III. Domain Privilege Escalation
We validate this area during scoped assessments, documenting impact and remediation guidance.
Why it matters
- Learn to find credentials and sessions of high-privileged domain accounts like Domain Administrators, extract their credentials, and use credential replay attacks to escalate privileges using built-in protocols for pivoting. - Learn to extract credentials from a restricted environment where application whitelisting is enforced. - Abuse derivative local admin privileges and pivot to other machines to escalate privileges to the domain level. - Understand the classic Kerberoast attack and its variants to escalate privileges. - Enumerate the domain for objects with unconstrained delegation and abuse it to escalate privileges. - Find domain objects with constrained delegation enabled. Understand and execute attacks against such objects to escalate privileges to a single service on a machine or the domain administrator using alternate tickets. - Learn how to abuse privileges of Protected Groups to escalate privileges.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of III. Domain Privilege Escalation during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to III. Domain Privilege Escalation.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Related topics
| Topic | Summary |
|---|---|
| Active Directory (AD) - Basics Understanding | Within Active Directory, there are three built-in groups that comprise the highest privilege groups in the director |
| Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| DLL | A DLL (Dynamic Link Library) is a file format used in Microsoft Windows environments to contain code, data, and resources that can be used by multiple programs simultaneously. DLLs help modularize applications, allowing them to share common functions without duplicating code acr… |
| Extended Active Directory (AD) Terminology | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| I. Active Directory Enumeration | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| II. Local Privilege Escalation | We validate this area during scoped assessments, documenting impact and remediation guidance. |