Active Directory
Windows and Active Directory tradecraft.
-
Password spraying that respects lockout policy
Read the lockout threshold and window first, then spray one password per window across all users to stay under it.
Active Directory
-
Relay NTLM to LDAP to configure RBCD
When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.
Active Directory
-
Map ACL attack paths with BloodHound before touching anything
Collect once, then let the graph show the shortest ACL path from your foothold to Domain Admin.
Active Directory
-
DNSAdmins to Domain Controller via server-level DLL
Membership in DNSAdmins can load an arbitrary DLL into the DNS service, which runs as SYSTEM on the DC.
Active Directory
-
Abuse writable GPOs for code execution on an OU
Write access to a GPO linked to an OU means an immediate or scheduled task on every computer in that OU.
Active Directory
-
Read LAPS passwords with extended rights
Delegated read of the LAPS attribute lets you pull local admin passwords for every managed machine you can see.
Active Directory
-
sAMAccountName spoofing (noPac) to impersonate a DC
Renaming a machine account to match a DC and requesting a ticket after reset yields a service ticket as domain admin.
Active Directory
-
DCSync with replication rights
Any principal granted DS-Replication-Get-Changes rights can pull every hash in the domain, including krbtgt.
Active Directory
-
Abuse unconstrained delegation with a coerced DC
A host with unconstrained delegation caches TGTs of everyone who authenticates; coerce a DC to it and steal the DC TGT.
Active Directory
-
ESC8: coerce a DC and relay to AD CS web enrollment
HTTP certificate enrollment plus machine coercion turns any domain foothold into a DC certificate and DCSync.
Active Directory