gtworek / priv2admin Goto Github PK

I noticed this note in the README:

Note 3: I am focusing on the OS only. If a privilege works in AD but not in the OS itself, I am describing it as not used in the OS. It would be nice if someone digs deeper into AD-oriented scenarios.

I would like to contribute such AD info to the repo, but am unsure what is meant by "if a privilege works in AD". The closest I can think is a table that maps default URA given to built-in AD groups as per 'Default Domain Controllers Policy':

URAs can thereafter be mapped to privileges because of my pull request #7

Would this mapping of default AD URAs be accepted, and is that what Note 3 is about?

The second step of the execution path column at the SeTakeOwnership privilege has a small mistype. It uses the executable "icalcs.exe", although the name of the executable should be "icacls.exe".

Hi,

SeTcbPrivilege allows you to read LSA storage, extract the SESSION KEY from TGT, and forge a request asking for a TGS; You must use LUID instead of Username.

https://github.com/foxlox/GIUDA

You’re missing several privileges escalation such as SeLoadDriver
Get a look at Andreas work
(Decoder.ap)