Summary

In this chapter, we learned about techniques to compromise AD CS. The techniques presented in the chapter were grouped into four categories: theft, account persistence, domain privilege escalation, and domain persistence.

In the theft category, we covered different ways to steal certificates from a compromised endpoint. Next, we introduced you to account persistence techniques, such as the request and renewal of user and machine certificates. Also, we learned about domain privilege escalation and persistence techniques, respectively, to achieve the highest privileges on the domain level as well.

In the next chapter, we will dive into Microsoft’s solution for databases – Microsoft SQL Server. We will cover offensive techniques, prevention, and detection recommendations.