Zero2Hero exploits

In this section, we will discuss available exploits that can provide a domain administrator’s level of access in a matter of minutes. In a mature environment with regular patching and vulnerability management, it is not very common to find such treasure. However, there is still a possibility, and checking will not hurt. We will start with a relatively old GoldenPAC vulnerability in Kerberos, discuss the root cause of Zerologon and exploit it, and get elevated privileges with PrintNightmare and noPAC. We will also briefly cover different types of “Potatoes” and discuss how wrong group membership assignment can lead to a complete domain takeover.

MS14-068

MS14-068 was a successor of MS11-013, meaning that it was a PAC validation vulnerability. The attacker was able to modify the existing TGT by adding privileged groups and the domain controller wrongly validated the tickets. This happened on the fly, so domain users’ group membership...