DEF CON 27 - NIKHIL MITTAL nikhil-mittal - race minimal rights and ace for active directory dominance

1. 1

2. 2

3. 3

4. Reference: https://docs.microsoft.com/en-us/windows/win32/secauthz/how-dacls-
control-access-to-an-object
4

5. 5

6. 6

7. 7

8. 8

9. 9

10. Reference: https://github.com/samratashok/nishang/blob/master/Backdoors/Set-
RemotePSRemoting.ps1
10

11. 11

12. Reference - https://github.com/samratashok/nishang/blob/master/Backdoors/Set-
RemoteWMI.ps1
12

13. 13

14. 14

15. 15

16. 16

17. https://docs.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-
string-format
17

18. 18

19. 19

20. 20

21. 21

22. Reference: https://docs.microsoft.com/en-us/powershell/jea/overview
22

23. 23

24. 24

25. 25

26. 26

27. 27

28. 28

29. 29

30. References: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-
compromise-in-one-line-a0f779b8dc83
http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-
escalation-in-active-directory.html
30

31. https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-
practices/appendix-c--protected-accounts-and-groups-in-active-directory
31

32. 32

33. Reference: http://techgenix.com/aquicktiptoallowdsrmaccounttologonnormally/
33

34. 34

35. Reference: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#generic-
dacl-abuse
35

36. 36

37. 37

38. 38

39. 39

40. 40

41. Reference: https://docs.microsoft.com/en-us/windows/win32/adschema/r-user-
force-change-password
41

42. References: https://docs.microsoft.com/en-us/windows-server/identity/ad-
ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-
active-directory
https://adsecurity.org/?p=1906
42

43. 43

44. References: https://www.dcshadow.com/
https://www.labofapenetrationtester.com/2018/04/dcshadow.html
https://www.labofapenetrationtester.com/2018/05/dcshadow-sacl.html
44

45. 45

46. 46

47. 47

48. 48

49. [1] - http://active-undelete.com/dcom-configuration.htm
[2] - https://redmondmag.com/articles/2002/02/01/securing-remote-management-
with-wmi.aspx
49

50. https://github.com/BloodHoundAD/BloodHound/tree/master
https://github.com/canix1/ADACLScanner
https://www.pingcastle.com/
https://github.com/samratashok/Deploy-Deception
50

51. 51

52. 52