Dancing in the shadows – looting domain controllers with vssadmin

So, you achieved domain administrator in your client’s environment. Congratulations! Now what?

In a section about pressing forward from initial compromise and a chapter about escalating privileges, we need a little outside-of-the-box thinking. We’ve covered a lot of technical ground, but don’t forget the whole idea – you’re conducting an assessment for a client, and the value of your results isn’t just a bunch of screenshots with green text in them. When you’re having a drink with your hacker friends and you tell them about your domain administrator compromise, they understand what that means. But when you’re presenting your findings for the executive management of a client? I’ve had countless executives ask me point-blank, so what? Shaking them by the shoulders while shouting I got domain admin by sniffing their printer isn’t going to convince...