Privilege escalation
This section will be focused on privilege escalation via credential harvesting and authentication coercion. For harvesting, we will need a local Administrator account.
Client push authentication coercion
As we did in previous chapters, here, we will split hash capture and relay phases as well. Our goal is to coerce client push installation account authentication against our controlled machine to capture the NTLM response.
Note
Coercion attacks were presented by Mayyhem in his blog post at https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a.
The important fact is that the attack does not require administrative privileges; the captured client push installation account’s NTLM response will grant administrative access to all other machines where such an account has been used. The main prerequisites are automatic client assignment for a boundary group, automatic site-wide push installation, and allowed connection fallback...
