I85PREP
⌘ K
OSEP study materials
OSEP study resources

OSEP: Windows and Active Directory Privilege Escalation and Lateral Movement

OSEP · Work through your exam, one topic at a time.

All guide sections

Windows and Active Directory Privilege Escalation and Lateral Movement

Local escalation is a token and a credential problem

Every Windows escalation primitive collapses into one of three: you control a process token (privileges, integrity level, group membership), you control a service or scheduled task that runs as someone stronger, or you can read a credential (memory, registry, disk, or the directory). Map findings to that triad: SeImpersonate/SeAssignPrimaryToken to the Potato family to SYSTEM; unquoted service paths, weak service ACLs, and writable PATH directories to service-account takeover; SeBackupPrivilege/SeRestorePrivilege to registry hives and NTDS.dit; SeDebugPrivilege to LSASS.

Domain escalation is an ACL and protocol problem

Kerberoasting needs an account with an SPN and yields a crackable service ticket; AS-REP roasting needs pre-authentication disabled. Delegation abuse needs unconstrained, constrained, or RBCD configuration plus a coercion primitive such as the printer bug or PetitPotam. ACL abuse (GenericAll, WriteDACL, ForceChangePassword, AddMember, DCSync rights) is the quietest path and the one BloodHound graphs best. ADCS misconfigurations (ESC1 template with enrollee-supplied SAN, ESC8 relay to the web enrolment endpoint) are frequently the intended answer.

Traps to expect

  • A Golden ticket requires the krbtgt hash; a Silver ticket requires the service account hash and works without contacting a DC.
  • Pass-the-hash works for NTLM-capable services, not for Kerberos-only paths; overpass-the-hash converts an NT hash to a Kerberos ticket.
  • Lateral movement always names an authentication protocol and a remote execution mechanism, for example SMB plus service creation (PsExec), WMI, WinRM, DCOM, or scheduled task.

Worked example

whoami /priv shows SeImpersonatePrivilege and the host is a modern Windows Server with no print spooler running. Spooler-dependent exploits fail; a fresh impersonation primitive (GodPotato-style, or a named-pipe impersonation technique) is needed. Rule of thumb: escalation gives you a token, escalation does not give you a password, so answer with the credential you actually obtain.