Windows Security

Notes on Windows authentication, credential attacks, and lateral movement techniques.

Directory map

• Windows Authentication Process — NTLM, Kerberos, authentication modules, logon flow
• Windows Logon Types — logon type codes, Event IDs 4624/4625, security monitoring significance
• Pass the Hash (PtH) — NTLM hash reuse, tools (Mimikatz, CrackMapExec, Impacket), mitigations
• Pass the Ticket (PtT) — Kerberos ticket theft, import/export, tools (Rubeus, Mimikatz)
• Pass the Certificate (PtC) — X.509 certificate-based TGT requests, PKINIT, AD CS abuse
• Attacking Active Directory (ADDS) — dictionary attacks against AD accounts, NTDS.dit hash extraction
• Attacking Windows Credential Manager — credential vault enumeration, extraction techniques
• Windows Privileges Overview — authorization process, privileged groups, user rights assignment, whoami /priv, detection (Event 4672)
• Windows Privilege Escalation — Initial Enumeration — tasklist, environment variables/PATH abuse, systeminfo/hotfixes, installed programs, netstat, user/group enumeration, password policy
• Windows Privilege Escalation — Communication with Processes — access tokens, netstat/loopback services, Splunk Forwarder, Erlang cookies, named pipes, AccessChk DACL review
• Windows Privilege Escalation — SeImpersonate / SeAssignPrimaryToken (Potato Attacks) — service account token impersonation, JuicyPotato, PrintSpoofer, RoguePotato
• Windows Privilege Escalation — SeDebugPrivilege — LSASS dumping with ProcDump/Mimikatz, SYSTEM RCE via token inheritance
• Windows Privilege Escalation — SeTakeOwnershipPrivilege — taking ownership of files/objects, takeown, icacls ACL grants, file-share credential hunting
• Windows Privilege Escalation — Built-in Groups (Backup Operators) — SeBackup/SeRestore abuse, NTDS.dit + SAM/SYSTEM extraction, secretsdump, robocopy
• Windows Privilege Escalation — Built-in Groups (DnsAdmins) — ServerLevelPluginDll SYSTEM DLL load, mimilib.dll, WPAD record / global query block list bypass
• Windows Privilege Escalation — User Account Control (UAC) Bypass — integrity levels, split tokens, GPO settings, UACME auto-elevate DLL hijack

Summary

Windows authentication relies on two primary protocols: NTLM (challenge-response, used for legacy and local auth) and Kerberos (ticket-based, preferred in domain environments). Understanding the logon flow — from the winlogon process through LSASS to the authentication packages — is essential for both offensive and defensive work.

Credential-based lateral movement attacks exploit Windows authentication mechanisms without requiring plaintext passwords. Pass the Hash reuses NTLM hashes to authenticate to remote services. Pass the Ticket imports stolen Kerberos tickets (.kirbi) to impersonate users. Pass the Certificate leverages X.509 certificates obtained through AD CS exploitation or Shadow Credentials attacks to request TGTs via PKINIT.