Windows Security – core-jmp

// Windows Security

3 posts

Manual LDAP Querying, Part 2: Nested Groups, UAC Bits, Trusts, and Foreign SIDs

Hope Walker's SpecterOps sequel to manual LDAP querying: OR parentheses that lie, nested Domain Admins, Kerberoastable SPNs, userAccountControl sticker-math, passwords in schema…

oxfemale· Sep 10· 22 min ·178

Manual Active Directory Querying with dsquery and ldapsearch

Active Directory140

Active Directory Penetration Testing

Manual Active Directory Querying with dsquery and ldapsearch

When BloodHound and PowerView will not load, Active Directory is still a phone book. Hope Walker's SpecterOps lab shows how to query…

oxfemale· Sep 10· 31 min ·140

Privilege Escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC Endpoint

Active Directory382

Active Directory Certificate Services

Privilege Escalation from IIS AppPool to NT Authority/SYSTEM via AD CS RPC Endpoint

Demonstrate a sophisticated privilege escalation technique exploiting Windows IIS AppPool identity elevation to obtain machine account certificates from AD CS, leading to…

oxfemale· Sep 2· 9 min ·382