Search for | BookStack

Persistence through Credentials

Red Team - Windows Active Directory - Persisting

Congratulations weary traveler! After breaching AD, performing enumeration, and exploiting it all the way to the top (if you have done these AD networks in order), you have finally made it to the tavern of persistence. The hard work is over and it is now time ...

La Focaccia

Recipes

[!info] La recette permets de faire une petite focaccia. Prévoir environ 5 à 6 heures dans une pièce tempérée +25°C (ou en utilisant une chambre de pousse / un four) Ingrédients : 300g de farine de blé T65 257g d'eau 6g de sel 5g de levure 1 c.à.c de sucre ...

Persistence through Tickets

Red Team - Windows Active Directory - Persisting

As discussed in the previous tasks, we often want to persist through service accounts with delegation permissions to forge silver and golden tickets. But what are those exactly, and why does every blue team tabletop exercise end with someone shouting: "Flush a...

Persistence through Certificates

Red Team - Windows Active Directory - Persisting

A quick note here. The techniques discussed from this point forward are incredibly invasive and hard to remove. Even if you have signoff on your red team exercise to perform these techniques, you must take the utmost caution when performing these techniques. I...

Persistence through SID History

Red Team - Windows Active Directory - Persisting

The Security IDentifiers (SIDs) have been discussed before. But for a recap, SIDs are used to track the security principal and the account's access when connecting to resources. There is, however, an interesting attribute on accounts called the SID history. T...

Persitence through Group Membership

Red Team - Windows Active Directory - Persisting

If we don't want to tamper with SID histories, we can just add ourselves directly to AD groups for persistence. While SID history is a great persistence technique, credential rotation and cleanup can still remove our persistence. In certain cases, it may be be...

Persistence through ACLs

Red Team - Windows Active Directory - Persisting

Sometimes, we need more than just persisting to normal AD groups. What if we want to persist to all protected groups simultaneously? Persisting through AD Group Templates While we can just add an account we control to every single privileged group we can fin...

Persistence through GPOs

Red Team - Windows Active Directory - Persisting

The last persistence technique we will review is persistence through Group Policy Objects (GPOs). At this point, you should be familiar with GPOs based on all the different enumeration, attack, and exploitation techniques we have discussed. However, GPOs are a...

Conclusion

Red Team - Windows Active Directory - Persisting

There are several different ways that we can persist in AD. Some of these techniques persist better than others. In order to ensure that your persistence cannot be removed by the blue team, you will have to think creatively about your persistence. Furthermore,...