Privilege-Escalation

ASREProasting is the lesser-known sibling of Kerberoasting, but it’s just as dangerous and significantly harder to detect. Unlike Kerberoasting, which requires authenticated access to request service tickets, ASREProasting exploits accounts with Kerberos pre-authentication disabled — allowing attackers to request encrypted AS-REP responses for any user without knowing their password. These encrypted responses can be cracked offline to recover plaintext credentials. This guide builds comprehensive ASREProasting detection in Splunk: the Event 4768 query patterns that identify AS-REQ abuse, accounts vulnerable to ASREProasting, volume anomalies, and the Splunk dashboards that turn authentication logs into actionable threat intelligence. ...

Kerberoasting is the technique every red team uses and every blue team underdetects. An attacker requests Kerberos TGS (Ticket Granting Service) tickets for service accounts, then cracks the encrypted portion offline to recover plaintext passwords. The attack leaves Event 4769 footprints on Domain Controllers that most SOCs ignore — and that’s exactly what makes Kerberoasting so effective in real breaches. This guide builds comprehensive Kerberoasting detection in Splunk: the Event 4769 query patterns that catch RC4 encryption abuse, service account targeting, volume anomalies, and the Splunk dashboards that turn raw Kerberos logs into actionable security intelligence. ...

The Windows privilege escalation surface has narrowed since the days of unquoted-service-path goldmines, but it hasn’t disappeared. Token abuse, misconfigured services, and overlooked AutoLogon registry entries still net SYSTEM on a meaningful percentage of corporate hosts. Step 0: Baseline whoami /all systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" hostname whoami /all is the single most informative command. Look at: ...

You have a low-privilege shell. Now what? This cheat sheet is the ordered, opinionated checklist that solves the privesc step on most CTFs and audits. 0. Stabilize the Shell python3 -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm-256color stty raw -echo; fg # back in your terminal: stty rows X cols Y A broken shell wastes hours. ...

Platform TryHackMe Difficulty Easy OS Linux Points 10 Release 2019-08-29 Tags Web enum, command injection, sudo abuse Pickle Rick is the room every new TryHackMe user solves first. It’s a perfect introduction to the full pentest loop on a single host — enumeration, exploitation, and post-exploitation — with a forgiving difficulty curve. ...