Active Directory114 Domain Credential Dumping via File Handle Redirection
S12 points a notepad.exe File handle at ntds.dit, SYSTEM, and SECURITY on a live DC via BYOVD LowQword patch. No LSASS, no…
oxfemale·
Sep 14·
15 min
·114
// Active Directory
15 postsActive Directory114 
Active Directory178 Manual LDAP Querying, Part 2: Nested Groups, UAC Bits, Trusts, and Foreign SIDs
Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema…
oxfemale·
Sep 10·
22 min
·178
Active Directory140 Manual Active Directory Querying with dsquery and ldapsearch
When BloodHound and PowerView will not load, Active Directory is still a phone book. Hope Walker's SpecterOps lab shows how to query…
oxfemale·
Sep 10·
31 min
·140
Active Directory382 Privilege Escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC Endpoint
Demonstrate a sophisticated privilege escalation technique exploiting Windows IIS AppPool identity elevation to obtain machine account certificates from AD CS, leading to…
oxfemale·
Sep 2·
9 min
·382
Active Directory521 Identity Crisis: Kerberos downgrade, DoS, and full domain takeover via KerberLoss and ResetNightmare
Active Directory stores Unicode characters its own LDAP server cannot search for. Semperis researcher Shai Laron turned that gap into KerberLoss (CVE-2026-25177)…
oxfemale·
Aug 10·
31 min
·521
Active Directory220 Hunting Active Directory Honeypots: Reading lastLogon as a Decoy Oracle
Decoy accounts in Active Directory look legitimate at the schema level but cannot fake behavioural history. This walkthrough shows how to read…
oxfemale·
Jun 18·
21 min
·220
Active Directory346 Weaponizing Writable SMB Shares to Steal Domain Credentials
A walkthrough of a classic-but-still-effective Active Directory attack: how write access to an SMB share — plus a single .lnk file —…
oxfemale·
Jun 13·
11 min
·346
Active Directory176 What Windows Server 2025 Quietly Did to Your NTLM Relay
Windows Server 2025 quietly breaks a classic NTLM relay technique by enforcing changes inside msv1_0.dll. The update prevents attackers from abusing NTLMv1…
oxfemale·
Apr 9·
3 min
·176
Active Directory201 Credential Dumping from LSASS (Windows Authentication Secrets)
The article explains how attackers dump credentials from the Windows LSASS process using tools like Mimikatz and ProcDump, extracting password hashes and…
oxfemale·
Apr 1·
10 min
·201
Active Directory190 Reflecting on Your Tier Model: CVE-2025-33073 and the One-Hop Problem
CVE-2025-33073 enables NTLM reflection attacks that give attackers SYSTEM access on vulnerable Windows hosts. When combined with unconstrained delegation, a single compromised…
oxfemale·
Mar 28·
9 min
·190
Active Directory208 Relaying Trust: Exploiting NTLM Authentication to Compromise Active Directory
he article demonstrates an NTLM relay attack against Active Directory using tools like ntlmrelayx and PetitPotam. By relaying authentication to LDAP, attackers…
oxfemale·
Mar 26·
11 min
·208
Active Directory246 Breaking the Flat Network: How Tiering Models Protect Active Directory
The article explains how flat enterprise networks enable easy lateral movement and domain compromise. It shows how Active Directory tiering models segment…
oxfemale·
Mar 25·
24 min
·246