Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

KrbRelayUp

NTLM/Kerberos Relaying

Privilege Escalation

AD Misconfigurations

Windows-only local privilege-escalation tool for domain-joined hosts. It coerces the local computer account's Kerberos authentication and relays it to LDAP (RBCD or Shadow Credentials) or AD CS Web Enrollment (certificate route), then uses the resulting control primitive to obtain a service ticket and create a local service as NT AUTHORITY\SYSTEM. Requiring LDAP signing protects the documented default LDAP relay path; channel binding is scoped to applicable LDAP-over-TLS sessions. The AD CS route has separate IIS/TLS/EPA protections.

Source

https://github.com/Dec0ne/KrbRelayUp

Language

References

github.com microsoft.com learn.microsoft.com learn.microsoft.com learn.microsoft.com

+13 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER