gtworek / priv2admin Goto Github PK

You’re missing several privileges escalation such as SeLoadDriver
Get a look at Andreas work
(Decoder.ap)

Hi,

SeTcbPrivilege allows you to read LSA storage, extract the SESSION KEY from TGT, and forge a request asking for a TGS; You must use LUID instead of Username.

https://github.com/foxlox/GIUDA

I noticed this note in the README:

Note 3: I am focusing on the OS only. If a privilege works in AD but not in the OS itself, I am describing it as not used in the OS. It would be nice if someone digs deeper into AD-oriented scenarios.

I would like to contribute such AD info to the repo, but am unsure what is meant by "if a privilege works in AD". The closest I can think is a table that maps default URA given to built-in AD groups as per 'Default Domain Controllers Policy':

URAs can thereafter be mapped to privileges because of my pull request #7

Would this mapping of default AD URAs be accepted, and is that what Note 3 is about?

The second step of the execution path column at the SeTakeOwnership privilege has a small mistype. It uses the executable "icalcs.exe", although the name of the executable should be "icacls.exe".