Wrapping Up
This module showcased attack paths against a small Active Directory
infrastructure that had multiple security measures in place.
We demonstrated chaining techniques as well as the complications of bypassing
antivirus and other protections.
A penetration test against a hardened infrastructure is not trivial and if
and if multiple attack paths are available,
we will often chose the path of least resistance.
In addition, we bypassed unique obstacles instigated by our initial service account
compromise which lacked an interactive logon session.
In the end, we compromised evil.com without relying on any vulnerabilities
except for the flaw in the initial web application.