Home > Attack Vectors > Active Directory Privilege Escalation

Active Directory Privilege Escalation

Active Directory Privilege Escalation

Active Directory Privilege Escalation is an attack vector in which a perpetrator engages in one or more successive acts of unauthorized modificaton in Active Directory resulting in an escalation of privilege to an account or group with higher privileges.


Note - From an objectively technical standpoint, escalation of privilege that involves exploiting inherent weaknesses in Windows authentication protocols, i.e. weaknesses in the Kerberos or NTLM authentication protocols, or in Active Directory Certificate Services, when used for domain authentication, (except in cases where excessive access in Active Directory ACLs is exploited), when used to compromise Active Directory accounts, is strictly speaking  not  Active Directory Privilege Escalation per se, in that it does not involve exploiting any weakness in Active Directory, but rather in Windows authentication protocols.


The operations involved in this attack vector are easy to enact as all that is required to enact them is sufficient effective access in Active Directory, which commonly exists due to insufficiently secured delegated/provisioned access in Active Directory.


An Example –

This powerful attack vector is perhaps best illustrated with a simple example.


    Target – Assume that the objective of the perpetrator is to gain C2 over the Domain Admins security group in the target Active Directory domain.

    Path Determination - Assume that the perpetrator is successfully able to make the following resultant access determinations in Active Directory -

    1. John Smith can add his own domain user account to the Domain Admins security group
    2. Brian Johnson can change the permissions on John Smith's domain user account
    3. Mary Williams can change the ownership of Brian Johnson's domain user account
    4. The perpetrator can reset the password of Mary William's domain user account

    Note - All that a perpetrator needs to make these resultant access determinations is read access to Active Directory objects and ACLs, which all Authenticated Users have by default and by design, it being a directory service.


    Escalation Path –

    Perpetrator  →  Mary Williams  →  Brian Johnson  →  John Smith  →  Domain Admins

              Reset Password          Change Ownership        Change Permissions      Add Self as Member


    Duration + Tooling –

    < 1 minute to escalate. Once a path has been determined, the entire escalation can be fully scripted or enacted using native tooling.

    Note - All that a perpetrator needs to carry out these operations is network access to Active Directory and credentials for the accounts that have the determined access to carry out these operations. There are no other requirements.




Active Directory Privilege Escalation Operations –

The following are the most common technical operations involved in Active Directory Privilege Escalation -

  1. Reset the password of a domain user account
  2. Change the permissions protecting a domain user account
  3. Change the ownership of a domain user account
  4. Reset the password of a domain computer account
  5. Change the permissions protecting a domain computer account
  6. Change the ownership of a domain computer account
  7. Change the membership of a domain security group
  8. Add oneself to a domain security group
  9. Change the permissions protecting a domain security group
  10. Change the ownership of a domain security group
  11. Change the permissions protecting an organizational unit (OU)
  12. Change the ownership of an organizational unit (OU)
  13. Change the permissions protecting a container
  14. Change the ownership of a container
  15. Change the permissions protecting the domain root


Active Directory Privilege Escalation is a very powerful and potent attack vector with minimal requirements, as it solely relies on the enactment of two or more successively performed simple unauthorized modificaton operations in Active Directory.