DCSync is a well-known technique allowing an attacker to extract password hash from the domain controller by simulating the behaviour of domain replication.Impersonating as an Domain Controller Us...
LLMNR & NBT-NS Poisoning
LLMNR & NBT-NS Poisoning What is LMNR & NBT-NS ⇒ Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are two name services used by windows for resolving hostnam...
DCSync Attack
DCSync is a well-known technique allowing an attacker to extract password hash from the domain controller by simulating the behaviour of domain replication.Impersonating as an Domain Controller To...
Domain Persistence-Golden Ticket
Its not much as privilege escalation attack . There’s more of persistence attak . its like when you have already got access to some pretty high level stuff like domain controller in the domain a...
AS-REP Roasting - Kerberos Pre-Auth
If a user’s UserAccountControl settings have the option “Do not require Kerberos preauthentication” enabled, it means that Kerberos preauthentication is disabled for that user. In simple terms, thi...
AS-REP Roasting Lab Setup
So to perform the AS-REP Roasting / Kerberos Pre-Auth Attack needs the following permission Perform Attack Open Active Directory Users and Computers Click on users OU and select t...
Resource Based Constrained Delegation /GenericWrite
What is RBCD and How it works RBCD (Resource Based Constrained Delegation). This is similar to the basic Constrained Delegation in which it allows you to configure which services an account can be...