RED TEAM Operator: Privilege Escalation in Windows Course

[tensaiD]

A course about breaking and bypassing the Windows security model. Escalating privileges with 20 different techniques. From non-admin to SYSTEM.

Contents​

Intro and Setup
Introduction to Windows Security
Intro Addendum
Course VM Setup
RTO-LPE.ova
RTO-LPE.zip

Credentials​

“Low Hanging Passwords”
“The X Files” - Interesting Files
“Swimming in Hives” - Registry
“A Boss with Creds” - Abusing Credential Manager
“The King is Naked” - Robbing Credential Manager
“A Thief” - Asking User for Creds

Unsecured Objects​

“Boundless Servant” - Unsecured Service [1]
“Lonely Vassal”- Unsecured Service [2]
“Hornets’ Nest”- Unsecured Service [3]

Execution Flow Hijacking​

“Folding Papers”- Unsecured File System
“Hi Jack, Show Me THE WAY” - Exploiting PATH
“Closed. No Service” - Missing Service
“Jobless” - Missing Task
“Library Has Fallen” - DLL Hijacking
“You Ain’t Corner Me” - UACME

Getting SYSTEM​

“! NeverRemoveDepressed” - AlwaysInstallElevated Hack
“Hi, Sis!” - New Service for SYSTEM
“Nick Has a Leak: Prelude” - Leaked HANDLE [1]
“Nick Has a Leak: Demon” - Leaked HANDLE [2]
“Nick Has a Leak: Sequel” - Leaked HANDLE [3]
“Chip & Dance: Prologue” - Abusing Tokens [1]
“Chip & Dance Show” - Abusing Tokens [2]
“Broken Calumet: Overture” - Exploiting Named Pipes [1]
“Broken Calumet Exposed” - Exploiting Named Pipes [2]

Assignments​

Assignment #1
Assignment #2
Assignment #3

12.32 GB folder on MEGA

68 files and 8 subfolders

mega.nz

Course Closing Information

Click to read more...