https://emc2hf.github.io/categories/defender-bypass/ Recent content in Defender Bypass on emc2hf Blog Hugo -- 0.148.2 en @emc2hf Wed, 10 Sep 2025 16:22:03 +0200 https://emc2hf.github.io/blog/2025/09/10/goad-game-of-active-directory-nha-%233-bypassing-defender-and-achieving-system-on-sql-host/ Wed, 10 Sep 2025 16:22:03 +0200 https://emc2hf.github.io/blog/2025/09/10/goad-game-of-active-directory-nha-%233-bypassing-defender-and-achieving-system-on-sql-host/ <p>After achieving RCE on the <code>SQL</code> host I proceeded to check the user&rsquo;s privileges.</p> <p><figure> <img loading="lazy" src="https://emc2hf.github.io/images/goad/3-amsi-bypass/mssql_whoami_priv.png"/> </figure> As this is a service account it has the <code>SeImpersonatePrivilege</code> privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries.</p> <p>Knowing the way I will get <code>NT AUTHORITY\SYSTEM</code> on the <strong>SQL</strong> host, I proceeded to check if <strong>Defender</strong> is active.</p> <figure> <img loading="lazy" src="https://emc2hf.github.io/images/goad/3-amsi-bypass/mssql_check_defender.png"/> </figure> <p>I also confirmed I can access Kali from the Windows environment with an HTTP request: <figure> <img loading="lazy" src="https://emc2hf.github.io/images/goad/3-amsi-bypass/mssql_iwr.png"/> </figure> <figure> <img loading="lazy" src="https://emc2hf.github.io/images/goad/3-amsi-bypass/mssql_kali_iwr_result.png"/> </figure> </p>