HTB CAPE key terms

A variable-length numeric value that uniquely identifies a Windows security principal such as a user, group, or computer. Access control entries and Kerberos tickets reference principals by SID rather than by name, so SID history and SID-based abuse matter.

A single rule inside a discretionary access control list that grants or denies a specific principal a specific right over an object. Misconfigured ACEs on AD objects are a primary source of privilege escalation paths.

The ordered list of ACEs attached to an AD object that determines who may read or modify it. An empty or missing DACL means everyone is allowed, while a permissive DACL lets an attacker take ownership or grant rights.

An ACE right that confers full control over an AD object, including the ability to reset passwords, modify group membership, or alter attributes. On a user it allows a forced password reset; on a group it allows adding yourself as a member.

An ACE right permitting modification of non-protected attributes of an object. Against a user it can enable setting a service principal name for targeted Kerberoasting; against a computer it can allow resource-based constrained delegation abuse.

An ACE right that lets a principal rewrite an object's DACL. An attacker with WriteDACL can grant themselves full control over the object, which is often the fastest route from a low-privileged account to domain admin.

An extended right that allows a principal to reset another user's password without knowing the current one. It is frequently found delegated on helpdesk groups and yields immediate account takeover of the target user.

The owner of an AD object implicitly holds the right to read and change its DACL. Attackers use the SeRestorePrivilege or WriteOwner-style rights to seize ownership and then rewrite permissions to gain control.

Querying the directory over port 389 or 636 to harvest users, groups, computers, trusts, and password policy. Unauthenticated or low-privileged LDAP queries often reveal enough structure to plan later attacks.

A user or group attribute set to 1 when the object was placed in a protected administrative group. Objects with AdminCount set, especially those no longer privileged, are prime targets because their ACLs were once hardened and may retain stale rights.

A template object whose DACL is periodically copied onto protected administrative accounts by the SDProp process. Modifying the AdminSDHolder DACL grants persistent rights over every protected account in the domain.

Requesting a service ticket for an account with a registered service principal name, then cracking the ticket offline to recover the service account password. Success depends on the account having a weak password and RC4 or AES tickets being obtainable.

Requesting an authentication service response for an account that has Kerberos pre-authentication disabled, then cracking the encrypted portion offline. No valid credentials are needed if the username is known.

A Kerberos setting requiring clients to prove knowledge of a password before the KDC issues a ticket. When disabled on an account, anyone can request an AS-REP encrypted with that account's key and crack it offline.

An identifier mapping a service instance to an account, such as HTTP/web01.corp.local. Any account with an SPN can be requested as a service ticket, making SPN-bearing accounts Kerberoastable.

Using GenericWrite or similar rights to set an SPN on a chosen account, then Kerberoasting it. This converts an ACL misconfiguration into an offline password-cracking opportunity against an otherwise non-service account.

A time-limited credential issued by the KDC, either a ticket-granting ticket or a service ticket. Tickets are encrypted with account keys, and stolen or forged tickets can be replayed to impersonate users.

A Kerberos ticket encrypted with the krbtgt account hash that proves a user's identity to the KDC. A forged TGT, or golden ticket, grants arbitrary access until the krbtgt password is changed twice.

A forged TGT created with the krbtgt account's secret, allowing impersonation of any user including domain admins. It survives password resets of victim accounts and is only invalidated by rotating krbtgt twice.

A forged service ticket encrypted with a service account's key, granting access to a specific service without contacting the KDC. It is stealthier than a golden ticket but limited to the targeted service and host.

A built-in domain account whose key encrypts all TGTs. Compromise of its hash enables golden tickets, so incident response requires resetting its password twice to invalidate existing tickets.

Authenticating with a captured NTLM hash instead of the plaintext password. It works where NTLM is accepted and lets an attacker move laterally without cracking the hash.

Using an NTLM hash or AES key to request a Kerberos ticket, converting a hash into a Kerberos credential. The resulting ticket can then be used for pass-the-ticket against Kerberos-enabled services.

Injecting a stolen Kerberos ticket into a session to authenticate as its owner. It requires no password knowledge and is effective until the ticket expires or is revoked.

Coercing a victim to authenticate to an attacker-controlled listener, then forwarding that authentication to another service to act as the victim. Signing and channel binding mitigate it, and SMB signing absence is a common enabling condition.

Forcing a machine or user to authenticate to an attacker-specified host, often via protocols such as PetitPotam or PrinterBug. Coerced authentication feeds NTLM relay or resource-based constrained delegation attacks.

A delegation configuration where a service can impersonate any user to any service, storing the user's TGT on the host. Compromise of such a host lets an attacker harvest TGTs of connecting privileged users.

A delegation model restricting a service to a defined list of back-end services, encoded in the msDS-AllowedToDelegateTo attribute. Abuse involves requesting a ticket for a permitted SPN and impersonating an arbitrary user via S4U2Self and S4U2Proxy.

Delegation configured on the target resource via msDS-AllowedToActOnBehalfOfOtherIdentity rather than on the front-end service. Anyone with write access to that attribute on a computer object can impersonate users to it.

An attribute holding additional SIDs applied to a user's token, originally for domain migrations. Injecting a privileged SID such as Domain Admins into SID History grants that group's access without actual membership.

A relationship allowing principals in one domain or forest to be authenticated in another. Trust direction and transitivity determine which side can enumerate and access the other, and trust keys enable inter-realm ticket forgery.

The shared secret between two domains that encrypts inter-realm referral tickets. Extracting it allows forging tickets that cross the trust, enabling compromise of the trusting domain from the trusted one.

A protection that strips foreign SIDs from tokens crossing a trust boundary. It blocks SID-history based escalation across trusts, but it is not enforced within a single forest by default.

The property that trusts within a forest are transitive, so any domain can authenticate principals from any other domain in the same forest. This makes a single compromised domain a stepping stone to forest-wide compromise.

A feature that stores local administrator passwords in AD attributes, readable only by delegated principals. Misconfigured read permissions on the LAPS attributes expose local admin credentials for many machines at once.

Extracting secrets such as password hashes, Kerberos keys, or cached credentials from memory or registry hives on a compromised host. Tools target LSASS, SAM, and the SECURITY hive to obtain material for lateral movement.

The Windows process that enforces security policy and caches credential material for active sessions. Reading its memory yields NTLM hashes and Kerberos tickets, which is why it is heavily protected and monitored.

A Windows interface that encrypts user and system secrets such as saved credentials and browser data. Decryption depends on the user's master key, so both the master key and the encrypted blob must be recovered.

Granting a low-visibility principal rights such as WriteDACL or GenericAll on a privileged object so access can be regained later. It blends into normal directory permissions and survives password changes.

A persistence technique that registers a rogue domain controller and pushes changes into AD replication, bypassing normal change logging. Detecting it requires monitoring for unexpected domain controller registrations and replication traffic.

Abusing directory replication rights to request account secrets from a domain controller as if it were a peer DC. It yields krbtgt and privileged account hashes without touching LSASS on the DC.

Moving from one compromised host or account to another to reach higher-value targets. Common techniques include remote service creation, WinRM, SMB, and credential reuse with pass-the-hash or pass-the-ticket.

Routing attack traffic through a compromised host to reach networks not directly accessible from the attacker. It typically relies on port forwarding or SOCKS proxies established on the foothold.

A remote management protocol over HTTP or HTTPS that provides PowerShell remoting. Valid credentials with remote management rights are enough to execute commands, making it a common lateral movement channel.

The first reliable level of access an attacker establishes inside a target environment. It usually means code execution as a low-privileged user on a host, from which enumeration and privilege escalation proceed.

The phase in which an attacker first gains entry to the environment, such as through valid accounts, exposed services, or phishing. In AD labs it often begins with leaked credentials or a vulnerable public-facing application.

Trying a small set of common passwords against many usernames to avoid lockout thresholds. It is effective in AD because password policy is often weak and lockout counters are per account.

A tool that ingests AD data and graphs relationships such as group membership and ACL rights to reveal attack paths. It helps prioritize escalation steps from a controlled principal toward domain admin.

The process of gathering directory data via LDAP, session, and local admin collection for graph analysis. Collection method and stealth determine whether the activity is logged by defenders.

Concrete, prioritized fixes reported after an assessment, such as removing excessive ACL rights, rotating krbtgt, and enforcing tiered administration. Good guidance ties each finding to a specific risk and verification step.

Documenting findings with affected assets, evidence, business impact, and reproduction steps so defenders can act. Clear reports distinguish critical domain-wide risks from localized misconfigurations and include retest criteria.

A chained sequence of weaknesses leading from an entry point to a target objective such as domain admin. Documenting the full path helps defenders break one link rather than patching isolated findings.