Can a foothold become Domain Admin?
Set Domain Admin as the objective and test from a chosen position in your network. AutoAttack follows the access it gains and records the credentials and permissions that extend the route.
← All objectivesWhat turned a foothold into Domain Admin?
In this hypothetical assessment, an employee account is the starting point. The objective is Domain Admin in the named Active Directory domain.
Inspect the domain privilege
The captured output supports administrator control of the named domain. Subscribers can inspect target names and captured evidence beside each gain.
Review the exposed credential and its privileges
Identify the readable file and the service account with domain administrator privileges. The owner can review the file permissions and the services that depend on the account before rotating its credential or reducing its access. Remediation advice sits beside the relevant gain in a paid report.
- A readable file exposes a privileged credential.The employee account can read a configuration file containing the password of a service account with Domain Admin privileges.
- That credential provides domain control.The campaign uses the recovered account to establish administrator control of the domain named in the objective.
What the report shows
- Access gained
- Follow the route from the starting point to the access the campaign reached, with evidence behind the steps.
- Where to investigate
- See which exposed credential or excessive permission enabled a transition. The report gives you a concrete condition to review.
- Published example
- Read the published lab test methods and results →
An example route through Active Directory
- 1Obtain a starting credentialAn account configured without Kerberos pre-authentication can allow offline password recovery. A recovered password may provide the first authenticated access.
- 2Find additional accessDirectory attributes and shared files can expose another credential. Its permissions determine which systems it opens.
- 3Follow a reused credentialA service-account password recovered on one host may also work elsewhere. The campaign tests whether that access extends the route within scope.
- 4Reach domain controlAdministrative or directory-replication rights can expose domain credentials. Trust configuration determines whether access can extend to another domain.
Related
Set an objective for your network.
Run a campaign free and review its masked report before subscribing.
Contact