Remote Potato - From Domain User to Enterprise Admin скачать в хорошем качестве

Remote Potato - From Domain User to Enterprise Admin

Remote Potato is a technique which can be used for elevation of privileges (Domain User to Enterprise Administrator). The Domain Administrator needs to be physically connected or via RDP on the host. A COM activation call is triggered which is sent to the host of the attacker. The traffic is forwarded back and this triggers a second authenticated call which is captured locally (RPC Server). This authentication is sent to an HTTP server which the attacker controls and relayed to the domain controller via LDAP. Since the authentication include the NTLM Type 3 Authentication of the domain administrator authentication to the domain controller is achieved and the user is added to the Enterprise Admins group. It should be noted that the user should be part of the Remote Management Users group. Article: https://pentestlab.blog/2021/05/04/re...