hackgraph.github.io/reference.html at main · HackGraph/hackgraph.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>HackGraph Reference | AD, Windows &amp; Linux Privilege Escalation</title>
<meta name="description" content="HackGraph reference: text version of the interactive Active Directory, Windows, and Linux privilege-escalation attack-path graphs. Offensive-security study notes for OSCP, OSEP, CRTP, PNPT, and CTFs."/>
<meta name="keywords" content="cybersecurity, offensive security, penetration testing, red team, OSCP notes, OSEP, CRTP, PNPT, CTF, privilege escalation, Active Directory, Windows privilege escalation, Linux privilege escalation, Kerberoasting, NTLM relay, AD CS ESC1, pass-the-hash, DCSync, ethical hacking, attack path, pentest cheat sheet"/>
<link rel="canonical" href="https://hackgraph.github.io/reference.html"/>
<meta name="robots" content="index, follow, max-image-preview:large"/>
<link rel="icon" type="image/svg+xml" href="/favicon.svg"/>
<meta name="theme-color" content="#0c0a0b"/>
<meta property="og:type" content="article"/>
<meta property="og:site_name" content="HackGraph"/>
<meta property="og:title" content="HackGraph Reference | AD, Windows &amp; Linux Privilege Escalation"/>
<meta property="og:description" content="HackGraph reference: text version of the interactive Active Directory, Windows, and Linux privilege-escalation attack-path graphs. Offensive-security study notes for OSCP, OSEP, CRTP, PNPT, and CTFs."/>
<meta property="og:url" content="https://hackgraph.github.io/reference.html"/>
<meta property="og:image" content="https://hackgraph.github.io/og-image.png"/>
<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:image" content="https://hackgraph.github.io/og-image.png"/>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"CollectionPage","name":"HackGraph Reference","url":"https://hackgraph.github.io/reference.html","description":"HackGraph reference: text version of the interactive Active Directory, Windows, and Linux privilege-escalation attack-path graphs. Offensive-security study notes for OSCP, OSEP, CRTP, PNPT, and CTFs.","inLanguage":"en","isPartOf":{"@type":"WebSite","name":"HackGraph","url":"https://hackgraph.github.io/"},"hasPart":[{"@type":"TechArticle","name":"Active Directory Attack Paths","url":"https://hackgraph.github.io/reference/active-directory.html"},{"@type":"TechArticle","name":"Windows Privilege Escalation","url":"https://hackgraph.github.io/reference/windows-privilege-escalation.html"},{"@type":"TechArticle","name":"Linux Privilege Escalation","url":"https://hackgraph.github.io/reference/linux-privilege-escalation.html"}]}</script>
<style>
:root{--bg:#0c0a0b;--panel:#160f11;--ink:#f0eaec;--dim:#a59699;--faint:#8a7d80;--accent:#f04450;--border:rgba(214,168,172,.13)}
@font-face{font-family:'Geist';font-weight:400;font-display:swap;src:url('/engine/fonts/geist-sans-latin-400-normal.woff2') format('woff2')}
@font-face{font-family:'Geist';font-weight:600;font-display:swap;src:url('/engine/fonts/geist-sans-latin-600-normal.woff2') format('woff2')}
@font-face{font-family:'Geist Mono';font-weight:400;font-display:swap;src:url('/engine/fonts/geist-mono-latin-400-normal.woff2') format('woff2')}
*{box-sizing:border-box}
body{margin:0;background:var(--bg);color:var(--ink);font-family:'Geist',system-ui,-apple-system,sans-serif;line-height:1.6;letter-spacing:-.01em;-webkit-font-smoothing:antialiased}
a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
header.top{border-bottom:1px solid var(--border);padding:14px 24px;display:flex;align-items:center;gap:12px;position:sticky;top:0;background:rgba(12,10,11,.85);backdrop-filter:blur(10px)}
header.top .name{font-weight:600;font-size:17px}
header.top .cta{margin-left:auto;font-size:14px;color:var(--dim)}
main{max-width:860px;margin:0 auto;padding:40px 24px 96px}
h1{font-size:30px;font-weight:600;line-height:1.2;margin:0 0 14px}
.lead{color:var(--dim);font-size:17px;margin:0 0 10px}
.toc{margin:20px 0 8px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:10px}
.toc a{border:1px solid var(--border);border-radius:999px;padding:5px 12px;font-size:13px;color:var(--ink)}
section.phase{margin-top:44px}
h2.phase-h{font-size:13px;font-weight:600;text-transform:uppercase;letter-spacing:.09em;padding-bottom:6px;border-bottom:1px solid var(--border)}
article{padding:18px 0;border-bottom:1px solid var(--border);scroll-margin-top:78px;overflow-wrap:anywhere}
section.phase>h2{scroll-margin-top:78px}
article h3{font-size:19px;font-weight:600;margin:0 0 4px;scroll-margin-top:70px}
.kind{font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:var(--faint);font-weight:600}
.summary{color:var(--ink);margin:6px 0}
.desc{color:var(--dim);margin:8px 0}
.meta{color:var(--faint);font-size:13px}
h4{font-size:11px;text-transform:uppercase;letter-spacing:.08em;color:var(--faint);margin:16px 0 6px}
ul.req{margin:4px 0;padding-left:18px;color:var(--dim);font-size:14px}
pre{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:12px 14px;overflow:auto;overflow-wrap:normal;margin:6px 0}
code{font-family:'Geist Mono',ui-monospace,Menlo,monospace;font-size:13px;color:#e7dfe1}
pre .cmt{color:var(--faint)}
ul.links{margin:4px 0;padding-left:18px;font-size:14px}
.claim-list{padding-left:18px;font-size:14px;line-height:1.6}
.claim-list>li+li{margin-top:18px}.claim-list p{margin:0;overflow-wrap:anywhere}
.claim-list .claim-section{margin-top:6px;font-size:13px;color:var(--dim)}
.claim-sources{display:grid;gap:4px;margin-top:6px}
.claim-sources a{display:block;width:fit-content;max-width:100%;padding:2px 0;color:var(--ink);overflow-wrap:anywhere;text-decoration:underline;text-underline-offset:.18em;border-radius:2px}
.claim-sources a:focus-visible{outline:2px solid var(--ink);outline-offset:3px}
.opsec{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:10px 14px;margin:12px 0;color:var(--dim);font-size:14px}
.opsec b{color:var(--ink)}
.editorial{border-left:2px solid var(--dim);padding:6px 12px;margin:12px 0;color:var(--dim);font-size:13px}.editorial p{margin:4px 0}table{border-collapse:collapse;width:100%;font-size:14px}td,th{text-align:left;padding:8px;border-bottom:1px solid var(--border)}.table-wrap{overflow:auto}.table-wrap:focus-visible{outline:2px solid var(--ink);outline-offset:4px}
footer{max-width:860px;margin:0 auto;padding:32px 24px 64px;color:var(--faint);font-size:14px;border-top:1px solid var(--border)}
</style>
</head>
<body>
<header class="top"><a href="/" style="display:flex;align-items:center;gap:10px;color:var(--ink)"><svg viewBox="0 0 24 24" width="26" height="26" fill="none" aria-hidden="true"><path d="M9.5 12 H11.5 V5.5 H13.5 M11.5 12 V18.5 H13.5" stroke="#a59699" stroke-width="1.8" stroke-linejoin="round"/><rect x="1" y="8.5" width="8.5" height="7" rx="2.2" fill="#f0eaec"/><rect x="13.5" y="2" width="8.5" height="7" rx="2.2" fill="#a59699"/><rect x="13.5" y="15" width="8.5" height="7" rx="2.2" fill="#f04450"/></svg><span class="name">HackGraph</span></a><a class="cta" href="/">Open the interactive graph &rarr;</a></header>
<main>
<h1>HackGraph Reference</h1>
<p class="lead">HackGraph is an open-source collection of security study notes, organized as expandable graphs. Use the graph to explore connections, or read the reference pages at your own pace. Source coverage and editorial review status are shown separately.</p>
<p><a href="/about.html">How to read the graph and assess its sources</a></p>
<p><a href="/glossary.html">Security glossary with definition sources</a></p>
<p class="meta">A plain-text mirror of the <a href="/">interactive graph</a>, for search and offline reading. 390 topics across 3 maps.</p>
<article><h3><a href="/reference/active-directory.html">Active Directory Attack Paths</a></h3><p class="summary">Enumerate, capture credentials, escalate, move laterally, and reach Domain Admin: Kerberoasting, AS-REP roasting, NTLM relay, AD CS (ESC1-ESC16), DACL/ACL abuse, delegation, DCSync, and golden/silver tickets.</p><p class="meta">250 topics &middot; <a href="/reference/active-directory.html">Read the reference &rarr;</a></p></article>
<article><h3><a href="/reference/windows-privilege-escalation.html">Windows Privilege Escalation</a></h3><p class="summary">From a foothold to NT AUTHORITY\SYSTEM: token privileges (SeImpersonate, Potato), UAC bypass, service and DLL misconfigurations, unquoted paths, stored credentials, privileged groups, and defense evasion (AMSI, EDR, AppLocker).</p><p class="meta">93 topics &middot; <a href="/reference/windows-privilege-escalation.html">Read the reference &rarr;</a></p></article>
<article><h3><a href="/reference/linux-privilege-escalation.html">Linux Privilege Escalation</a></h3><p class="summary">From an unprivileged shell to root: sudo abuse and GTFOBins, SUID/SGID and capabilities, cron and systemd jobs, writable files, credential hunting, privileged groups and container escapes, and kernel exploits.</p><p class="meta">47 topics &middot; <a href="/reference/linux-privilege-escalation.html">Read the reference &rarr;</a></p></article>
</main>
<footer>
<p>HackGraph is an open-source collection of security study notes, organized as expandable graphs. Use the graph to explore connections, or read the reference pages at your own pace. Source coverage and editorial review status are shown separately.</p>
<p><a href="/">Interactive graph</a> &middot; <a href="/reference.html">All references</a> &middot; <a href="/glossary.html">Glossary</a> &middot; <a href="/about.html">About the sources</a> &middot; <a href="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/HackGraph/hackgraph.github.io">Source on GitHub</a></p>
<p>Reading pages accompany the interactive graph. Material is intended for authorized security study and blue-team detection.</p>
</footer>
</body>
</html>