> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

#  Takeover Techniques List

> Converted from Markdown to

| Codename                                          | Description                                                                                    |
| ------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| [TAKEOVER‑1](./TAKEOVER-1/takeover-1_description) | Hierarchy takeover via NTLM coercion and relay to MSSQL on remote site database                |
|  TAKEOVER‑1.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑1.2: Coerce SMS Provider                |                                                                                                |
|  TAKEOVER‑1.3: Coerce passive site server         |                                                                                                |
| [TAKEOVER‑2](./TAKEOVER-2/takeover-2_description) | Hierarchy takeover via NTLM coercion and relay to SMB on remote site database                  |
|  TAKEOVER‑2.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑2.2: Coerce passive site server         |                                                                                                |
| [TAKEOVER‑3](./TAKEOVER-3/takeover-3_description) | Hierarchy takeover via NTLM coercion and relay to HTTP on ADCS                                 |
|  TAKEOVER‑3.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑3.2: Coerce SMS Provider                |                                                                                                |
|  TAKEOVER‑3.3: Coerce passive site server         |                                                                                                |
|  TAKEOVER‑3.4: Coerce site database server        |                                                                                                |
| [TAKEOVER‑4](./TAKEOVER-4/takeover-4_description) | Hierarchy takeover via NTLM coercion and relay from CAS to origin primary site server          |
|  TAKEOVER‑4.1: Relay to SMB                       |                                                                                                |
|  TAKEOVER‑4.2: Relay to AdminService              |                                                                                                |
| [TAKEOVER‑5](./TAKEOVER-5/takeover-5_description) | Hierarchy takeover via NTLM coercion and relay to AdminService on remote SMS Provider          |
|  TAKEOVER‑5.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑5.2: Coerce passive site server         |                                                                                                |
| [TAKEOVER‑6](./TAKEOVER-6/takeover-6_description) | Hierarchy takeover via NTLM coercion and relay to SMB on remote SMS Provider                   |
|  TAKEOVER‑6.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑6.2: Coerce passive site server         |                                                                                                |
| [TAKEOVER‑7](./TAKEOVER-7/takeover-7_description) | Hierarchy takeover via NTLM coercion and relay to SMB between primary and passive site servers |
|  TAKEOVER‑7.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑7.2: Coerce passive site server         |                                                                                                |
| [TAKEOVER‑8](./TAKEOVER-8/takeover-8_description) | Hierarchy takeover via NTLM coercion and relay HTTP to LDAP on domain controller               |
|  TAKEOVER‑8.1: Coerce primary site server         |                                                                                                |
|  TAKEOVER‑8.2: Coerce SMS Provider                |                                                                                                |
|  TAKEOVER‑8.3: Coerce passive site server         |                                                                                                |
|  TAKEOVER‑8.4: Coerce site database server        |                                                                                                |
| [TAKEOVER‑9](./TAKEOVER-9/takeover-9_description) | Hierarchy takeover via crawling site database links configured with DBA privileges             |