AD-RODCPrivilege Escalation

RODC Compromise

Compromise a Read-Only DC — its krbtgt_<RODC#> hash can issue tickets for revealed accounts.

§ Where this technique fits

AD-RODC is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 1 on average.

§ Dossiers chaining this technique

RODC compromise → cracked NT hashes of revealed accounts
A Read-Only Domain Controller stores password material only for principals on its msDS-RevealedList. Compromising the RODC + cracking those hashes gives you the corresponding users.
step 1 / 6

§ What commonly comes next

01
RODC Revealed Accounts Enumeration
AD-RODC-MEMBERS · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

RODC compromise → cracked NT hashes of revealed accounts

§ What commonly comes next