I just read a brilliant blog post on Carnal0wnage.  Luke Jennings’ Incognito has been integrated into metasploit.  Check out Luke’s recent paper if you missed it. In a nutshell, if you get SYSTEM level access to a box (e.g. MSSQL database) and a domain user is logged into that box, then you can use meterpreter […]