gMSADumper
Reads the managed password of gMSA accounts and returns their NT hash.
Reads the managed password of gMSA accounts (msDS-ManagedPassword attribute) for principals allowed in msDS-GroupMSAMembership, returning the NT hash ready for Pass-the-Hash.
Family General
Flags -u -p -d -l
Concepts gMSA Password Read
Cheatsheet Post-exploitation & lateral
Installation
git clone https://github.com/micahvandeusen/gMSADumperUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.