methodology: Abusing and Securing Group Managed Service Accounts.

Methodology

• Identify current user & their membership(s)
• Enumerate gMSA(s) in the domain that have group membership(s)
• Check if current user has permission to modify gMSA attribute(s)
  • GenericAll, WriteProperty, WriteProperty on mdDS-GroupMSAMembership attribute
• Report vulnerable gMSA(s) with potential to abuse
• Attempts to retrieve NT-Hash on gMSA(s) from msDS-ManagedPassword attribute

Credit

Kevin Joyce for gMSA_Permissions_Collection.ps1 script base