TL;DR explanation of what SDDL is, how to read it, and does it even matter. Welcome to Part VIII of our Auditing AD Series. Part I: 3 warm up questions to get us started Part II: Who can reset the CISO’s password? Part III: Who can execute DCSync? Part IV…

TL;DR How to check for one type of persistence by attackers in AD. Background Welcome to Part VII of our Auditing AD series. Part I: 3 warm up questions to get us started Part II: Who can reset the CISO’s password? Part III: Who can execute DCSync? Part IV: Who…

TL;DR Does the Internet really need another eJPT review? Probably not, but here is mine anyway. Please note that the exam format is changing soon. This is about the 20 Question version, circa May 2022. Disclaimer I am not a pentester. I have worked everything from service desk to change…

Part of the Pentest+ Pathway TryHackMe | Attacktive Directory 99% of Corporate networks run off of AD. But can you exploit a vulnerable Domain Controller?tryhackme.com Background This particular section of the Pentest+ pathway was developed by THM user Spooks (https://twitter.com/NekoS3c) as part of their cyber security degree. It is a decent introduction to Active Directory overall, or a great introduction for the $7.50 a month a THM membership runs.

TL;DR Lab scenario showing why using Deny ACLs IOT attempt to negate an Allow elsewhere is a bad idea. Fix the original Allow statement! Background Welcome to part VI of our Auditing AD series. Part I: 3 warm up questions to get us started Part II: Who can reset the…

TL;DR How to query who can modify an AD group & a brief discussion of whether this is even the right question to be asking. Background Welcome to part IV of our Auditing AD series. Part I: 3 warm up questions to get us started Part II: Who can reset…

TL;DR this is a sample scenario of how a lowly Domain User can take over a domain by simply abusing ACLs in AD. Welcome to Part V of our Auditing AD series. Part I: 3 warm up questions to get us started Part II: Who can reset the CISO’s password? …

TL;DR Migrating 2016 to 2019: demote the Server 2016 DC, install Server 2019, run setup scripts for static IPs & joining the domain, pull GPOs, promote to DC, move the FSMO roles, add the server to DFS. This is Part III; demoting the DC, bringing the VM up on Server…

TL;DR This is Part II of a writeup on transferring server roles to a new server prior to decommissioning the old server and then performing a clean install of a newer Windows Server version. Part I was on DFS. Part I: https://happycamper84.medium.com/transferring-windows-server-roles-to-a-new-server-part-i-dfs-a021d9ee1650 Part III: https://happycamper84.medium.com/transferring-windows-server-roles-part-iii-setup-the-new-server-98017b58725f