PNPT - Week 3
Overview
Week 3 of the Practical Network Penetration Tester (PNPT) journey was primarily focused on completing the Active Directory section of TCM Security’s Practical Ethical Hacking (PEH) course.
After covering the fundamentals and initial attack vectors during the previous week, I progressed into the post-compromise phase of Active Directory penetration testing. This included learning how to enumerate a compromised domain, identify relationships and attack paths, perform credential and token-based attacks, and ultimately understand what can be done after obtaining significant control over the domain.
I also covered several additional Active Directory attack techniques and finished the section with multiple practical case studies that brought together the concepts covered throughout the course.
With these modules completed, I have now finished the entire Active Directory section of the PEH course.
Practical Ethical Hacking (TCM Security)
This week I completed the remaining Active Directory modules of the Practical Ethical Hacking (PEH) course.
The coursework progressed from post-compromise enumeration through increasingly advanced attacks and finally into complete Active Directory compromise scenarios.
Attacking Active Directory: Post-Compromise Enumeration
The first module focused on what to do after obtaining an initial foothold in an Active Directory environment.
The topics covered included:
Introduction: Understanding the objectives of post-compromise enumeration and the information that should be collected after obtaining access to a domain-joined system.
Domain Enumeration with ldapdomaindump: Using LDAP-based enumeration to gather information about users, groups, computers, and other Active Directory objects.
Domain Enumeration with BloodHound: Understanding how BloodHound can map relationships and permissions within Active Directory to identify potential attack paths.
Domain Enumeration with PlumHound: Learning how PlumHound can be used to query and present BloodHound data in a more structured format.
Domain Enumeration with PingCastle: Using PingCastle to assess an Active Directory environment and identify security weaknesses and configuration issues.
Section Quiz: Testing the knowledge acquired throughout the module.
This module highlighted the importance of enumeration after gaining an initial foothold. Rather than immediately attempting to escalate privileges, a large amount of useful information can first be gathered about the domain structure, users, groups, permissions, and potential attack paths.
Attacking Active Directory: Post-Compromise Attacks
The next module focused on techniques that can be used after compromising a domain-joined system.
The topics covered included:
Introduction: Understanding the post-compromise attack phase and how information gathered during enumeration can be used to identify further opportunities.
Pass Attacks Overview: Introduction to attacks that reuse authentication material instead of requiring the original password.
Pass Attacks: Exploring techniques for abusing recovered authentication material to authenticate to other systems.
Dumping and Cracking Hashes: Understanding how password hashes can be extracted and subjected to offline password attacks.
Pass Attack Mitigations: Reviewing defensive measures against authentication-material reuse.
Kerberoasting Overview: Understanding how Kerberos service tickets associated with accounts configured with Service Principal Names can be requested and attacked offline.
Kerberoasting Walkthrough: Performing the technique in the lab environment and analyzing the resulting Kerberos ticket material.
Kerberoasting Mitigation: Reviewing ways to reduce the exposure of service accounts to Kerberoasting.
Token Impersonation Overview: Understanding how Windows access tokens can be abused to operate under another user’s security context.
Token Impersonation Walkthrough: Performing token enumeration and impersonation using Meterpreter and the Incognito extension.
Token Impersonation Mitigation: Reviewing techniques for reducing the exposure of privileged authentication contexts.
LNK File Attacks: Understanding how malicious Windows shortcut files can be used as an attack vector.
GPP / cPassword Attacks and Mitigations: Learning how legacy Group Policy Preferences can expose credential material and how the associated risks can be mitigated.
Mimikatz Overview: Understanding the capabilities of Mimikatz and its interaction with Windows authentication mechanisms.
Credential Dumping with Mimikatz: Using Mimikatz to investigate authentication material available on compromised Windows systems.
Post-Compromise Attack Strategy: Putting the different techniques together into a structured approach for continuing an Active Directory compromise after obtaining an initial foothold.
Section Quiz: Testing the knowledge acquired throughout the module.
This module connected many of the individual techniques covered throughout the Active Directory section.
In particular, it demonstrated how credentials, Kerberos tickets, access tokens, and other authentication material can become stepping stones for moving from an initial compromised machine towards more privileged access.
We’ve Compromised the Domain - Now What?
The next module focused on the situation where an attacker has obtained significant control over the Active Directory environment.
The topics covered included:
Post-Domain Compromise Attack Strategy: Understanding the objectives and considerations after obtaining domain-level privileges.
Dumping the NTDS.dit: Learning how the Active Directory credential database can be accessed to extract domain authentication material.
Golden Ticket Attacks Overview: Understanding the role of the
krbtgtaccount in Kerberos and the implications of compromising its secret.Golden Ticket Attacks: Learning how a compromised
krbtgtsecret can be used to create forged Kerberos Ticket Granting Tickets.
This module provided an important perspective on the difference between compromising an individual account and compromising the underlying Active Directory trust infrastructure.
Additional Active Directory Attacks
The following module introduced additional attacks against Active Directory and Windows infrastructure.
The topics covered included:
Section Overview: Introduction to additional Active Directory attack techniques.
Abusing ZeroLogon: Learning about the Zerologon vulnerability and its impact on vulnerable Domain Controllers.
PrintNightmare (CVE-2021-1675) Walkthrough: Exploring the exploitation of a vulnerability in the Windows Print Spooler service and its relevance to Active Directory environments.
Section Quiz: Testing the knowledge acquired throughout the module.
These attacks also reinforced the importance of patch management and reducing the attack surface of infrastructure services running on Domain Controllers.
Active Directory Case Studies
The final module consisted of several practical Active Directory case studies.
The topics covered included:
AD Case Study #1: Applying the techniques covered throughout the Active Directory section to a practical scenario.
AD Case Study #2: Working through another Active Directory compromise scenario and applying the appropriate enumeration and attack techniques.
AD Case Study #3: Combining multiple concepts from the previous modules into a complete practical scenario.
These case studies were useful for moving away from individual techniques and towards a more structured penetration-testing methodology.
Instead of treating each attack as an isolated technique, the scenarios required understanding how enumeration, credential access, privilege escalation, lateral movement, and domain compromise can form a continuous attack path.
Active Directory Section Completed
With the completion of Modules 16 through 20, I have now finished the Active Directory section of the Practical Ethical Hacking course.
The progression through these modules covered the complete lifecycle of an Active Directory attack, starting with initial access and enumeration and continuing through post-compromise activity and domain-level compromise.
The main areas covered throughout the complete section were:
Active Directory architecture and fundamentals.
Active Directory lab deployment.
LLMNR poisoning.
NTLM authentication attacks.
SMB Relay.
IPv6-based attacks.
Passback attacks.
Post-compromise enumeration.
LDAP enumeration.
BloodHound and attack-path analysis.
Credential and hash attacks.
Kerberoasting.
Token impersonation.
Mimikatz and credential dumping.
NTDS credential extraction.
Golden Ticket attacks.
Additional Active Directory vulnerabilities.
Practical Active Directory case studies.
This provides a solid foundation for approaching an Active Directory environment from both an enumeration and exploitation perspective.
Week 3 Takeaways
The main takeaway from this week was understanding how much the post-compromise phase contributes to an Active Directory penetration test.
Obtaining an initial foothold is only the beginning. Once inside the environment, systematic enumeration can reveal relationships, privileges, credentials, service accounts, and attack paths that are not immediately visible from the compromised machine.
The modules also demonstrated how different techniques can be chained together.
For example, an initial credential compromise can lead to access to another machine, which can expose additional authentication material, which can then lead to further privilege escalation or lateral movement.
Finally, the sections covering NTDS and Golden Tickets demonstrated the significance of compromising the Active Directory infrastructure itself. At this stage, the focus moves beyond individual machines and accounts towards the security mechanisms that underpin the entire domain.