Chapter 8: Age of Empire – Owning Domain Controllers

1. There are many different techniques which can be used to get access into the Domain Controller but not all are recommended. It's better to impersonate the Domain Controller using 'DCSync' to extract the password hashes without requiring interactive logon or copying the Active Directory database file (ntds.dit).
2. You can either try other UAC modules in Empire for privilege escalation or you can look for a local vulnerability using privesc/powerup/allchecks module or a Unquoted Service Path Vulnerability to escalate the privileges manually.
3. DeathStar follows a series of checklist to look for the credentials. If the standard way didn't work, you need to do some manual reconnaissance to move further.
4. It's not mandatory to retrieve the passwords in plain-text. We can always use Pass-The-Hash (PTH)...