Loading feed…
InfoSec Write-ups0 Hot0 comments15 min read
Certified AD Red Team Specialist (AD-RTS): Full Exam Write-Up
A detailed exam write-up for the CyberWarfare Labs AD-RTS (Active Directory Red Team Specialist) certification, covering two full adversary paths through a simulated telecom enterprise environment. Path 1 starts from zero credentials and chains DNS zone transfer abuse, ASREPRoasting, SQL Server xp_cmdshell, GodPotato privilege escalation, ADCS ESC1 certificate abuse, and VMware ESXi hypervisor pivoting to reach Domain Admin and guest VM code execution. Path 2 begins with a low-privilege IIS foothold and exploits ASP.NET ViewState deserialization via a leaked machine key, DPAPI-protected registry credentials, a second ESC1 ADCS template, Exchange ApplicationImpersonation abuse, and hardcoded credentials in scheduled task scripts. The write-up emphasizes understanding attack chains over individual exploits, and closes with defensive recommendations around certificate template hardening, credential hygiene, and RBAC scoping for Exchange impersonation roles.
Source: https://infosecwriteups.com/certified-ad-red-team-specialist-ad-rts-full-exam-write-up-40f5e9450703. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
