0Pricing
Cyber Security Academy · Lesson

Privilege Escalation and Domain Dominance

From foothold to Domain Admin.

Privilege Escalation and Domain Dominance is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

From Foothold to Domain Admin

A foothold is rarely the goal. The objective in an AD engagement is usually to demonstrate a path to Domain Admin or, more precisely, control of Tier 0 (DCs and identity infrastructure).

Privilege escalation in AD chains local escalation, credential theft, and directory misconfigurations until you reach the crown jewels.

Local Privilege Escalation First

From a low-priv shell on a host, you usually need local SYSTEM to dump credentials. Common local escalation vectors:

  • Unquoted service paths and weak service permissions.
  • Writable service binaries or DLL hijacking.
  • AlwaysInstallElevated MSI policy.
  • Token impersonation (Potato family) abusing SeImpersonatePrivilege.
# Enumerate local escalation paths
winPEAS.exe

# SeImpersonate abuse
PrintSpoofer.exe -i -c cmd.exe

Harvest and Pivot

With SYSTEM you dump cached credentials and pivot. Each new credential may unlock new hosts and higher privileges.

The loop is: dump → identify reachable targets in BloodHound → move laterally → dump again. Repeat until a privileged credential appears.

# Map shortest path to Domain Admins from owned principals
# In BloodHound: mark nodes Owned, then run
# 'Shortest Paths to Domain Admins from Owned Principals'

ACL-Based Escalation

Misconfigured ACLs are a reliable escalation path that needs no exploit. If you control a principal with rights over a privileged object, you can grant yourself access.

  • ForceChangePassword over a user lets you reset their password.
  • GenericWrite over a user lets you set an SPN and Kerberoast it, or set RBCD.
  • WriteDacl over a group lets you add yourself.
  • AddMember on a privileged group is direct escalation.
# PowerView: add self to a group you can WriteDacl
Add-DomainObjectAcl -TargetIdentity 'Domain Admins' -PrincipalIdentity attacker -Rights All
Add-DomainGroupMember -Identity 'Domain Admins' -Members attacker

Delegation Abuse

Delegation misconfigurations escalate effectively to impersonation of high-value users.

  • Unconstrained delegation: coerce a DC to authenticate (PrinterBug / PetitPotam), capture its TGT, then DCSync.
  • Resource-Based Constrained Delegation: with write rights on a computer, add a controlled account to its msDS-AllowedToActOnBehalfOfOtherIdentity and impersonate any user via S4U.
# RBCD takeover (Impacket)
rbcd.py -delegate-to TARGET$ -delegate-from FAKE$ -action write corp/user:pass
getST.py -spn cifs/target.corp -impersonate Administrator corp/FAKE$

ADCS Attacks (ESC paths)

Active Directory Certificate Services introduces certificate-based escalation. Misconfigured templates let low-priv users enroll certs that authenticate as anyone.

  • ESC1: template allows requester-supplied SAN plus client auth EKU.
  • ESC8: NTLM relay to the web enrollment endpoint.

A cert mapped to a DA is durable and survives password resets.

# Find vulnerable templates
Certify.exe find /vulnerable

# Request a cert impersonating an admin (ESC1)
Certify.exe request /ca:CA01\corp-CA /template:VulnTemplate /altname:Administrator

DCSync to Steal All Hashes

Once you control a principal with Replicating Directory Changes rights, you can impersonate a DC and pull any account's hash, including krbtgt, over the standard replication protocol. No code runs on the DC.

# Mimikatz DCSync of krbtgt
lsadump::dcsync /domain:corp.local /user:krbtgt

# Impacket secretsdump
secretsdump.py corp/admin@dc01 -just-dc

Establishing Domain Dominance

With krbtgt and DA-level hashes, you achieve dominance. Persistence options include:

  • Golden Ticket: forge TGTs from the krbtgt hash.
  • DCShadow: register a rogue DC to push malicious directory changes.
  • AdminSDHolder: backdoor the ACL template that re-applies to protected groups every hour.
  • Certificate-based persistence via ADCS.

Detecting the Endgame

High-impact actions generate detectable signals.

  • DCSync from a non-DC source IP: event 4662 with the replication GUID.
  • Coercion tools trigger anomalous machine-account authentication.
  • AdminSDHolder ACL changes (event 5136).
  • Anomalous certificate enrollment with SANs not matching the requester.

Defending Tier 0

Containing domain dominance requires architectural defenses.

  • Strict tiered administration: Tier 0 admins log on only to Tier 0 hosts.
  • Restrict replication rights; audit who holds DCSync.
  • Harden ADCS templates, enable enrollment approval, and patch PetitPotam/relay paths.
  • Patch AdminSDHolder ACLs and monitor protected-group changes.
  • Have a krbtgt double-rotation runbook ready.

Reporting Impact

For dominance findings, document the full kill chain: each privilege gained, the misconfiguration that enabled it, and the minimal fix. Prioritize remediations that break the chain earliest (e.g., fixing an ACL path) over point fixes.

Clean up forged tickets, rogue delegations, and test certificates before closing the engagement.

Quick Check

Validate your understanding of domain dominance.

Recap

You followed the path from initial foothold to full domain control.

  • Local escalation enables credential dumping; BloodHound guides pivots.
  • ACL misconfigs, delegation abuse, and ADCS ESC paths escalate without exploits.
  • DCSync extracts krbtgt; Golden Tickets and AdminSDHolder persist.
  • Tiering, replication-rights auditing, and ADCS hardening break the chain.

This completes the Active Directory and Kerberos course.

Frequently asked questions

Is the “Privilege Escalation and Domain Dominance” lesson free?

Yes — the full text of “Privilege Escalation and Domain Dominance” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Privilege Escalation and Domain Dominance”?

From foothold to Domain Admin. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Privilege Escalation and Domain Dominance” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Active Directory Attack Surface
  2. Kerberos and Kerberoasting
  3. Pass-the-Hash and Pass-the-Ticket
  4. Privilege Escalation and Domain Dominance
← Back to Cyber Security Academy