PNPT - Week 2
Overview
Week 2 of the Practical Network Penetration Tester (PNPT) journey shifted the focus heavily towards Active Directory and internal network attacks. I progressed through the Active Directory sections of TCM Security’s Practical Ethical Hacking (PEH) course, built a dedicated virtualized Active Directory lab environment, and explored several common initial attack vectors used during internal penetration tests.
Alongside the PNPT preparation, vulnerability research also progressed. The previously discovered zero-day vulnerability was confirmed, and further research into the same product led to the discovery of an additional vulnerability. The vendor has been informed and I am currently awaiting their response.
Unlike the previous week, I did not complete any HackTheBox or other CTF machines this week.
Practical Ethical Hacking (TCM Security)
This week I progressed through the Active Directory portion of the Practical Ethical Hacking (PEH) course by TCM Security.
The completed curriculum covered the following sections.
Active Directory Overview
I started by learning the fundamental concepts behind Active Directory and how it is structured within a Windows domain environment.
The topics covered included:
Active Directory Overview: Understanding the purpose of Active Directory and its role in centralized identity and resource management.
Physical Active Directory Components: Learning about Domain Controllers, servers, clients, and the underlying infrastructure supporting an Active Directory environment.
Logical Active Directory Components: Understanding domains, forests, organizational units, users, groups, and other logical components.
Section Quiz: Testing the concepts covered throughout the module.
Active Directory Lab Build
After covering the theoretical foundations, I built my own Active Directory environment to use throughout the following sections of the course.
The lab setup included:
Reviewing the required infrastructure and lab components.
Preparing the environment using the cloud alternative provided by the course.
Downloading the necessary Windows ISO images.
Setting up the Domain Controller.
Configuring the Windows client machines.
Creating users and groups.
Configuring Active Directory policies.
Joining the client machines to the domain.
In addition to the course lab, I also prepared a dedicated VMware environment to perform my own experiments and reproduce the techniques covered throughout the course.
This environment will provide a controlled platform for experimenting with Active Directory attacks without relying exclusively on the course infrastructure.
Attacking Active Directory: Initial Attack Vectors
The main focus of this week’s coursework was the initial attack phase against Active Directory environments.
I covered several techniques commonly used to obtain an initial foothold or capture domain credentials:
LLMNR Poisoning: Understanding how LLMNR can be abused to capture NTLM authentication attempts.
Responder: Setting up Responder to poison name-resolution requests and capture NTLMv2 authentication material.
NTLMv2 Cracking: Understanding how captured NTLMv2 challenge-responses can be attacked offline.
LLMNR Mitigation: Learning how disabling LLMNR and applying appropriate network and authentication controls can reduce the attack surface.
SMB Relay: Understanding how NTLM authentication can be relayed to another SMB service instead of being cracked.
SMB Relay Lab: Performing an SMB Relay attack in the Active Directory lab and understanding the requirements for a successful relay.
SMB Relay Defenses: Studying SMB signing and other mitigations against NTLM relay attacks.
Gaining Shell Access: Exploring techniques for turning successful authentication or exploitation into interactive access.
IPv6 Attacks: Learning why IPv6 represents an important attack surface in Windows environments.
IPv6 DNS Takeover with mitm6: Understanding how rogue IPv6 configuration and DNS responses can be combined with NTLM relay.
IPv6 Attack Defenses: Reviewing defensive measures against IPv6-based attacks.
Passback Attacks: Learning how authentication mechanisms can be abused to obtain credentials through alternative network services.
Initial Internal Attack Strategy: Putting the individual techniques together into a structured strategy for approaching an internal Active Directory penetration test.
Section Quiz: Testing the knowledge acquired throughout the module.
These modules provided a much deeper understanding of how seemingly minor Windows networking features can become useful attack vectors when combined with NTLM authentication and Active Directory.
Security Research & Vulnerability Discovery
The security research conducted during Week 1 continued throughout this week.
The previously discovered Authenticated Remote Code Execution (RCE) vulnerability was further investigated and confirmed.
During the continued research into the same product, we also identified another previously unknown vulnerability.
The vendor has been informed of both findings and the responsible disclosure process is currently ongoing. At the time of writing, I am waiting for the vendor’s response and further information regarding the handling of the vulnerabilities.
Because the disclosure process is still active, technical details about the vulnerabilities are intentionally omitted from this report.
Lab Environment
A significant part of this week was dedicated to preparing a personal VMware-based penetration testing environment.
The goal is to have a reproducible environment where I can:
- Build and configure Active Directory domains from scratch.
- Deploy Windows clients and Domain Controllers.
- Reproduce the attacks covered in the PEH course.
- Experiment with different Active Directory configurations.
- Test both offensive techniques and their corresponding mitigations.
- Develop a better understanding of how individual attack vectors interact with each other.
Having a dedicated environment is particularly useful for the Active Directory portion of th