7 Minute Security

7MS #681: Pentesting GOAD – Part 3

Jun 27, 2025 · 18 min · 17.6 MB
0:00-18:18

Streams straight from the publisher. podnod never proxies or re-hosts episode audio.

Today Joe "The Machine" Skeen and I pwn the third and final realm in the world of GOAD (Game of Active Directory): essos.local! The way we go about it is to do a WinRM connection to our previously-pwned Kingslanding domain, coerce authentication out of MEEREEN (the DC for essos.local) and then capture/abuse the TGT with Rubeus! Enjoy.