Tutorial 14: Windows Privilege Escalation & AD Basics
Lesson notes
Welcome to Tutorial 14 of the Ethical Hacking & Cybersecurity Masterclass at ONICastro Digital Intelligence. This guide to Active Directory Hacking will teach you how enterprise Windows networks are compromised and how to defend them. Mastering Active Directory Hacking is essential for any penetration tester working with corporate clients.
While Linux servers power most web applications, Microsoft Windows powers the enterprise network. In a corporate environment, workstations, servers, file shares, and user identities are managed centrally by Active Directory (AD). This centralization makes Active Directory Hacking both devastating and critically important to understand.
To evaluate the security of an enterprise network, a penetration tester must understand how Windows manages credentials locally and how Active Directory coordinates trust across thousands of machines. The field of Active Directory Hacking combines local system exploitation with network-wide lateral movement.
In this tutorial, we will analyze the theoretical mechanics of the LSASS process, the math behind NTLM Hashing, the conceptual flow of Pass-the-Hash (PtH) attacks, and the architectural hardening strategies required to secure Windows domains. Every technique in Active Directory Hacking builds on these fundamentals.
1. Local Windows Credential Storage and Active Directory Hacking
On a standalone Windows machine, user accounts are stored locally in the SAM (Security Accounts Manager) database. However, once a user logs in, Windows needs to cache credentials in memory so the user doesn’t have to re-type their password every time they access a network share. This caching mechanism is a primary target in Active Directory Hacking.
This caching is handled by a critical system process: LSASS (Local Security Authority Subsystem Service).
[ User Login ] ──► [ LSASS Process Memory ] ──► (Encrypts & stores passwords/hashes)
│
▼ (Stops unauthorized read attempts)
[ LSA Protection / PPL ]Historically, LSASS stored passwords in plain text in memory via protocols like WDigest. While modern Windows operating systems disable plain-text storage by default, LSASS still maintains cryptographic hashes (NTLM) and Kerberos tickets in its memory space. This makes LSASS the most valuable target in Active Directory Hacking.
The Attack Concept: LSASS Dumping for Active Directory Hacking
If an auditor gains local administrator privileges on a Windows host, they have the technical ability to read the memory space of other running processes. This is a foundational technique in Active Directory Hacking.
By dumping the memory of the lsass.exe process (using native tools like procdump or Task Manager) and parsing it offline with security tools like Mimikatz, they can extract the NTLM hashes or Kerberos tickets of any user who is currently logged into—or has recently accessed—that machine. This credential extraction is the cornerstone of Active Directory Hacking.
Mimikatz: The Swiss Army Knife of Active Directory Hacking
Mimikatz is the most famous tool in Active Directory Hacking. It can:
- Extract plaintext passwords from LSASS memory (on older systems with WDigest enabled).
- Dump NTLM hashes from memory.
- Extract Kerberos tickets (TGTs and TGSs) for pass-the-ticket attacks.
- Export certificates from the Windows certificate store.
- Perform Golden Ticket and Silver Ticket attacks against the domain.
Understanding Mimikatz is non-negotiable for anyone serious about Active Directory Hacking.
2. NTLM Hashing and Pass-the-Hash for Active Directory Hacking
Windows does not store passwords in plain text on the hard drive; it stores them as NTLM (NT LAN Manager) hashes. NTLM is a one-way cryptographic function based on the MD4 algorithm. Understanding NTLM is fundamental to Active Directory Hacking.
How NTLM Authentication Works
When a user authenticates using NTLM, the following process occurs:
- The client sends a username to the server.
- The server responds with a random challenge (a nonce).
- The client encrypts the challenge using the NTLM hash of the user’s password and sends it back.
- The server validates the response against the hash stored in the SAM or Active Directory.
The Vulnerability: Pass-the-Hash in Active Directory Hacking
Because the system uses the hash itself to complete the challenge, the hash acts exactly like the password. This is the critical vulnerability exploited in Active Directory Hacking.
If an attacker dumps LSASS memory and obtains an administrator’s NTLM hash (e.g., 31d6cfe0d16ae931b73c59d7e0c089c0), they do not need to crack the hash to find the plain-text password. They
Unlock the Remaining 60%
Join the ONICastro Intelligence Hub — completely free.
Get full access to every tutorial and never lose your place.
- Learning Paths synced to your account
- Continue exactly where you stopped
- Completed badges & next recommended step
- Priority access to speedy consultancy
