In the previous article, I obtained credentials to the domain three different ways. For most of this part of the series, I will use the rsmith user credentials, as they are low-level, forcing us to do privilege escalation. Privilege escalation in Windows can of course come from a missing patch or unquoted service paths, but … Continue reading Penetration Testing Active Directory, Part II
I've had several customers come to me before a pentest and say they think they're in a good shape because their vulnerability scan shows no critical vulnerabilities and that they're ready for a pentest, which then leads me to getting domain administrator in fifteen minutes by just exploiting misconfigurations in AD. One of the lapses … Continue reading Penetration Testing Active Directory, Part I
I take absolutely no credit for the modules used in this script. A massive thanks to Tim Medin, Kevin Robertson, Marcello Salvati, Will Schroeder and the rest of the team at Specter Ops for the modules used in this script. Finally, thanks to Daniel Bohannon for writing Invoke-Obfuscation, which was used to obfuscate all … Continue reading Active Directory Assessment and Privilege Escalation Script 2.0
When Invoke-Obfuscation came out in late 2016, I, and I'm sure many other pentesters, rejoiced at the fact that our commands bypassed AV like it wasn't even there. Empire payload? Easy. Privilege escalation Powershell scripts? Not a problem. In 2016, Windows Defender was but an annoying feature in Windows that would just catch Cain & … Continue reading Suck it, Windows Defender.
There's been a disturbance in pentesting, have you felt it? More mature environments have finally caught on that Powershell can be used for malicious gains and pentesters could own your domain with a few Powershell commands, so admins have began to lock it down, EDRs have began to alert, and thus the saying goes, necessity … Continue reading The Rise of C# and using Kali as a C2 Server with SILENTTRINITY