Kerberos

Introduction Assume we have obtained a shell as attacker_svc, a low-privileged domain user. We initially gained access through WinRM using credentials acquired earlier. Another user (victim) is currently logged on interactively to the same machine. Normally, the obvious approach would be to dump LSASS and extract the user’s credentials. However, because our account lacks the required privileges, that option is off the table. Our goal is therefore to obtain access to the victim’s account without interacting with their session directly. ...

Introduction Active Directory environments are full of subtle misconfigurations that can lead to complete domain compromise. One of the less-documented attack paths combines two primitives that alone seem harmless: Constrained Delegation and WriteSPN. Together, they enable an attacker to impersonate any user, including Domain Admins, against a Domain Controller. SPN Jacking is particularly valuable when classic alternatives like RBCD or Shadow Credentials are blocked or monitored. SPN Jacking offers an alternative path to domain compromise using only WriteSPN and an already-configured delegation. ...