Other privilege escalation vectors

This section will be focused on outstanding privilege escalation vectors. We will demonstrate the consequences of adding non-privileged domain users to the various built-in domain security groups. Then, we will describe privilege escalation from the child to the parent domain using Golden and inter-realm tickets. At the end, the PAM concept will be explained.

In general, privileged users, computers, and groups have to be reviewed on a regular basis. From an Active Directory perspective, there is no drastic difference between a user and computer account. If an attacker compromises a machine account that has membership of a privileged group, it will certainly lead to privilege escalation.

Note

Original research was presented by XPN: https://secarma.com/using-machine-account-passwords-during-an-engagement/. The idea is to extract the machine account hash and use it for a pass-the-hash attack, as demonstrated here: https://pentestlab.blog/2022...