38. Active Directory Attacks and Defence
38.7 Privilege Escalation Paths and Domain Admin Risks
Common AD privilege escalation (अधिकार वाढ) themes (concepts):
- ACL abuse:
GenericAll,WriteDacl,WriteOwneron users/groups/computers - Shadow admins / nested group surprises
- Unconstrained delegation on a computer – stolen TGTs risk if that host is compromised (prefer constrained / resource-based constrained delegation)
- Over-privileged service accounts that are also in high groups
- Legacy protocols + mis-set SPNs (38.4)
Domain Admin risk: backup operators, account operators, DNS admins (historically sensitive), replication rights (DCSync) – treat as Tier-0 adjacent. Remediation: clean nested groups; JIT/PAM; PAW; no standing DA for daily mail; audit privileged groups weekly.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Walks ACL edges until reset-password / group add on DA | Regular ACL / BloodHound reviews; remove WriteDacl/GenericAll sprawl |
| Targets unconstrained delegation hosts | Inventory TrustedForDelegation; migrate to constrained/RBCD; monitor |
| Adds self to privileged group after ACL abuse | Alert 4728/4732 on Domain Admins; webhook to SOC |
Ravindra Bagale's Tip
"Domain Admin as the daily driver" – the most common mistake in Maharashtra SMBs (fictional shops too). Even if Raja is the business owner – no daily Chrome sessions as DA. Use a separate admin account + the PAW habit. For interviews, keep a one-liner ready on unconstrained vs constrained delegation.
Ravindra Bagale's Tip – मराठी
"Domain Admin daily driver" – Maharashtra मधल्या SMB मधली सर्वात common चूक (fictional shops पण). Raja business owner असला तरी – daily Chrome DA session नको. Separate admin account + PAW सवय. Interview मध्ये unconstrained vs constrained delegation चा one-liner तयार ठेवा.
Ravindra Bagale's Tip – हिंदी
"Domain Admin daily driver" – Maharashtra के SMB की सबसे common गलती (fictional shops भी). Raja business owner हो तो भी – daily Chrome DA session नहीं. Separate admin account + PAW की आदत. Interview के लिए unconstrained vs constrained delegation का one-liner तैयार रखो.
Lab
Lab DC var PowerShell (as lab admin): list users with SPN; list computers TrustedForDelegation. Document findings. Create intentional bad ACL on a test OU (GenericAll to amir) → BloodHound shows edge → remove ACL → re-verify. Never leave bad ACL overnight without snapshot restore plan.