For this post, we will be deep-diving into the art of Windows file transfers. We will go over various techniques on how to transfer files from our attacker machine onto a victim Windows 10 host (download), as well as from…
In this post we will go over three different methods that can be used to perform UAC-bypass in order to elevate from a medium-integrity shell to a high-integrity shell. We will run through two different scenarios where this would apply;…
In this post we will be demonstrating how to perform an over-pass-the-hash attack using rubeus.exe and getTGT.py. We will run through a quick example scenario where we have gotten a foothold on a Windows 10 domain-joined host. From there, we…
In this post we will take a look A LOT of tools and techniques that can be used to perform a pass-the-hash attack. First, we will dump the local SAM file hashes off our initial victim and extract the local…
In this post we are going to extract a copy of the SAM and SYSTEM file from a Windows Server using a service account that has SeBackupPrivilege enabled. We will have a look at a scenario where we have gotten…
In this post, we are going to review various techniques that can be used to dump the local SAM file hashes from a Windows host. To begin, we will examine a scenario where we have obtained a foothold on a…
