Pentesting Active Directory and Windows-based Infrastructure

6

Domain Privilege Escalation

The probability that an attacker will need to escalate privileges in the target domain is high. We have already discussed why we will not touch upon the host privilege escalation theme. However, most concepts are universal. We check whether any privilege escalation exploits are applicable to the target environment. If there are none, the next step is to identify various misconfigured ACLs and GPOs and users with excessive group memberships that could have been unintentionally introduced by IT staff or during software installation in the Active Directory environment. We will reiterate these activities in every newly discovered path.

This chapter starts with examples of good old point-and-click exploits. This will ...