Authentication
Forging Kerberos Tickets: Golden and Silver Tickets in GOAD
DCSync handed us the krbtgt hashes and service-account hashes. This is what they are actually for: forging a Golden Ticket for the whole forest, and a Silver Ticket for one SPN — logging in as Administrator without a password, and why the two differ.
Cross-Forest Pivoting via SQL Server Linked Servers: Bypassing Kerberos Trust Boundaries
Deconstructing SQL Server linked-server lateral movement in GOAD: from a cracked service account (jon.snow) to xp_cmdshell execution as north\sql_svc, pivoting through sa-mapped linked servers into essos\sql_svc without Kerberos trust authentication.
AD CS Part 4: The Rest of the Catalog and How to Lock It Down
Closing the AD CS series: ESC2's any-purpose EKU, ESC3's enrollment-agent escalation, the identity-mapping weaknesses of ESC9, and the relay-based ESC8/ESC11 — then the four-question hardening checklist that ties the whole taxonomy back together.
AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself
Part 2 exploited ESC1, a template that was already vulnerable. This part creates the vulnerability: ESC4 edits a template you have GenericAll over into an ESC1, and ESC6 abuses the CA-wide User Specified SAN flag to stuff a Subject Alternative Name into any Client Authentication template.
AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise
Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync.
AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy
Deconstructing the Active Directory Certificate Services attack surface: template attributes, PKINIT credential exchange, EKU semantics, identity mapping, and the ESC taxonomy mapped by root cause.
Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords
DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems.
GOAD Part 4: Owning essos.local Across the Forest Trust
The forest trust into essos.local enforces SID filtering, so a forged ExtraSids ticket will not carry Domain Admin across the boundary. What does cross is foreign group nesting, a three-hop ACL chain, LAPS, and an AD CS CA full of ESC templates.
Password Spraying: One Password, Every Account
The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022.
Inside Kerberos Delegation: Why Multi-Tier Windows Apps Need It (and Why It Breaks)
Walking through the Kerberos double-hop problem and the three generations of delegation in Windows: how Unconstrained, Constrained (S4U2Self / S4U2Proxy), and Resource-Based Constrained Delegation (RBCD) look in LDAP across the GOAD lab.
Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work
Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths.