Definition
Domain controllers replicate directory data among themselves, including credential material. An identity holding the relevant replication privileges can make the same request, obtaining that material without touching a domain controller's disk or memory.
Why it is the end of the path
Access to domain credential material is effectively domain compromise. It is not a step toward privilege. It is the privilege, and remediation is considerably more involved than resetting a password.
Why the privilege is often present
The rights involved are granted legitimately to domain controllers, and sometimes to synchronization, backup or migration tooling. Those grants persist after the tool is retired, and they are not visible in a review that looks only at group membership.
- Privileged Identity
- Directory Replication Rights
- Credential Material
- Domain Control
Each hop validated by successful exploitation
Tags
- active directory
- credentials
- domain compromise