Summary

In this chapter, we looked at the methodology of escalating privileges and explored different methods and tools that can be utilized to achieve our penetration test goal.

We first started with common system-level privilege escalation by exploiting ms18_8120_win32k_privesc on Windows Server 2008 and using bypassuac_fodhelper on Windows 10 machines. We focused on utilizing Meterpreter to gain system-level control and later we took a detailed look at utilizing the Empire tool; then we harvested credentials by using password sniffers on the network. We also utilized Responder and performed NTLM relay attacks to gain remote system access, and we used Responder to capture the passwords of different systems on a network that utilizes SMB.

We completely compromised an Active Directory using a structured approach. Finally, we exploited access rights in Active Directory by using PowerShell Empire and a compromised Kerberos account and performed a golden-ticket attack utilizing...