Link to this headingInternal Penetration Testing Guide

Hack Ticks Wiki

Additional Tools
The following tools are not installed by default in the prerequisite toolset, but provide significant value in certain scenarios during testing:

• Bloodhound
• PowerSploit
• CrackMapExec
• Empire (Outdated)
• Apfell A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI.
• Covenant is a .NET command and control framework the newer Empire
• Silver a Golang C2 framework
• Faction
• KeeThief
• [UAC Bypass](/Windows/UAC Bypass)
  • https://github.com/FuzzySecurity/PowerShell-Suite/tree/master/Bypass-UAC
  • https://github.com/FuzzySecurity/DefCon25
• Impacket
• Automation for internal Windows Penetrationtest / AD-Security
• Better netcat shell

Link to this headingLogging Configuration

Windows (PowerShell):
The PowerShell file below will automatically load and execute whenever a PowerShell prompt is opened. This will maintain persistent logging/history of PowerShell commands (with and without timestamps).

1. Create the following file:

2. Save the following PowerShell code to this file:

Metasploit:
The configuration file described below will automatically run whenever msfconsole is launched. This will ensure a history is kept (both input and output) of both standard MSF commands/modules, but also sessions (e.g., Meterpreter shell).

1. Create the following file:

Link to this headingNetwork Access Control (NAC) Testing

Check if you get an address from DHCP if not then there may be a NAC.

Link to this headingMAC Filtering Bypass

Get Mac address from Other devices including VoIP Phones

Set Mac Address:

Link to this headingIPv6 Traffic Exclusion

Utilize nmap’s “-6” option and/or Metasploit’s “ipv6_multicast_ping” and “ipv6_neighbor” modules for IPv6 host discovery, as some NAC solutions strictly focus on IPv4 traffic.

List IPV6 addresses with Metasploit:

Scan IPv6 addresses with Nmap:

Link to this headingDedicated NAC Bypass Device (Intrusive)

A dedicated physical device (e.g., Pwnplug) can be connected to a target machine and configured to bypass the implemented NAC mechanism.

Link to this headingPassive Reconnaissance / Information Gathering

Link to this headingResponder

Use the forked Responder.

Hashes Sored in /usr/share/responder/logs/[PROTOCOL]-[HASHTYPE]-[IPADDRESS].txt

Check for LLMNR/NBT-NS Requests:

Actively Poison LLMNR/NBT-NS Requests:

Link to this headingCredential Theft/Reuse

Link to this headingSMB/NetNTLM Relay

If the Host has SMB Message Signing disabled then it is possible to relay Credentials. The destination also needs SMB Message Signing disabled also. By default Non Server Windows have SMB Signing disabled by default.

Since MS08-068 it is not possible to relay credentials back to the same machine on the same protocol.

Testing for SMB Message Signing Nmap:

Testing for SMB Message Signing Responder:

Testing for SMB Message Signing CrackMapExec:

Other service testing with responder:

Responder with Redirections:

Using Responder to get shells:
Running the MultiRelay command below will result in a shell if a relayed authentication request is successful.
the -u parameter allows all users to be relayed

Impacket Powershell Command:

5. The resulting MultiRelay shell offers extended functionality, detailed in Laurent Gaffie’s blog post, including remote Mimikatz commands.

Link to this headingPass-the-Hash (PTH)

This technique requires a previously compromised NTLM/LM hash of an account’s password. Note that this cannot be done using NetNTLM/NTLMv1/NTLMv2 hashes that are collected using Responder or similar tools.

1. Compromise an NTLM/LM hash
2. Determine which machines the corresponding account (for the hash) has access to. This can be done in several ways:
   1. Leverage Active Directory reconnaissance techniques to enumerate a list of logged on users for all target machines. This is best accomplished using PowerView, which is one of the Recon modules of PowerSploit. S

Link to this headingMimikatz

Link to this headingpypykatz

Mimikatz implementation in pure Python.

Dumping Kerberos Tickers from a dump file:

Viewing Kerberos Tickets:

Using Kerberos Tickets:

Link to this headingMimipenguin

A tool to dump the login passwords from memory

Link to this headingActive Directory Reconnaissance

Link to this headingUse Domain Account Without Domain-Joined Computer

Using a compromise domain user account, you can leverage the following technique to execute commands that interact with the target domain without using a domain-joined machine. Instead, you can run commands directly within your Windows testing machine/VM.

1. Launch a command prompt (cmd.exe)
2. Execute the following command. Note that the “PROGRAM” argument can be any program on your machine/VM, including cmd.exe, powershell.exe, mimikatz, etc. In this example, we’ll launch cmd.exe and subsequently PowerShell (bypassing the execution policy using “-exec bypass”).
3. Enter the account password
4. Execute the following commands:
5. You can then confirm that you are running as the authenticated domain user within the target domain by issuing the following command: