Skip to content

PNPT - Week 1

Overview

This week marked the official kickoff of the Practical Network Penetration Tester (PNPT) journey. Activities ranged from foundational networking and OSINT modules to hands-on Active Directory lab work via HackTheBox and independent security research resulting in a zero-day discovery.

HackTheBox: Forest

To sharpen core Active Directory and pentesting foundations, I tackled the Forest machine on HackTheBox.

  • Machine Profile: Forest is an introductory-to-intermediate Windows machine heavily focused on Active Directory enumeration and exploitation.
  • Key Concepts Covered: Enumerating users and groups via RPC and LDAP, exploiting bloodhound/sharphound configurations, DCSync attacks, and leveraging Active Directory permissions abuse to escalate privileges to Domain Administrator.

Practical Ethical Hacking (TCM Security)

I began the Practical Ethical Hacking (PEH) course by TCM Security, progressing through the initial modules up to the “Butler” walkthrough section. The completed curriculum included:

  • Foundations & Methodology: Navigating course structures, setting up virtualization labs with VMware/VirtualBox and Kali Linux, and mastering the five stages of the ethical hacking methodology.
  • Networking Refresher: Deep-diving into IP/MAC addresses, the TCP 3-way handshake, common protocols, the OSI model, and practical subnetting.
  • Information Gathering (OSINT): Executing passive reconnaissance, hunting emails and breached credentials using tools like Breach-Parse and DeHashed, subdomain enumeration, tech profiling, and advanced Google-fu.
  • Scanning & Enumeration: Deploying Kioptrix labs, performing port scans with Nmap, enumerating HTTP/HTTPS, SMB, and SSH services, and identifying actionable vulnerabilities.
  • Vulnerability Scanning: Configuring and running comprehensive scans using Nessus.
  • Exploitation Basics: Differentiating reverse vs. bind shells and staged vs. non-staged payloads, utilizing Metasploit, manual exploitation, password spraying, and structured note-taking frameworks.
  • Capstone Labs: Completing practical walk-through setups and capstones including Blue, Academy, and Dev.

Security Research & Vulnerability Discovery

Alongside a colleague, I conducted independent security research targeting a ManageEngine product.

  • Finding: We successfully identified and verified an Authenticated Remote Code Execution (RCE) vulnerability.
  • Status: Full technical details and write-ups are currently withheld pending responsible disclosure and an official patch release by ManageEngine.