There exists a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings). Thanks to the research and open source tools of several researchers, it’s now trivial to elevate to SYSTEM on most Windows Operating Systems.
Listen on the go:
https://cyberthreatperspective.buzzsprout.com/1731753/10515339
Resources:
https://github.com/Dec0ne/KrbRelayUp
https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
https://github.com/cube0x0/KrbRelay