Active Directory
Windows and Active Directory tradecraft.
-
ESC1 certificate template abuse for domain admin
A template that allows enrollee-supplied subject and has a client-auth EKU lets a low-priv user request a cert as any account.
Active Directory
-
AS-REP roast accounts without preauth
Accounts with Kerberos preauth disabled hand out an offline-crackable blob to any unauthenticated requester.
Active Directory
-
Targeted Kerberoasting by writing an SPN
With write access to a user object, set a fake SPN, roast the ticket offline, then remove the SPN.
Active Directory
-
Shadow Credentials for a quiet takeover
Write access to msDS-KeyCredentialLink lets you add your own key and authenticate as the object via PKINIT without touching its password.
Active Directory
-
Resource-based constrained delegation from a single GenericWrite
One writable computer object plus a controlled account lets you S4U your way to any user on that host.
Active Directory
-
Kerberoast only what you can crack
Requesting every SPN ticket is loud and mostly useless. Target accounts with weak, human-set passwords.
Active Directory