Windows Through the Eyes of a Hacker

The internal architecture of Windows and Active Directory is examined, detailing the trust relationships of domains and forests, the features of Read-only Domain Controllers, vulnerabilities of group policies, and principles of privilege management. It discusses working with Kerberos, injection and dumping, tickets, hijacking user sessions, using WinAPI, COM, and Named Pipes in pentesting, as well as accessing native code from C#. Methods for bypassing information protection measures are described, including unhooking ntdll.dll, preventing DLL injection, loopholes for executing third-party code, utilizing hardware breakpoints, bypassing AMSI, and writing runners for shellcode on .NET. Practical recommendations for obfuscating WinAPI calls and protecting corporate networks from attacks are provided.