GOAD (Game of Active Directory) NHA #3 - Bypassing Defender and Achieving SYSTEM on SQL Host
After achieving RCE on the SQL host I proceeded to check the user’s privileges. As this is a service account it has the SeImpersonatePrivilege privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries. Knowing the way I will get NT AUTHORITY\SYSTEM on the SQL host, I proceeded to check if Defender is active. I also confirmed I can access Kali from the Windows environment with an HTTP request: ...