Pentest Notes

Exploits related to Windows

Active Directory

AD CS (Active Directory Certificate Services) Pentesting

AS-REP Roasting

Active Directory Pentesting

BloodHound SharpHound for Active Directory

Kerberos Pentesting

LAPS (Local Administrator Password Solution) Pentesting

LDAP (Lightweight Directory Access Protocol) Pentesting

NTLM (New Technology LAN Manager) Pentesting

Netlogon Elavasion of Privilege

SMB (Server Message Block) Pentesting

Protocol

MSRPC (Microsoft Remote Procedure Call) Pentesting

RDP (Remote Desktop Protocol) Pentesting

WinRM (Windows Remote Management) Pentesting

Privilege Escalation

Iperius Backup Service Privilege Escalation

ManageEngine ADSelfService Plus PrivEsc

Mimikatz

Outlook Reminder Privilege Escalation

UAC Windows Privilege Escalation

Windows PrivEsc with Potatoes

Windows PrivEsc with Registry Keys

Windows PrivEsc with SeBackupPrivilege

Windows PrivEsc with Unquoted Service Path

Windows Privilege Escalation

Post Exploitation

Windows Pivoting

PowerShell

PowerShell

PowerView

Others

Dumping Windows Password Hashes

LocalPotato

Microsoft Outlook Message (.msg)

Microsoft Word Pentesting

Windows API

Windows Basic Features

Windows Disk Management

Windows Forensics

Windows Pivoting

Windows Print Spooler Service

Windows Remote Code Execution from Linux

Windows XML EventLog (EVTX)

Windows Basic Features

Last modified: 2023-01-16

Windows

BitLocker

Command Prompt (cmd)

Computer Management (compmgmt)

Event Viewer

Windows Logs
Applications and Services Logs

Local Users and Groups (lusrmgr.msc)

Microsoft Management Console (mmc)

Performance Monitor (perfmon)

Registry Editor (regedit)

Resource Monitor (resmon)

Services

Manages (start/stop) services.

System Configuration (msconfig)

System Information (msinfo32)

System Monitor (sysmon)

Task Manager (taskmgr)

User Account Control Settings (uac)

Volume Shadow Copy Service (VSS)

Windows Defender Firewall (WF.msc)