๐ Secure Bits ๐ก
๐๐ผ ๐๐ผ๐ ๐๐ฐ๐ฎ๐ป ๐๐ผ๐๐ฟ ๐ถ๐ป๐ณ๐ฟ๐ฎ๐๐๐ฟ๐๐ฐ๐๐๐ฟ๐ฒ for privilege escalation paths?
You shouldโespecially if you havenโt implemented a ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น ๐ผ๐ฟ ๐๐ฒ๐ฎ๐๐ ๐ฃ๐ฟ๐ถ๐๐ถ๐น๐ฒ๐ด๐ฒ ๐๐ฐ๐ฐ๐ฒ๐๐.
With time, ๐บ๐ถ๐๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป๐ ๐ฝ๐ถ๐น๐ฒ ๐๐ฝโhidden escalation paths emerge. ๐๐น๐ผ๐ผ๐ฑ๐๐ผ๐๐ป๐ฑย is one of the best tools to uncover them.
How to Map Escalation Paths in AD
1๏ธโฃ ๐๐ผ๐น๐น๐ฒ๐ฐ๐ ๐๐ฎ๐๐ฎ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐ง๐ฎ๐ฟ๐ด๐ฒ๐ ๐๐ป๐ณ๐ฟ๐ฎ๐๐๐ฟ๐๐ฐ๐๐๐ฟ๐ฒ
โช๏ธAs a standard user, you can gather a lot of data.
โช๏ธHowever, to enumerate active sessions, youโll need elevated access.
โช๏ธUse Sharphound to collect all necessary relationships.
2๏ธโฃ ๐จ๐ฝ๐น๐ผ๐ฎ๐ฑ & ๐๐ป๐ฎ๐น๐๐๐ฒ ๐ถ๐ป ๐๐น๐ผ๐ผ๐ฑ๐๐ผ๐๐ป๐ฑ
โช๏ธOnce imported, you can visualize relationships between AD objects.
โช๏ธIdentify misconfigurations leading to privilege escalation.
โช๏ธExample: Carl โ Workstation โ Server โ Domain Admins ๐จ
๐ก Most environments have hidden escalation pathsโthe older the infrastructure, the worse it gets.
Learn how to build a secure Active Directory from scratch with me:
Building a Secure Active Directory โ Horizon Secured
Have you ever found a surprising escalation path in your AD?๐
