Deep dives into Active Directory attack techniques — understanding the mechanism, not just the commands.
How disabling Kerberos pre-authentication hands attackers an offline password crack with no credentials required. Lab setup, enumeration, exploitation, and offline cracking.
From a low privileged domain user to NT AUTHORITY\SYSTEM by overwriting a service executable that weak file permissions left writable. Lab setup, enumeration, and exploitation.
How any authenticated domain user can extract service account password hashes from Active Directory using legitimate Kerberos functionality, and crack them offline. Theory grounded in RFC 4120, lab setup, multiple exploitation paths, and cracking strategies.
How the PowerShell command history file silently records credentials in cleartext, where to find it, what leaks into it, and how to turn a history file into a privilege escalation during a pentest.
How attackers use Windows Task Scheduler to survive reboots, maintain access, and execute payloads as SYSTEM. Lab setup on a Domain Controller, multiple persistence paths via CMD and PowerShell.
How a missing pair of quotation marks in a service's ImagePath lets a low privilege user place a binary that Windows executes as SYSTEM. Theory behind CreateProcess path resolution, lab setup, enumeration, and exploitation.
How Windows AutoLogon stores plaintext credentials in the registry under HKLM\SOFTWARE, why every authenticated user can read them, and how to turn a single reg query into privilege escalation or domain compromise during a penetration test.
