Laps on MrAzoth https://az0th.it/tags/laps/ Recent content in Laps on MrAzoth Hugo -- 0.154.5 en-us Advanced Techniques — From Windows https://az0th.it/ad/windows/advanced-techniques/ Mon, 01 Jan 0001 00:00:00 +0000 https://az0th.it/ad/windows/advanced-techniques/ <h2 id="quick-reference">Quick Reference</h2> <table> <thead> <tr> <th>Technique</th> <th>Tool</th> <th>Requirement</th> <th>Impact</th> </tr> </thead> <tbody> <tr> <td>KrbRelayUp (RBCD)</td> <td>KrbRelayUp + Rubeus</td> <td>Domain-joined, no LDAP signing</td> <td>Low-priv → SYSTEM</td> </tr> <tr> <td>gMSA password read</td> <td>GMSAPasswordReader</td> <td>Authorized principal</td> <td>Lateral movement</td> </tr> <tr> <td>LAPS password read</td> <td>Get-AdmPwdPassword / PowerView</td> <td>Read perm on ms-Mcs-AdmPwd</td> <td>Local admin on target</td> </tr> <tr> <td>PPL bypass (mimidrv)</td> <td>Mimikatz + mimidrv.sys</td> <td>Local admin</td> <td>LSASS dump despite PPL</td> </tr> <tr> <td>PPL bypass (PPLdump)</td> <td>PPLdump</td> <td>Local admin</td> <td>LSASS dump despite PPL</td> </tr> <tr> <td>LSASS dump (comsvcs)</td> <td>LOLBAS / rundll32</td> <td>Local admin</td> <td>Credential extraction</td> </tr> <tr> <td>WebDAV coercion trigger</td> <td>PowerShell</td> <td>Shell on target</td> <td>Force HTTP auth for relay</td> </tr> <tr> <td>Shadow credentials</td> <td>Whisker</td> <td>GenericWrite on account</td> <td>PKINIT auth, NT hash</td> </tr> </tbody> </table> <hr> <h2 id="krbrelayup--local-privilege-escalation-to-system">KrbRelayUp — Local Privilege Escalation to SYSTEM</h2> <h3 id="what-krbrelayup-is">What KrbRelayUp Is</h3> <p>KrbRelayUp abuses Resource-Based Constrained Delegation (RBCD) to escalate from a low-privilege domain user with a local shell to <code>NT AUTHORITY\SYSTEM</code> on the same machine. The attack creates a new machine account, configures RBCD on the target machine to trust that new account, then uses S4U2Self + S4U2Proxy to get a Kerberos service ticket impersonating <code>Administrator</code> (or any domain user) for the current machine — then uses that ticket to spawn a SYSTEM process.</p>