• Windows Security
    • Post-exploitation
      • Network Tunneling
        (Ligolo-ng, Chisel)
      • Reverse Shell
      • System Manipulation
      • File Transfer
    • Lateral Movement
      • Common Problems
        • Double Hop
        • Remote UAC
      • Techniques
        • Access Token Manipulation
          (RunAs, RunasCs)
        • Pass-the-Ticket (Kerberos)
          (Rubeus, getTGT)
      • Technologies
        • MS-RPC
          • MS-DCOM
          • MS-RRP
          • MS-SCMR
            (PsExec, SmbExec, ScExec)
          • MS-TSCH
          • MS-WMI
            (WmiExec)
        • RDP
        • WinRM
          (winrs, PS Remoting)
    • Domain Privesc
      • ACL Abuse
      • AD Delegation Abuse
        • Constrained Delegation
        • Resource-Based Constrained Delegation
        • Unconstrained Delegation
      • AS-Rep Roasting
      • Certificate Service Abuse
      • Credentials Dump
        • DCSync
        • LSASS Memory
        • Local SAM
        • Windows Vault
      • Group Policies
      • Information to steal
        (files, logs, processes, ...)
      • Kerberoasting
      • Local Admin Hunting
      • MSSQL Abuse
      • NTLM Hash Stealing
      • NTLM Relay
      • Password Spraying
      • RDP Hijacking
      • Tasks and Services Abuse
    • Reconnaissance
      • Active Directory
      • DNS
      • LDAP
      • NetBIOS
      • NFS
      • Port Scanning
      • RPC
      • SMB
      • SMTP
      • SNMP
#Windows Security #Domain Privesc

Windows AD Domain Privilege Escalation

Privilege scalation is defined here as gaining access to resources not normally available to the current user. In an Active Directory domain network, this is done by abusing misconfigurations and some common weaknesses in known functions.

Children

Domain Privesc
ACL Abuse
AD Delegation Abuse
Constrained Delegation
Resource-Based Constrained Delegation
Unconstrained Delegation
AS-Rep Roasting
Certificate Service Abuse
Credentials Dump
DCSync
LSASS Memory
Local SAM
Windows Vault
Group Policies
Information to steal
Kerberoasting
Local Admin Hunting
MSSQL Abuse
NTLM Hash Stealing
NTLM Relay
Password Spraying
RDP Hijacking
Tasks and Services Abuse