Owning the Domain
So far, we have obtained a reverse Meterpreter shell on web01 from a file
upload vulnerability while bypassing detection from Windows Defender.
Once we gained this level of access, we elevated our privileges to local SYSTEM
and disabled the LSA protection to obtain an NTLM hash for the machine account.
Lastly, we exploited constrained delegation to get a TGS for the CIFS
service on file01 in the context of a domain admin.
In the next sections, we’ll use this TGS to perform lateral movement
and subsequently compromise the entire domain.