Attacking the Windows Domain

Abstract

An attacker that has gained a foothold on a network using the techniques of Chapter 2 can use Metasploit and native tools to expand their influence. Metasploit comes with reconnaissance modules that allow the attacker to determine their user privileges, the domain controller(s), and the account names for the domain administrators. If the attacker has compromised a privileged account, there are methods to allow the attacker to bypass User Account Control (UAC) to gain SYSTEM privileges. If not, the chapter presents ways the attacker can try to gain SYSTEM privileges, including exploiting insecure configuration of the host or using one of the Metasploit privilege escalation modules.