Privilege escalation and lateral movement
A single low-privileged foothold on one store server is where most real breaches begin, not where they end. This lesson shows how an attacker turns that foothold into control of the lab directory domain, step by step, and pairs every step with the defensive control that breaks it, so you can test a path and then help close it.
By the end you can
- Explain how local privilege escalation works at the concept level, and the hardening that removes each cause
- Describe why reused credentials and tickets let an attacker move host to host without a password
- Name the common Active Directory weaknesses and the single control that fixes each one
- Map an attack path to MITRE ATT&CK tactics and techniques, and say what each step leaves in the logs
- Read an attack graph the way both attackers and defenders do, and cut the shortest path to Domain Admin
The everyday picture
Think of a large office building. An attacker does not walk in through the front door with the master key. They find one unlocked side room, a cleaner's cupboard. Inside, someone has left a drawer key on the shelf. That drawer holds a pass for the second floor. On the second floor, a manager's coat has a lift key in the pocket that reaches the server room. Each small step uses something left lying around to reach one more room, and the last room runs the whole building.
Two ideas make this stop. First, nothing valuable is left lying around: keys are not stored in the rooms they open, and the master key never leaves the top floor. Second, the floors are separated, so a pass found on a low floor cannot open a high one. A directory domain is the same building. Privilege escalation is picking up the drawer key; lateral movement is using one floor's pass to reach the next; and the controls you will learn put the keys away and seal the floors off from each other.
From one foothold to the whole domain
In Attacking networks and services you gained a foothold: code running as an ordinary user on one practice store server. On its own that is a low-impact finding. The damage comes from the path that turns it into domain-wide control, and a path is only as strong as its weakest hop. The attacker repeats a short loop: raise privilege on the current host, collect whatever credentials that host holds, reuse them to reach the next host, and repeat until one host hands over the keys to the directory. A Windows directory domain (Active Directory) ties every machine together, which is exactly what the attacker rides from host to host.
The defender's job is not to make every hop impossible, which is unrealistic, but to break the chain at as many hops as possible, so no single mistake reaches the domain controller. The diagram below is the spine of this lesson: the climb on the left, the control that cuts each hop on the right.
Quick check
During an authorised test you have local admin on one store server but no way yet to reach any other host. In the report, how should you rate this on its own, before you find a path onward?
Impact is about where the foothold can lead, which is why you test the path. One admin-level server is a genuine finding, but rating it Critical with no onward path overstates it, and leaving it out hides a real weakness. You met risk ratings in Reporting that gets things fixed; the path you map here is what sets the rating.