Mois : janvier 2024

If a domain user does not have Kerberos preauthentication enabled, an AS-REP can be successfully requested for the user, and a component of the structure can be cracked

ADIDNS zone DACL (Discretionary Access Control List) enables regular users to create child objects by default, attackers can leverage that and hijack traffic. Active Directory will need some

ADFS – Golden SAML Requirements: ADFS service account The private key (PFX with the decryption password) Exploitation: Run mandiant/ADFSDump on AD FS server as the AD FS service account. It

RODCs are an alternative for Domain Controllers in less secure physical locations – Contains a filtered copy of AD (LAPS and Bitlocker keys are excluded) – Any user

You will need the following files to extract the ntds : – NTDS.dit file – SYSTEM hive (C:\Windows\System32\SYSTEM) Usually you can find the ntds in two locations : systemroot\NTDS\ntds.dit and systemroot\System32\ntds.dit.

CCACHE ticket reuse from /tmp When tickets are set to be stored as a file on disk, the standard format and type is a CCACHE file. This is

Dangerous Built-in Groups Usage If you do not want modified ACLs to be overwritten every hour, you should change ACL template on the object CN=AdminSDHolder,CN=System or set "dminCount attribute to 0 for the required

Creators of a GPO are automatically granted explicit Edit settings, delete, modify security, which manifests as CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner  GPO Priorization :

Using BloodHound Use the correct collector * AzureHound for Azure Active Directory * SharpHound for local Active Directory * RustHound for local Active Directory use BloodHoundAD/AzureHound (more info: Cloud – Azure

ACL: Access Control Lists ACE: Access Control Entry Check ACL for an User with ADACLScanner. ADACLScan.ps1 -Base "DC=contoso;DC=com" -Filter "(&(AdminCount=1))" -Scope subtree -EffectiveRightsPrincipal User1 -Output HTML -Show GenericAll GenericAll