Active Directory → Relay, Coercion & Persistence
Getting Domain Admin is step one. Keeping access through a Blue Team response is step two. Golden Tickets survive password resets …
DCShadow registers a rogue Domain Controller in Active Directory, triggers a replication event from it to a real DC, and uses that…
Coercion attacks force a Windows machine to authenticate to a server you control using NTLM — then relay that authentication. The …
Authenticate as someone else without their password. Every attack covered with working commands: Responder poisoning, mitm6 IPv6, …