Domain Privilege Escalation

The probability that an attacker will need to escalate privileges in the target domain is high. We have already discussed why we will not touch upon the host privilege escalation theme. However, most concepts are universal. We check whether any privilege escalation exploits are applicable to the target environment. If there are none, the next step is to identify various misconfigured ACLs and GPOs and users with excessive group memberships that could have been unintentionally introduced by IT staff or during software installation in the Active Directory environment. We will reiterate these activities in every newly discovered path.

This chapter starts with examples of good old point-and-click exploits. This will again emphasize the critical role patching plays in the security posture of an environment. Then, we will cover ACL misconfigurations and Group Policy abuses. The main caveat in detecting these escalation paths is that they can be hidden and not...