Skip to content
Windows Post-Exploitation
-
Loot the Credential Manager and Windows Vault
Saved RDP, web, and network credentials in the Vault are DPAPI-protected but decrypt trivially in the user's own session.
Windows Post-Exploitation
-
Extract Kerberos tickets and keys from LSA with Rubeus
Dumping tickets from LSA gives you TGTs to pass, and requesting them for kerberoastable SPNs yields hashes to crack offline.
Windows Post-Exploitation
-
Move as another logged-on user by stealing their token
On a multi-user host, duplicating the primary token of another session lets you act as that user, including a domain admin who logged in.
Windows Post-Exploitation
-
Persist with a WMI permanent event subscription
A filter-to-consumer binding stored in the WMI repository runs your payload on an event trigger with no file on disk and no Run key.
Windows Post-Exploitation
-
Escalate through weak service permissions and unquoted paths
A service you can reconfigure, or one whose unquoted path runs through a writable directory, executes your binary as its account on restart.
Windows Post-Exploitation
-
SeImpersonate to SYSTEM with a potato technique
A service account holding SeImpersonatePrivilege can coerce a SYSTEM authentication and duplicate its token for a full-privilege shell.
Windows Post-Exploitation
-
Decrypt DPAPI secrets with the domain backup key
With the domain DPAPI backup key from a DC, you can decrypt any user's masterkeys and the browser, vault, and RDP secrets they protect, offline.
Windows Post-Exploitation
-
Dump LSASS quietly with the comsvcs MiniDump export
A signed rundll32 call into comsvcs.dll writes an LSASS minidump without dropping mimikatz, sidestepping name-based detections.
Windows Post-Exploitation