/explore
|
You are here 
|
njmulsqb.github.io | ||
| | | | |
blog.ikuamike.io
Introduction After passing my OSCP, I am planning on doing CRTP and CRTO sometime this year. I took the OSCP exam before the updates that are focused on Active Directory so I didn't actively focus on this area. So to learn and practice on AD and Windows and also as some prep for the certifications I plan on taking, I will be doing some machines that are AD related and try to get into the details of the included misconfigurations and vulnerabilities. |
|
| | | | | ||
| | | | |
shenaniganslabs.io
By default, domain joined Windows workstations allow access to the network selection UI from the lock screen. An attacker with physical access to a locked device with WiFi capabilities (such as a laptop or a workstation) can abuse this functionality to force the laptop to authenticate against a rogue access point and capture a MSCHAPv2 challenge response hash for the domain computer account. This challenge response hash can then be submitted to crack.sh to recover the NTLM hash of the computer account in less than 24 hours. Once recovered, this NTLM hash combined with the domain SID can be used to forge Kerberos silver tickets to impersonate a privileged user and compromise the host. An example of this is to create a silver ticket for the CIFS service of the... |
|
| | | | | ||
| | | | |
taeluralexis.com
Exploit a machine through SMB and elevate privileges by performing a kerberoasting attack on a domain admin. |
|
| | | | | ||
| | | | |
www.zerodayinitiative.com
[AI summary] A critical remote code execution vulnerability in SolarWinds Access Rights Manager allows attackers to execute arbitrary code with service account privileges if proper data validation is not enforced. |
|
| | | |||
