Other privilege escalation vectors
This section will be focused on outstanding privilege escalation vectors. We will demonstrate the consequences of adding non-privileged domain users to the various built-in domain security groups. Then, we will describe privilege escalation from the child to the parent domain using Golden and inter-realm tickets. At the end, the PAM concept will be explained.
In general, privileged users, computers, and groups have to be reviewed on a regular basis. From an Active Directory perspective, there is no drastic difference between a user and computer account. If an attacker compromises a machine account that has membership of a privileged group, it will certainly lead to privilege escalation.
Note
Original research was presented by XPN: https://secarma.com/using-machine-account-passwords-during-an-engagement/. The idea is to extract the machine account hash and use it for a pass-the-hash attack, as demonstrated here: https://pentestlab.blog/2022...
