Summary

In conclusion, there are many ways for attackers to achieve persistence in compromised environments. This can be achieved at a domain level or by accessing a domain controller. We saw how powerful forged tickets are and how difficult is to detect their usage if an adversary follows OpSec recommendations. We also explored various ACL and attribute modifications. As usual, the devil is in the details, and in a complex environment, detection of such techniques can be tricky. We saw DCShadow and Golden gMSA attacks in practice. We dived deep into the topic of domain controller persistence, showing ways to collect clear-text passwords. Finally, we discussed security descriptors and possible ways to backdoor a system.

In the following chapter, we will focus on attacking AD Certificate Services, which is a privileged target in the Windows environment.