OSCP+ Notes 2025
search
⌘Ctrlk
OSCP+ Notes 2025
  • Scanning
    • nmap
  • SERVICES
    • MSSQL
    • HTTP
    • NFS
    • FTP
    • SNMP
    • SMTP
    • MYSQL
    • SMB
  • AD
    • Methodology
    • No Credentials
    • Username - no password
    • Username and Password Owned
  • Initial Attacks
    • MiTM (Listen & Relay)
    • ASP-REP Roasting
    • Kerberoasting
    • DC Sync
    • Silver Ticket
    • Client Attacks
    • KRB_AP_ERR_SKEW - sync time with Domain
  • Privs & Groups
    • SeManageVolumePrivilege
    • SeBackupPrivilege
    • GenericWrite or GenericAll on user
    • SeImpersonatePrivilege Exploit
    • SeDebugPrivilege
    • Server Operators Group
  • Lateral
    • PsExec
    • Creds login
    • Pass The Hash
    • Overpass the hash
    • Pass The Ticket
    • Shadow Credentials
    • Resourced Contrained Delegation
    • Unconstrained Delegation
    • Constrained Delegation
    • GPO Abuse
    • DCOM - TODO
    • Azure AD Connect Sync
    • AD-CS
    • defaultpool access
  • Persistence Access
    • Golden Ticket - TODO
    • Shadow Copies
    • Extract/Crack LSA & SAM
  • Windows PrivEsc
    • Checklist
    • Basics
    • Services Enum
    • Unquoted Service Name
    • Weak Permissions on Service Config
    • Weak Permissions on Service Binary
    • Insecure File/Folder Permissions
    • AlwaysInstallElevated
    • Autoruns
    • Stored Credentials
    • DLL Hijacking
    • Scheduled Tasks
    • SeImpersonatePrivilege Exploit
    • Kernel Exploits
    • History Logs
    • Add user script
    • Create new service
    • Dump sam
    • File transfering
    • evil-winrm
    • Shells
  • PASSWORD CRACKING
    • Kerberos
    • NTLM
    • JtR ZIP
    • JtR PFX
    • keepass
    • id_rsa
    • Page
  • wordlist generate
  • Linux PrivEsc
    • Checklist
    • suid/sgid
    • Users
    • Writable dirs
    • Useful software
    • cronjobs
    • Services
    • sudo baron vuln
    • c code to get root shell
    • Better Shell python
  • Forwarding
    • lingolo-ng
    • ssh local port forward
    • chisel local port forwarding
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Persistence Access

Golden Ticket - TODO

https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/goldenarrow-up-right

Previousdefaultpool accesschevron-leftNextShadow Copieschevron-right

Last updated 4 months ago