Identity Security

PentestNov 6, 20266 min read

DNSAdmins and Backup Operators: Privileged Group Abuse to SYSTEM on the DC

The last two GOAD techniques are not exploits but groups: DNSAdmins loads a DLL into the DNS service, Backup Operators reads what the OS would rather hide. One is demonstrated end to end, one is documented honestly with the remote-registry wrinkle, and the relay gap that neither covers is called out.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 6, 20267 min read

Skeleton Key: A Master Password for Every Account in the Domain

After Domain Admin, the game changes from getting in to staying in. The Skeleton Key patches the Domain Controller's KDC in memory so the single password 'mimikatz' unlocks every account — demonstrated live against KINGSLANDING, alongside the memory SSP and why DSRM does not apply in this lab.

#active-directory#pentest#red-team#identity-security#attack-paths

PentestNov 6, 20264 min read

Offline Domain Dump: Shadow Copies and NTDS.dit

DCSync is the online way to pull hashes — but it needs replication rights. The offline way asks for nothing from the DC: take a shadow copy of C:, copy the NTDS.dit database and SYSTEM hive out, and dump every credential on your own machine with no Domain Controller cooperation.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 6, 20265 min read

Forging Kerberos Tickets: Golden and Silver Tickets in GOAD

DCSync handed us the krbtgt hashes and service-account hashes. This is what they are actually for: forging a Golden Ticket for the whole forest, and a Silver Ticket for one SPN — logging in as Administrator without a password, and why the two differ.

#active-directory#pentest#authentication#attack-paths#identity-security

PentestNov 5, 20268 min read

Cross-Forest Pivoting via SQL Server Linked Servers: Bypassing Kerberos Trust Boundaries

Deconstructing SQL Server linked-server lateral movement in GOAD: from a cracked service account (jon.snow) to xp_cmdshell execution as north\sql_svc, pivoting through sa-mapped linked servers into essos\sql_svc without Kerberos trust authentication.

#active-directory#pentest#attack-paths#identity-security#authentication

PentestNov 5, 20265 min read

AD CS Part 4: The Rest of the Catalog and How to Lock It Down

Closing the AD CS series: ESC2's any-purpose EKU, ESC3's enrollment-agent escalation, the identity-mapping weaknesses of ESC9, and the relay-based ESC8/ESC11 — then the four-question hardening checklist that ties the whole taxonomy back together.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 5, 20265 min read

AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself

Part 2 exploited ESC1, a template that was already vulnerable. This part creates the vulnerability: ESC4 edits a template you have GenericAll over into an ESC1, and ESC6 abuses the CA-wide User Specified SAN flag to stuff a Subject Alternative Name into any Client Authentication template.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 5, 20268 min read

AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise

Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 5, 202613 min read

AD CS Part 1: Architecture, Template Semantics, and the ESC Taxonomy

Deconstructing the Active Directory Certificate Services attack surface: template attributes, PKINIT credential exchange, EKU semantics, identity mapping, and the ESC taxonomy mapped by root cause.

#active-directory#identity-security#authentication#attack-paths#methodology

PentestNov 4, 20265 min read

Pass-the-Hash and Overpass-the-Hash: Moving with Hashes, Not Passwords

DCSync left us holding NTLM hashes but no passwords. Pass-the-hash feeds the raw hash straight into NTLM; overpass-the-hash turns that same hash into a Kerberos TGT. Both log in as Administrator without ever cracking anything — and they answer two different problems.

#active-directory#pentest#authentication#attack-paths#identity-security

PentestNov 4, 20264 min read

Force-Set SPN: Targeted Kerberoasting with GenericWrite

Kerberoasting normally waits for a service account to already have an SPN. With GenericWrite over a user you can add the SPN yourself and Kerberoast them on demand — turning any weak-password user you can write to into a crackable target.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 3, 20264 min read

Password Spraying: One Password, Every Account

The lockout-aware credential attack: one common password tried across every account in the domain, respecting the lockout threshold so nothing trips. GOAD's north domain shows the whole dance — from reading the password policy to the one account that reused Winter2022.

#active-directory#pentest#authentication#attack-paths#identity-security

ArchitectureNov 3, 202613 min read

Active Directory as a Directed Graph: How Security Descriptors and Object ACLs Actually Work

Active Directory stores every user, group, computer, and GPO as an LDAP object with a binary nTSecurityDescriptor. Walking the eight-hop escalation chain in GOAD's sevenkingdoms.local domain shows how ACE masks, Extended Rights GUIDs, and ownership changes turn helpdesk permissions into Domain Controller compromise.

#active-directory#access-control#identity-security#methodology#attack-paths

ArchitectureNov 3, 202612 min read

Inside Kerberos Delegation: Why Multi-Tier Windows Apps Need It (and Why It Breaks)

Walking through the Kerberos double-hop problem and the three generations of delegation in Windows: how Unconstrained, Constrained (S4U2Self / S4U2Proxy), and Resource-Based Constrained Delegation (RBCD) look in LDAP across the GOAD lab.

#active-directory#authentication#identity-security#methodology#attack-paths

ArchitectureNov 2, 202616 min read

Multi-Forest Active Directory Architecture: How Forests, Trusts, DNS, and Tiered Services Actually Work

Looking at the five-server GOAD environment from the systems side before running an exploit: why organizations split forests and child domains, how directory partitions replicate, how DNS forwarders and Trusted Domain Objects route cross-forest authentication, and where normal Windows features turn into attack paths.

#active-directory#identity-security#authentication#methodology#attack-paths