Summary
Active Directory — Summary
Compiled from two exam attempts (Exam B and Exam C).
AD Chain Overview
| Host | Role | Initial Access | PrivEsc |
|---|---|---|---|
| External | Domain workstation | Given creds (assumed breach) → evil-winrm | SeDebugPrivilege → LSASS dump (Exam C) / SeBackupPrivilege → SAM/SYSTEM dump (Exam B) |
| Internal | Member server | Plaintext creds found on External → SMB | Exposed SMB backup files → secretsdump → high-priv account |
| DC | Domain Controller | Compromised account with excessive AD permissions | DCSync → Domain Admin |
All instances used an assumed breach starting point — credentials for a low-priv domain user on External were provided in the exam brief.
Attack Chain Summary
[Given creds] → External (evil-winrm)
→ Token privilege abuse (SeDebugPrivilege or SeBackupPrivilege)
→ Dump credential material (LSASS or SAM/SYSTEM)
→ Pivot to Internal (SMB with dumped creds)
→ Enumerate SMB shares → find backup files
→ secretsdump → high-priv AD account
→ DCSync on DC → Domain Admin
Recurring Themes
- SeDebugPrivilege and SeBackupPrivilege were both observed across different exam instances — always check
whoami /privimmediately on External - Credentials left on External (in files, registry, or LSASS) were the bridge to Internal in all cases
- Backup files stored on open SMB shares on Internal — a realistic and recurring misconfiguration
- Excessive AD permissions (DCSync rights, WriteDACL, Domain Admins membership) were the final link to DC