Windows Security 17

• Revisiting a Abuse of Read-Only Domain Controllers (RODCs) Nov 27, 2023
• S4UTomato - Escalate Service Account To LocalSystem via Kerberos Aug 2, 2023
• Revisiting a UAC Bypass By Abusing Kerberos Tickets Jul 29, 2023
• How to Forge a Kerberos Ticket by Yourself Jul 9, 2023
• Creating Windows Access Tokens With God Privilege Jul 6, 2023
• Pass The Certificate when PKINIT Padata Type is NOSUPP Feb 28, 2023
• Revisiting a Credential Guard Bypass From Wdigest Jan 18, 2023
• Privilege Escalation - Exploiting RBCD Using a User Account May 27, 2022
• PetitPotato - How Do I Escalate To SYSTEM Via Named Pipe May 21, 2022
• Domain Escalation - Certifried combined with KrbRelay May 19, 2022
• Certifried - Active Directory 域权限提升漏洞（CVE-2022–26923） May 12, 2022
• Privilege Escalation - NTLM Relay over HTTP (Webdav) May 2, 2022
• Shadow Credentials Apr 27, 2022
• 使用 MITM6 通过 DNS 中继 Kerberos 身份验证 Apr 26, 2022
• 使用 MITM6 中继 WPAD 身份验证 Mar 26, 2022
• Attack Surface Mining For AD CS Mar 15, 2022
• Abusing Domain Delegation to Attack Active Directory Mar 12, 2022