Attacking Active Directory with Advanced Techniques With Lab

Enumerate guest access on shares with crack map exec and SMB to reveal anonymous, passwordless access, view read/write shares, and note potential upload for a reverse shell.

Demonstrates remote credential dumping in an active directory environment using responder, ntlmrelayx, proxychain, and DonPapi with wmiexec.py, highlighting stealthy data exfiltration and credential discovery.

Use invoke share finder to enumerate domain shares across multiple servers, revealing read/write access, admin shares, and certificate services within the Active Directory lab.

Explore how to enumerate group policy objects with Get-NetGPO using Power View, inspect display names, domain scope, and GPO metadata in a local Active Directory domain.

Explore Active Directory domain trust and how bi-directional trust enables cross-domain authentication, using Get-NetDomainTrust and forest enumeration to map domain controllers and forest topology.

This lecture demonstrates how the print nightmare vulnerability in the Windows print spooler can enable system access by loading a DLL from an SMB server to spawn a reverse shell.

Demonstrates exploiting printnightmare on the Baltimore domain controller, bypassing Defender with a crafted DLL, creating a local administrator user, and dumping the NTDS database via crackmapexec.

Explore constrained delegation with protocol transmission in Windows Kerberos, compare it with unconstrained delegation, and learn to verify delegation settings and impersonate an administrator on the Bronx server.

Learn how to use Metasploit to enumerate Active Directory assets—users, groups, and computers—while managing sessions and executing post modules in a lab environment.

Enumerate Active Directory servers, shares and SMB permissions, and enumerate services, SNMP, and Chrome data using post Windows gatherer modules for hands-on lab exploration.

Learn to perform a hash dump with metasploit on a Windows host, using post windows gather and kiwi to extract administrator credentials and tickets in a lab.

Learn lateral movement with metasploit, using the smb parsec exploit to gain remote access, dump credentials, and enumerate domain admins across multiple servers in a simulated active directory lab.

demonstrates a dc sink attack with Metasploit, impersonating the administrator from nt authority/system to obtain credentials via dc sync, and prep for a golden ticket.

demonstrates creating a golden ticket with metasploit using mimikatz kiwi extension to persistently authenticate to active directory as a high privilege domain administrator for ten years.

learn to establish persistence by creating a backdoor service using a Windows Meterpreter payload, startup registry settings, and a reverse TCP handler.

Install Neo4j and Cypher Shell, set up BloodHound with AD CS and PKI support, and run the BloodHound collector to map Active Directory attack paths in Azure and on premises.

Explore exploiting the sc2 template on an adcs server with certipy, requesting a certificate via rpc from Maryland CA, and using smbexec to obtain a privileged session.

Explores exploiting trusted links between MSSQL servers to pivot from Yonkers to Salisbury by authenticating with Elena Lopez's credentials, enabling remote login and command execution.