Escalating access rights in Active Directory
We have just explored how to escalate privileges within a system and how to grab credentials over the network. Now let’s utilize all the details that we have collected so far; then we should be able to achieve the goal of penetration testing using the cyber kill chain methodology. In this section, we will escalate the privilege of a normal domain user to that of the domain administrator.
We identify the system that is connected to the domain and utilize our Empire PowerShell tool to escalate to the domain controller and dump all the username and password hashes:
Figure 12.30: Current reporting agents in PowerShell Empire
You can harvest more information about the domain using the situational_awareness module, get_domain_controller:
usemodule situational_awareness/network/powerview/get_domain_controller
Figure 12.31: Output of the domain controller details
To identify who is logged in to the domain...
