Hands-On Red Team Tactics

Age of Empire - Owning Domain Controllers

In the previous chapter, we covered the basics of Empire and how to use Empire efficiently to perform post-exploitation. Now we are in the network, what's the next step? What can we do apart from exploring the target filesystem and internal network service discovery? In every organization, a centralized server will be present to control and manage the whole network. If an attacker can compromise this central server, they would have full control over the entire organization's network. This central server is called the Domain Controller (DC), while the domain services that are provided by a Domain Controller are known as Active Directory Domain Services.

In this chapter, we will cover the following ...