Penetration Testing – discussing exploits, vulnerabilities, fixes and tools
Here I will be discussing exploits, vulnerabilities, fixes and tools dedicated to the two areas of personal interest to me within Penetration Testing. Infrastructure and Web Application Testing.
- CVE-2021-4034 “Pwnkit” Local Privilege Escalation (LPE) vulnerability
- PetitPotam and Active Directory Certificate Services NTLM Relay Attack
- Basic Pivoting Techniques
- GPO Abuse – Edit permissions misconfiguration
- DACL Trouble: GenericAll on OUs
- Pass the Ticket: PTH
- LAPS ms-Mcs-AdmPwd enumeration/attack vector
- Stealing RDP Sessions
- Active Directory Resource-based Constrained Delegation: Attack Path
- Networking Pivoting via SSH – Scanning with Nessus Professional behind a Firewall or NAT.