From the course: Advanced Pen Testing Techniques for Active Directory

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Running a shadow attack

Running a shadow attack - Active Directory Tutorial

From the course: Advanced Pen Testing Techniques for Active Directory

Start my 1-month free trial Buy for my team

Running a shadow attack

“

- Microsoft uses public key cryptography as an underlying mechanism for access through the Kerberos protocol and provides an active directory component called "AD Certificate Services" to manage the public key certificates. We want to avoid attackers escalating or gaining long-term access to active directory once they've been able to compromise a domain user account. In addition to attacks on the accounts themselves, we want to defeat any attacks on this certificate infrastructure. There's a number of potential ways of exploiting Active Directory Certificate Services which have been documented by Will Schroeder and Lee Christensen in their paper entitled "Certified Pre-Owned". This provides numerous ways to attack specific configurations of Active Directory Certificate Services through theft or technical attack to achieve lateral movement, privilege escalation, and persistence. Testing AD Certificate Services is of…

Contents