> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/monteverde/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/monteverde/priv-escalation.md).

# Priv Escalation

![](https://3904889679-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fvx4dnPH7PTjiQROfmYhI%2Fuploads%2FQz5yOpGRrnXnwdXI7buI%2F2022-08-15_14-24.png?alt=media\&token=667418eb-543a-4ae9-a8d7-a3a0aec01e1b)

Our current user is part of the Azure Admins group which means that we have rights over ADSync, which means that we can dump credentials using an exe and a dll. 

{% embed url="<https://vbscrub.com/2020/01/14/azure-ad-connect-database-exploit-priv-esc/>" %}

{% embed url="<https://github.com/VbScrub/AdSyncDecrypt>" %}

After uploading the exploit to the temp directory and navigating to the desired path nad executing it I was able to get the credentials for the administrator user.&#x20;

```
C:\Program Files\Microsoft Azure AD Sync\Bin> C:\wINDOWS\Temp\AdDecrypt.exe -FullSQL
```

![](https://3904889679-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fvx4dnPH7PTjiQROfmYhI%2Fuploads%2FzRQPEqJ5zRA4S8xLebO3%2F2022-08-15_14-34.png?alt=media\&token=f5941a22-68b3-4448-b2c2-f43b073f429d)