Academy Node
AdminTo
AdminTo means the principal has local administrator rights on a computer.
Intermediate100 XPBloodHound Edge
Why it matters
This usually enables remote execution, dumping local secrets, or lateral movement.
How to identify it
- BloodHound AdminTo edge
- nxc SMB says Pwn3d!
BloodHound indicators
- AdminTo
NetExec commands
nxc smb 192.168.184.150 -d xutslabs.local -u USER -p PASSnxc smb 192.168.184.150 -d xutslabs.local -u USER -p PASS --samImpacket commands
impacket-psexec xutslabs.local/USER:PASS@192.168.184.150impacket-smbexec xutslabs.local/USER:PASS@192.168.184.150Expected output
- Pwn3d!
- Shell as SYSTEM or admin context
Success looks like
- Remote command execution
- SAM/LSA dump
Failure looks like
- UAC filtering
- Firewall
- AV
Troubleshooting
- Try psexec/smbexec/wmiexec
- Use local admin syntax if local account
Common mistakes
- Not trying WinRM too
- Not dumping local creds
Alternative attacks
- WinRM
- WMI
- RDP
What to try next
- Dump creds
- Enumerate sessions
- Pivot to next host
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.