Section index
The knowledge base grouped by phase — fundamentals through domain dominance, plus the end-to-end attack paths that chain them together.
The objects, protocols and stores an attacker reasons over: directory structure, Kerberos flow, NTLM, and where the secrets live.
Getting authentication material out of the domain: roasting, replication, and reusing hashes, keys, tickets and certs.
Once you hold a signing secret, forge tickets offline: Golden, Silver, Diamond, and SID-history injection.
Unconstrained, constrained and resource-based delegation misconfigurations that turn into impersonation and privilege escalation.
Force a machine to authenticate, then relay it: PetitPotam, the printer bug, mitm6/WPAD, and Kerberos relay.
Active Directory Certificate Services misconfigurations — the ESC1–ESC15 family — that mint authentication certificates.
Abusing DACLs on directory objects and GPOs — GenericAll, WriteDACL, WriteOwner — to walk edges toward Domain Admin.
Winning the box: low-priv shell → local admin/SYSTEM via UAC, tokens, services, tasks, pipes, DLLs and PATH, plus the Potato family — and keeping it.
Turning credentials into code execution across hosts: SMB, WMI, WinRM, PSRemoting and RDP.
Durable footholds once you own the domain: DCShadow, Skeleton Key, AdminSDHolder and DSRM backdoors.
Attacking the deployment plane: SCCM/MECM network access accounts and WDS/MDT imaging shares.
Crossing the domain and forest boundary: SID filtering, TREAT_AS_EXTERNAL and trust-key abuse.
The defender's side: tiering baselines, honeytokens and the log artifacts each technique leaves behind.
How an engagement actually runs: the kill-chain arc, situational awareness, C2/pivoting and staying quiet.
Reading and building Windows binaries: the PE format, shellcode, API hashing, packing, injection, and the static + dynamic analysis workflow.
Running C2 and staying quiet: beaconing, Cobalt Strike, AMSI/ETW evasion, and the Sysmon/Sigma detection they're built against.
End-to-end chains: the specific misconfiguration, the tooling, and the walk from foothold to domain dominance.
Pages not yet filed under a section.