Blog

Security Research

Abusing the DHCP Administrators Group to Escalate Privileges in Windows Domains

Ori David is a Security Researcher at Akamai. His research is focused on offensive security, malware analysis, and threat hunting.

Malicious privilege escalation can be disastrous, especially when it leverages legitimate processes.

Editorial and additional commentary by Tricia Howard

Executive summary

\r\n Akamai researchers discovered a new privilege escalation technique affecting Active Directory (AD) environments that leverages the DHCP administrators group.

\r\n

\r\n In cases where the DHCP server role is installed on a Domain Controller (DC), this could enable them to gain domain admin privileges .

\r\n

\r\n The technique is based on abuse of legitimate features and doesn’t rely on any vulnerability.…