#Techniques

Attack techniques.

ESC1 - Abuse Active Directory Certificate Services.

From Backup Operator To Domain Admin.

ESC8 - Abuse Active Directory Certificate Services.

Abusing the kerberos protocol to gain KRBTG hashes to crack.

A universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).

How to dump NTDS.dit and extract the hashes with ShadowCopy and Secretsdump.

Use the hash of a user to authenticate around the network.

Triggers RPC call using SpoolService bug.

From LOCAL/NETWORK SERVICE to SYSTEM by abusing SeImpersonatePrivilege on Windows 10 and Server 2016/2019.

Resource-Based Constrained Delegation Attack (Kerberos RBCD / KRBCD).

Attack techniques.