https://blog.iamwin.xyz/tags/privilege-escalation/Recent content in Privilege Escalation on IamWin's BlogHugoen-usTue, 30 Jun 2026 01:08:00 -0500https://blog.iamwin.xyz/posts/esc8_krb/Tue, 30 Jun 2026 01:08:00 -0500https://blog.iamwin.xyz/posts/esc8_krb/<h2 id="summary">Summary</h2> <p><strong>ESC8</strong> is an AD CS vulnerability where the Certificate Enrollment Web Service is enabled over <strong>HTTP</strong> (without HTTPS). This allows intercepting a Domain Controller&rsquo;s authentication and relaying it to the CA to request a certificate. With that certificate we can impersonate the DC, perform DCSync, and take full control of the domain.</p> <h2 id="requirements">Requirements</h2> <ul> <li>Valid domain user credentials (<code>Rosie.Powell:Cicada123</code>)</li> <li>The CA has Web Enrollment over HTTP enabled</li> <li>NTLM disabled in the domain (authentication must use Kerberos)</li> <li>Machine Account Quota &gt; 0 (allows adding DNS records, default is 10)</li> </ul> <h2 id="step-by-step-walkthrough">Step-by-step Walkthrough</h2> <h3 id="1-initial-setup">1. Initial Setup</h3> <p>Ensure correct DNS resolution in <code>/etc/hosts</code>:</p>https://blog.iamwin.xyz/posts/esc11/Sun, 28 Jun 2026 21:30:00 -0500https://blog.iamwin.xyz/posts/esc11/<h2 id="introduction">Introduction</h2> <p><strong>ESC11</strong> is a vulnerability in <strong>Active Directory Certificate Services (ADCS)</strong> that occurs when the RPC interface of the Certificate Authority (CA) — specifically the <strong>ICertPassage (MS-ICPR)</strong> interface — does not enforce signing or encryption for certificate enrollment requests. This happens because the <code>IF_ENFORCEENCRYPTICERTREQUEST</code> flag is disabled on the CA.</p> <p>Since no packet signing or encryption is required on this RPC interface, it becomes vulnerable to <strong>NTLM Relay</strong> attacks. If an attacker manages to coerce the NTLM authentication of a privileged account (such as the machine account of a Domain Controller or a Domain Admin), they can relay that authentication to the CA&rsquo;s RPC port and request a valid certificate on behalf of the victim.</p>https://blog.iamwin.xyz/posts/esc8/Tue, 09 Jun 2026 03:00:00 -0500https://blog.iamwin.xyz/posts/esc8/<h2 id="introduction">Introduction</h2> <p><strong>ESC8</strong> is a vulnerability in <strong>Active Directory Certificate Services (ADCS)</strong> that occurs when the <strong>Web Enrollment</strong> service is enabled over HTTP without encryption, or over HTTPS without <strong>Channel Binding (EPA)</strong> enabled.</p> <p>The vulnerable endpoint is:</p> <pre tabindex="0"><code>http://&lt;CA&gt;/certsrv/certfnsh.asp </code></pre><p>This endpoint accepts <strong>NTLM authentication without signing or channel binding</strong>, making it susceptible to <strong>NTLM Relay</strong> attacks. In essence, an attacker can intercept the NTLM authentication of a privileged account (such as the Domain Controller&rsquo;s machine account) and relay it to the ADCS service to obtain a valid certificate on behalf of that account.</p>https://blog.iamwin.xyz/posts/trustad/Mon, 08 Jun 2026 01:00:00 -0500https://blog.iamwin.xyz/posts/trustad/<h2 id="introduction"><strong>INTRODUCTION</strong></h2> <p>Domain Trust relationships in Active Directory are fundamental to allowing users from one domain to access resources in other domains. However, from a Red Teaming perspective, these relationships represent an excellent vector for privilege escalation and lateral movement.</p> <p>In this post, we will explore how to abuse a <strong>Child-to-Parent</strong> trust relationship within the same forest to escalate privileges from a fully compromised subdomain to the root domain.</p> <hr> <h2 id="key-concepts"><strong>KEY CONCEPTS</strong></h2> <h3 id="what-is-a-domain-trust"><strong>What is a Domain Trust?</strong></h3> <p>It is a trust mechanism between two domains that enables cross-domain authentication. Its key properties are:</p>