HTB CAPE flashcards
HTB CAPE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Forest security boundary
- A forest is the top-level AD security boundary; compromising any domain in it generally allows compromise of all domains via trust and SID history abuse.
- Domain naming context
- The partition holding users, groups, and computers for one domain; it replicates to every domain controller in that domain but not to other domains.
- Global Catalog port
- TCP 3268 (LDAP) and 3269 (LDAPS) expose the Global Catalog, a partial replica of all objects in the forest used for cross-domain searches and logon.
- rootDSE query
- An LDAP query for the empty base with scope base returns namingContexts, defaultNamingContext, and supported controls, useful for unauthenticated enumeration.
- adminCount attribute
- Set to 1 on accounts protected by AdminSDHolder; querying (adminCount=1) reveals privileged accounts whose ACLs are controlled by SDProp.
- BloodHound edge
- A relationship such as GenericAll, WriteDACL, or ForceChangePassword between AD objects; shortest-path queries chain edges from owned principals to Domain Admin.
- Password spray lockout rule
- Attempt at most one password per account per lockout window, staying below lockoutThreshold; check the domain policy first with net accounts /domain.
- AS-REP roasting
- Requesting a TGT for an account with pre-authentication disabled; the response is encrypted with the user's password hash and can be cracked offline.
- Kerberoasting
- Requesting a service ticket for an SPN account; the ticket is encrypted with the service account's NTLM hash and can be cracked offline with hashcat mode 13100.
- LLMNR poisoning
- Responder answers failed broadcast name-resolution requests, capturing NetNTLMv2 hashes from victims that can be cracked or relayed to other hosts.
- NTLM relay precondition
- Relay succeeds when the target does not enforce SMB signing and the victim's credentials are relayed by ntlmrelayx; check signing with nxc smb --gen-relay-list.
- GPP cpassword
- A password field in SYSVOL Groups.xml encrypted with a public Microsoft AES key; anyone reading SYSVOL can decrypt it with gpp-decrypt.
- LSASS credential dumping
- Extracting plaintext passwords, hashes, and tickets from the LSASS process memory; requires admin or SYSTEM on the target host.
- DCSync rights
- The DS-Replication-Get-Changes and DS-Replication-Get-Changes-All permissions on the domain root let a principal replicate password hashes like a domain controller.
- Overpass-the-hash
- Converting an NTLM hash into a Kerberos TGT with Rubeus asktgt /rc4, useful when NTLM authentication is blocked but Kerberos is allowed.
- Unconstrained delegation abuse
- A host trusted for unconstrained delegation caches TGTs of connecting users; coercing a DC to authenticate yields a DC TGT usable for DCSync.
- ForceChangePassword edge
- An ACL permission allowing a principal to reset another user's password without knowing the old one, granting immediate account takeover.
- Pass-the-hash
- Authenticating with an NTLM hash instead of a plaintext password; works over SMB, WMI, and WinRM where NTLM authentication is accepted.
- WMI execution
- Remote command execution via WMI (wmiexec) using RPC port 135 and a dynamic range; semi-interactive, leaves less disk evidence than PsExec.
- Chisel reverse SOCKS
- A tunneling tool: chisel server --reverse on the attacker, chisel client with R:socks on the victim, then proxychains routes tools through the SOCKS port.
- Ligolo-ng pivot
- A TUN-based pivoting tool creating a virtual interface on the attacker, allowing direct routing to internal subnets without proxychains per-tool configuration.
- SMB signing requirement
- When SMB signing is enforced, NTLM relay to SMB fails; relay targets must be hosts where signing is not required.
- Golden Ticket
- A forged TGT signed with the krbtgt NTLM hash; grants access as any user in the domain until krbtgt is rotated twice.
- Silver Ticket
- A forged service ticket signed with a service account's NTLM hash; access is limited to that service on that host and requires no domain controller contact.
- Skeleton Key
- An LSASS patch on a domain controller making 'mimikatz' a master password for any account; volatile, requires DA on the DC, and is detectable.
- RBCD abuse
- Resource-Based Constrained Delegation: with write access to a computer object, set msDS-AllowedToActOnBehalfOfOtherIdentity to a controlled account's SID, then use S4U2Proxy.
- ExtraSIDs attack
- Embedding an Enterprise Admins SID from another domain in a Golden Ticket's SID history to gain forest-wide administrative access across domain trusts.
- WriteDACL to DCSync
- Granting yourself DS-Replication-Get-Changes and -All on the domain root via WriteDACL enables DCSync without Domain Admin membership.
- AdminSDHolder persistence
- An ACE added to CN=AdminSDHolder,CN=System,DC=domain is pushed by SDProp to all protected accounts every 60 minutes, granting durable access.
- SID History injection
- Adding a privileged SID to a low-privileged user's sIDHistory so its token includes that SID; requires Domain Admin or equivalent and is logged as event 4765.
- DCShadow
- Registering a rogue domain controller to push arbitrary directory changes, such as ACL or SID history modifications, bypassing normal replication audit paths.
- krbtgt rotation
- Resetting the krbtgt password twice with replication in between invalidates all forged Golden Tickets; a single reset does not.