Token

Abusing Windows’ tokens to compromise Active Directory without touching LSASS

27 October 2022 ~24 min By Aurelien Chalot
Authentication Internals Redteam Token Windows
During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows server. Looking at the users connected on the same server, I knew that a domain administrator account was connected. All I had to do to compromise the domain, was compromise the account. This could be achieved by dumping the memory of the LSASS process and collecting their credentials or Kerberos…