Pentest Notes
CtrlK
  • 🏠/home/x3m1Sec/.pt-notes
  • 📝Pentest Notes
    • 🔍Information Gathering
    • 📜Protocols and Services
      • DNS Port (53)
      • FTP Port (21)
      • IMAP Ports (143,993)
      • IPMI Port (623)
      • Kerberos Port (88)
      • MSSQL Port (1433)
      • MySQL Port (3306)
      • NFS Ports (111,2049)
      • NetBIOS Ports (137,138,139)
      • Oracle TNS Port (1521)
      • POP3 Port (110)
      • PostgreSQL Port (5432)
      • RDP Port (3389)
      • SMB Ports (139,445)
      • SMTP Port (25)
      • SNMP Ports (161,162)
      • Java RMI Port (1099)
      • LDAP Ports (389,636)
      • Apache Tomcat Ports (8080,8180)
      • Port 123 - NTP
      • RPCBind Ports (111,32771)
      • Email Services
      • Nmap Commands for Port Discovery
    • 🕸️Web Applications
      • Web Attacks
        • Cross Site Scripting (XSS)
        • SQL Injection (SQLi)
        • File Upload Vulnerabilities
        • Insecure Direct Object References (IDOR)
        • OS Command Injection
        • Local File Inclusion (LFI)
        • Remote File Inclusion (RFI)
        • XML External Entities (XXE)
        • HTTP Verb Tampering
        • Sub-domain Enumeration
      • Web Technologies
        • Tomcat
        • CGI Applications
        • WordPress
        • SAP Netweaver
        • Joomla
        • Drupal
        • Gitlab
        • Jenkins
        • Microsoft IIS
        • osTicket
        • PRTG Network Monitor
        • Splunk
      • Fuzzing
    • 🪟Active Directory Pentesting
      • 🔍Initial Enumeration
        • 👤Enumerating Users
      • 🛠️Abusing ACLs/ACEs
      • 🏛️Active Directory Certificate Services (ADCS)
      • 🎭Attacking Kerberos
      • 🐶Bloodhound
      • 🧰Tools
        • 🩸BloodyAD
        • 📦Impacket
        • 🦁Kerbrute
        • 📚LDAPSearch
        • 🧠PowerView.py
    • 🐧Linux Privilege Escalation
      • Linux PrivEsc Summary
      • PriveEsc Checklist
      • Enumerating Attack Vectors
      • Privileged Groups
      • Environment Variables Abuse
      • Capabilities Abuse
      • Programs, Jobs and Services
      • Miscellaneous Techniques
      • Recent CVEs
    • 🪟Windows Privilege Escalation
      • PriveEsc checklist
      • Enumerating Attack Vectors
      • Excessive User Rights Abuse
      • Built-in Groups Abuse
      • File System ACLs
      • Services Hijacking
      • User Account Control (UAC) Bypass
      • Living off the Land
    • 🐛Bug Bounty Hunting
      • Bug Bounty Tools
    • 👾Utilities, Scripts and Payloads
      • Shells and Payloads
      • Metasploit Framework
      • File Transfers
      • Pivoting, Tunneling, Port Forwarding
      • Password Attacks
      • Spawn TTY Shells
  • 🎮CTFs
    • 🟩Hack The Box
      • Linux
        • Easy
          • Busqueda
          • Help
          • Sau
          • Broker
          • Sea
          • Nibbles
          • Codify
          • Cozyhosting
          • Devvortex
          • Irked
          • Keeper
          • Knife
          • Pilgrimage
          • Soccer
          • Sunday
          • Tabby
          • Usage
          • Bashed
          • Analytics
          • Networked
          • Swagshop
          • Pandora
          • OpenAdmin
          • Precious
          • Boardlight
          • Editorial
          • Linkvortex
          • Underpass
        • Medium
          • Monitored
          • Updown
          • Popcorn
          • Jarvis
          • Mentor
          • Poison
          • Solidstate
          • Tartarsauce
          • Nineveh
          • Magic
          • Builder
        • Hard
      • Windows
        • Easy
          • Jerry
          • NetMon
          • Servmon
          • Bounty
          • Arctic
          • Buff
          • Love
          • Access
          • Mailing
          • Heist
          • Active
          • Forest
          • Sauna
          • Timelapse
          • Return
          • Cicada
          • EscapeTwo
        • Medium
          • Chatterbox
          • Jeeves
          • Sniper
          • Querier
          • Giddy
          • Remote
          • SecNotes
          • Monteverde
          • Administrator
          • Certified
          • Thefrizz
          • Escape
        • Hard
          • Blackfield
          • Flight
    • 🔴TryHackMe
  • 🎓Road to certification
    • eJPTv2
      • My review
    • CPTS
      • My review
      • Notes
        • Enumeration
          • Enum Cheklist
          • Initial Enumeration
        • Nmap
          • Nmap Full Flag
          • Protocol Scan
          • Scan-network-with-nmap
        • Attacking Common Applications
          • 1.Content Management Systems (CMS)
            • 1.-Wordpress-discovery-and-enumeration
            • 2.-Attacking-wordpress
            • 3.-Joomla-discovery-and-enumeration
            • 4.-Attacking-joomla
            • 5.-Drupal-discovery-and-enumeration
            • 6.-Attacking-drupal
          • 2. Servlet Containers and Software Development
            • 10.-Attacking-jenkins
            • 7.-Tomcat-discovery-and-enumeration
            • 8.-Attacking-tomcat
            • Attacking Jenkins - Focused Commands & Key Points
          • 3. Infrastructure and Network Monitoring Tools
            • 11.-Aplunk-discovery-and-enumeration
            • 12.-Attacking-splunk
            • 13.Prtg-network-monitor
          • 4. Customer Service Mgmt & Configuration Management
            • 14.-Osticket
            • 15.Gitlab-discovery-and-enumeration
            • 16.-Attacking-gitlab
          • 5. Common Gateway Interfaces
            • 17.-Attacking-tomcat-cgi
            • 18.-Attacking-cgi-applications-shellshock
          • 6. Thick Client Applications
            • 19.-Attacking-thick-client-applications
            • 20.Exploiting-web-vulnerabilities-in-thick-client-applications
          • 7. Miscellaneous Applications
            • 21.-Coldfusion-discovery-and-enumeration
            • ColdFusion Exploitation Guide
            • 23.-IIS-tilde-enumeration
            • 24.Attacking-ldap
            • 25.-Web-mass-assignment-vulnerabilities
            • 26.Attacking-applications-connecting-to-services
            • 27.Other-notable-applications
          • 8. Closing Out
            • 28.Application-hardening
        • Attacking Common Services
          • 1.Protocol-specific-attacks
          • 2.FTP
          • 3.SMB
          • 4.SQL-databases
          • 5.RDP
          • 6.DNS
          • 7.SMTP
        • Active Directory Enumeration & Attacks
          • 0. AD Pentest
            • Quick Guide To AD Pentesting
            • Active Directory: Full Attack Name
            • Active Directory Advanced Concepts
            • Active Directory Delegation
            • Beyond-Active-Directory
          • 1.Initial Enumeration
            • 1.External Recon and Enumeration Principles
            • 1.initial-enumeration-of-the-domain
            • Active-Directory-Basic-Command
          • 2.Sniffing out a Foothold
            • 3. LLMNR-NBT-NS Poisoning - from Linux
            • 4.LLMNR-NBT-NS Poisoning - from Windows
          • 3.Sighting In, Hunting For A User
            • 5.Password Spraying Overview
            • 6.Enumerating & Retrieving Password Policies
            • 7.Password Spraying - Making a Target User List
          • 4.Spray Responsibly
            • 8. Internal Password Spraying - from Linux
            • 9.Internal Password Spraying - from Windows
          • 5.Deeper Down the Rabbit Hole
            • 10. Enumerating Security Controls
            • 11. Credentialed Enumeration - from Linux
            • 12.Credentialed Enumeration - from Windows
            • 13. Living Off the Land
          • 6.Cooking with Fire
            • 14.Kerberoasting - from Linux
            • 15. Kerberoasting - from Windows
            • Kerberoasting Attack Step by Step Guide
            • Kerberoasting Attack Step by Step Guide
          • 7.An ACE in the Hole
            • 16.Access Control List (ACL) Abuse Primer
            • 17. ACL Enumeration
            • 18. ACL Abuse Tactics
            • 19. DCSync
          • 8.Stacking The Deck
            • 20.Privileged Access
            • 21.Kerberos Double Hop Problem
            • 22.Bleeding Edge Vulnerabilities
            • 23.Miscellaneous Misconfigurations
          • 9.Why So Trusting
            • 24.Domain Trusts Primer
            • 25.Attacking Domain Trusts - Child - Parent Trusts - from Windows
            • 26. Attacking Domain Trusts - Child - Parent Trusts - from Linux
          • 10.Breaking Down Boundaries
            • 27.Attacking Domain Trusts - Cross-Forest Trust Abuse - from Windows
            • 28.Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux
          • 11.Defensive Considerations
            • 29.Hardening-active-directory
            • 30.Additional AD Auditing Techniques
        • Linux Privilege Escalation
          • Linux-hardening
          • Linux-priv-esc-to-quick-check-the-system
            • 1.Information Gathering
            • 1.Environment-enumeration
            • 2.Linux-services-and-internals-enumeration
            • 3.Credential-hunting
          • 2.Environment-based Privilege Escalation
            • 4.Path-abuse
            • 5.Wildcard-abuse
            • 6.Escaping-restricted-shells
          • 3.Permissions-based Privilege Escalation
            • 10.Capabilities
            • 7.-Special-permissions
            • 8.Sudo-rights-abuse
            • 9.Privileged-groups
          • 4.Service-based Privilege Escalation
            • 11.Vulnerable-services
            • 12.Cron-job-abuse
            • LXC Privilege Escalation Techniques
            • 14.-Docker
            • 15.Kubernetes
            • 16.Logrotate
            • 17.Miscellaneous-techniques
          • 5.Linux Internals-based Privilege Escalation
            • 18.Kernel-exploits
            • 19.Shared-libraries
            • 20.Shared-object-hijacking
            • 21.Python-library-hijacking
          • 6.Recent 0-Days
            • 22.Sudo
            • 23.Polkit
            • 24.Dirty-pipe
            • 25.Netfilter
        • Windows Privilege Escalation
          • Priv-Esc
          • 1.Getting the Lay of the Land
            • 1.Situational-awareness
            • 2.Initial-enumeration
            • 3.Communication-with-processes
          • 2.Windows User Privileges
            • 4.windows-privileges-overview
            • 5.Seimpersonate-and-seassignprimarytoken
            • 6.Sedebugprivilege
            • Exploiting SeTakeOwnershipPrivilege
          • 3.Windows Group Privileges
            • 10.DNSadmins
            • 11.Hyper-v-administrators
            • Key Concepts:
            • Key Concepts:
            • 8.Windows-built-in-groups
            • Exploiting Event Log Readers Group for Security Log Access
          • 4.Attacking the OS
            • 14.User-account-control
            • 15.Weak-permissions
            • 16.Kernel-exploits
            • 17.Vulnerable-services
            • 18.DLL-injection
          • 5.Credential Theft
            • 19.Credential-hunting
            • 20.Other-files
            • 21.Further-credential-theft
          • 6.Restricted Environments
            • 22.-Citrix-breakout
          • 7.Additional Techniques
            • 23.Interacting-with-users
            • 24.Pillaging
            • 25.Miscellaneous-techniques
          • 8.Dealing with End of Life Systems
            • Key Points:
            • 27.windows-server
            • 28.windows-desktop-versions
        • Server-side Attacks
          • Server-side-vulnerabilities
        • Web Attacks
          • 1.-HTTP-verb-tampering
          • 2.-Insecure-direct-object-references-idor
          • 3.-XML-external-entity-xxe-injection
          • Web-attacks-to-the-point
        • Web Service & API Attacks
          • web-service-and-api-attacks
        • Command-injections
        • SQL-injection
        • XSS
          • XSS-based Session Hijacking
        • Broken Authentication
        • Login-brute-forcing
        • Password-attacks
        • Password-cracking
        • Session Security Guide
        • File-transfer
        • File-upload-attacks
        • Shells and payloads
        • Upgrading-tty-shell
        • Using-the-metasploit-framework
        • File Inclusion
          • 1.File Disclosure
            • 1.Local-file-inclusion-lfi
            • 2.Basic-bypasses
            • 3.PHP-filters
          • 2.Remote Code Execution
            • 4.PHP-wrappers
            • 5.Remote-file-inclusion-rfi
            • 6.LFI-and-file-uploads
            • 7.LOG-poisoning
          • 3.Automation and Prevention
            • 8.Automated-scanning
            • 9.File-inclusion-prevention
        • Ligolo-ng
        • Pivoting-tunneling-and-port-forwarding
        • TIPS
        • CheatSheet
    • OSCP
      • Preparation
      • Cheatsheets
      • Machine List
  • 📚Resources
    • Cheat Sheets
      • Reverse shells
      • Default Passwords
      • Kerberoast
      • Mimikatz
      • Powerup
      • Hashcat Word lists and Rules
      • Metasploit Modules
      • Misc Snippets
      • GTFOBins
      • LOLBAS
      • WADCOMS
      • Reverse Shell Generator
      • Pentestmonkey Revshell
      • OSINT Tools
      • Weakpass
Powered by GitBook
On this page
  1. 🎓Road to certification
  2. CPTS
  3. Notes
  4. Windows Privilege Escalation

6.Restricted Environments

22.-Citrix-breakout
Previous21.Further-credential-theftNext22.-Citrix-breakout

Last updated 3 months ago