Privilege Escalation

macOS SecurityNov 9, 20269 min read

macOS Hardening in Practice: Auditing 54 Controls, Detecting Drift, and Remediating Without Dependencies

A deep dive into macOS endpoint security architecture: auditing SIP, Gatekeeper, TCC, LaunchDaemons, BPF packet filters, and plaintext secret leakage using native Zsh primitives, zero third-party dependencies, and OASIS SARIF v2.1.0.

#macos-security#apple-security#methodology#privilege-escalation#detection

Cloud SecurityNov 6, 20266 min read

Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves

A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.

#container-security#linux-security#cloud-security#privilege-escalation#pentest

PentestNov 6, 20266 min read

DNSAdmins and Backup Operators: Privileged Group Abuse to SYSTEM on the DC

The last two GOAD techniques are not exploits but groups: DNSAdmins loads a DLL into the DNS service, Backup Operators reads what the OS would rather hide. One is demonstrated end to end, one is documented honestly with the remote-registry wrinkle, and the relay gap that neither covers is called out.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 6, 20264 min read

Offline Domain Dump: Shadow Copies and NTDS.dit

DCSync is the online way to pull hashes — but it needs replication rights. The offline way asks for nothing from the DC: take a shadow copy of C:, copy the NTDS.dit database and SYSTEM hive out, and dump every credential on your own machine with no Domain Controller cooperation.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 5, 20265 min read

AD CS Part 4: The Rest of the Catalog and How to Lock It Down

Closing the AD CS series: ESC2's any-purpose EKU, ESC3's enrollment-agent escalation, the identity-mapping weaknesses of ESC9, and the relay-based ESC8/ESC11 — then the four-question hardening checklist that ties the whole taxonomy back together.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 5, 20265 min read

AD CS Part 3: ESC4 and ESC6 — Creating the Vulnerability Yourself

Part 2 exploited ESC1, a template that was already vulnerable. This part creates the vulnerability: ESC4 edits a template you have GenericAll over into an ESC1, and ESC6 abuses the CA-wide User Specified SAN flag to stuff a Subject Alternative Name into any Client Authentication template.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 5, 20268 min read

AD CS Part 2: ESC1 Exploitation: RPC Targeting, PKINIT Authentication, and Forest Compromise

Weaponizing the ESC1 certificate template on ESSOS-CA: MS-WCCE RPC endpoint resolution, PKINIT Kerberos TGT issuance via weak UPN mapping, and full forest takeover using DRSUAPI DCSync.

#active-directory#identity-security#authentication#privilege-escalation#attack-paths

PentestNov 4, 20264 min read

Force-Set SPN: Targeted Kerberoasting with GenericWrite

Kerberoasting normally waits for a service account to already have an SPN. With GenericWrite over a user you can add the SPN yourself and Kerberoast them on demand — turning any weak-password user you can write to into a crackable target.

#active-directory#pentest#privilege-escalation#attack-paths#identity-security

PentestNov 4, 202618 min read

GOAD Part 4: Owning essos.local Across the Forest Trust

The forest trust into essos.local enforces SID filtering, so a forged ExtraSids ticket will not carry Domain Admin across the boundary. What does cross is foreign group nesting, a three-hop ACL chain, LAPS, and an AD CS CA full of ESC templates.

#active-directory#pentest#privilege-escalation#attack-paths#authentication

PentestNov 4, 202618 min read

GOAD Part 3: Walking the ACL Chain to the Forest Root

Eight misconfigured ACLs stand between a single recovered password and Domain Admin on the sevenkingdoms.local forest root. Each edge is a different right and forces a different technique. This is every hop, every tool, and the two places it tried to fail.

#active-directory#pentest#privilege-escalation#attack-paths

PentestNov 3, 202614 min read

GOAD Part 2: Owning the NORTH Domain Controller

Moving from a low-privileged user account to Domain Admin on DC02 in north.sevenkingdoms.local: Kerberoasting a service account, abusing constrained delegation with S4U2Self and S4U2Proxy, and injecting a SYSTEM scheduled task through a writable GPO.

#active-directory#pentest#privilege-escalation#attack-paths

Patch AnalysisSep 16, 202614 min read

CVE-2026-87772: Root Escalation Through the Pardus About Mount Helper

Root-cause analysis of CVE-2026-87772: Pardus About's passwordless Polkit action started a root helper that mounted attached disks with defaults,ro, so a setuid binary on a disk gave a local user root. Fixed in 1.2.5.

#linux-security#privilege-escalation#access-control#vulnerability-research#exploit-development