Exploitation & Initial Access
This phase covers techniques to gain initial access and harvest credentials on internal networks, including password attacks, relay attacks, and Active Directory exploitation. Each attack category has its own comprehensive guide with detailed techniques, automation scripts, and practice labs.
Danger
krbtgt key, and CVE
exploitation can take a host down. Authorization for "enumeration" does not carry over to exploitation — confirm the
Rules of Engagement name the permitted techniques, the hosts they may be run against, and the change window before
the first attempt, and keep a record of what you altered so cleanup is possible.
Exploitation Guides
Credential Attacks
A07 | Authentication FailuresLLMNR/NBT-NS poisoning with Responder, hash capture and cracking with Hashcat and John, password spraying, and brute force attacks.
NTLM Relay Attacks
A07 | Authentication Failuresntlmrelayx attacks, SMB to LDAP relay, IPv6 DNS takeover with mitm6, LDAPS relay for privilege escalation, and computer account creation.
Kerberos Attacks
A04 | Cryptographic FailuresKerberoasting, AS-REP roasting, Pass-the-Ticket, Golden/Silver ticket attacks, and Kerberos delegation abuse techniques.
Lateral Movement
A01 | Broken Access ControlPass-the-Hash, PsExec, WMI execution, WinRM/Evil-WinRM, SMB execution, DCOM lateral movement, and RDP pivoting techniques.
Privilege Escalation
A01 | Broken Access ControlToken manipulation, service account abuse, UAC bypass, PrintSpoofer, Potato attacks, SeImpersonate privilege abuse, and scheduled task exploitation.
Active Directory Exploitation
A01 | Broken Access ControlDCSync attacks, GPO abuse, ACL exploitation, AdminSDHolder abuse, LAPS abuse, constrained delegation, and resource-based constrained delegation.
Credential Dumping
A07 | Authentication FailuresSAM database extraction, LSASS memory dumps with Mimikatz and pypykatz, secretsdump, NTDS.dit extraction, and credential caching attacks.
Known Vulnerabilities
A03 | Software Supply Chain FailuresEternalBlue (MS17-010), ZeroLogon (CVE-2020-1472), PrintNightmare (CVE-2021-34527), PetitPotam, and other critical Windows/AD vulnerabilities.
ADCS Attacks
ESC1, ESC4, ESC6, ESC8Active Directory Certificate Services abuse — template misconfigurations, relay to HTTP enrollment, and certificate theft.
Shadow Credentials
msDS-KeyCredentialLinkKey Trust abuse via msDS-KeyCredentialLink attribute modification for stealthy account takeover.
Delegation Attacks
S4U / RBCDUnconstrained, constrained, and resource-based constrained delegation abuse for service impersonation.
Coercion Attacks
RPC AbusePetitPotam, PrinterBug, DFSCoerce, and ShadowCoerce — force machine authentication for relay or credential capture.
gMSA & LAPS Abuse
Credential TheftExtract group Managed Service Account passwords and Local Administrator Password Solution credentials from AD.
AD Trust Attacks
Cross-DomainForest trust exploitation, SID History injection, ExtraSids golden tickets, and cross-forest lateral movement.
NTLM Downgrade
Drop The MICNTLMv2→v1 downgrade, advanced relay techniques, WebDAV relay, and EPA bypass attacks.
Hybrid Identity
Azure AD ConnectAzure AD Connect exploitation, PTA backdoors, Seamless SSO silver tickets, and PRT theft for on-prem→cloud pivots.
Attack Flow Overview
Quick Reference
Exploitation Methodology
- Identify attack surface - Map network services, protocols, and potential targets
- Choose attack vector - Select appropriate technique based on available access
- Execute exploitation - Use the detailed guides above for specific attack vectors
- Harvest credentials - Extract hashes, tickets, or plaintext credentials
- Move laterally - Pivot to additional systems using captured credentials
Information
Command Quick Reference
| Attack | Tool | Command |
|---|---|---|
| LLMNR Poison | Responder | sudo responder -I eth0 -dwPv |
| NTLM Relay | ntlmrelayx | ntlmrelayx.py -tf targets.txt -smb2support |
| Kerberoast | GetUserSPNs | GetUserSPNs.py domain/user:pass -request |
| AS-REP Roast | GetNPUsers | GetNPUsers.py domain/user:pass -request |
| Remote Shell | psexec.py | psexec.py domain/admin:pass@TARGET |
Recommended Reading
The Art of Network Penetration Testing
Royce Davis
Modern internal pentest walkthrough — enumeration, exploitation, pivoting, and AD attacks with real-world methodology.
Hacking APIs
Corey Ball (2022)
Exploiting internal and web APIs — authentication flaws, BOLA, injection, and mass assignment in modern environments.
Evidence Collection
One artefact per technique: The hash, ticket, certificate, object or session that each attack produced — not a screenshot of the tool's banner. Every child page has its own Evidence section listing exactly what that technique has to yield.
Command, host and time: What you ran, against which host, and when. This is the difference between a finding the client can reproduce and an assertion they have to take on trust.
What changed in their environment: Objects created, attributes written, certificates issued, services installed. Exploitation is the phase that leaves state behind; the report has to account for all of it, and so does cleanup.
Reachability, not just success: Where the obtained credential or ticket actually works, as a host list with the privilege level on each. "Domain credentials obtained" is a claim about every one of those hosts.
CVSS range: Per finding. Credential capture without a path: 5.3–6.5 | Local admin on a member server: 7.2–8.8 | Domain Admin or DCSync: 9.8
False Positive Identification
-
A tool banner is not a result:
Responder printing a hash, ntlmrelayx reporting
SUCCEEDand nxc showingPwn3d!all describe an attempt. Each page lists the second observation that turns it into a finding. - A credential that works on one host: Local administrator on a single workstation is not domain compromise, and the report should not imply it is. State the host count and the tier of each host.
- Success that depended on a missing control: LLMNR poisoning succeeding means LLMNR is enabled; relay succeeding means signing is off. Report the missing control as the finding — the technique is only how you found it.
- Repeating a lab result on a production claim: A technique that worked in a lab without EDR may produce nothing on a defended estate. If the attempt failed on the client's systems, that is the result.
Remediation
The four controls that remove most of this phase
- • Disable LLMNR/NBT-NS and require SMB signing — kills poisoning and SMB relay together (05a, 05b).
- • LDAP signing and channel binding, plus EPA on AD CS HTTP — closes the two relay destinations that still work on 24H2 estates (05b, 05i).
- • Credential Guard, LSASS as PPL and LAPS — makes the credential-dumping step cost a kernel exploit instead of local admin (05g).
The ones that need a programme, not a setting
- • Tiered administration with separate credentials per tier, so one compromised workstation does not yield a server or domain credential (05d, 05k).
- • Service-account hygiene: gMSA, no SPNs on user accounts, no RC4-only or pre-auth-disabled accounts (05c).
- • Patch and build inventory with deadlines, and isolation for hosts past end of life — the whole of 05h depends on this being visible.
Related Topics
AD Attack Paths
Deep dive into Active Directory attacks
Post-Exploitation
Persistence and lateral movement
Impacket Cheatsheet
Python AD attack tools
nxc Cheatsheet
Network pentesting swiss army knife
BloodHound Cheatsheet
AD relationship mapping
Authentication Remediation
Secure credential management
As an Amazon Associate I earn from qualifying purchases.