Learn Active Directory Pentesting for RedTeaming - Part 1

Understand how Active Directory functions as a database, storing information about objects in the network and providing authentication and authorization services. Recognize that objects include users, computers, and printers.

Explore how active directory enables centralized management of users and computers via a domain controller, allowing bulk rule enforcement across an organization. Understand why manual setup is impractical at scale.

Contrast pen testing and red teaming by showing pentesting targets vulnerabilities in a limited scope and time, while red teaming seeks broader access to test blue team defenses.

Set up a three-machine lab with a public M01, internal M02, and a domain controller, then compromise M01, pivot to M02, and finally to the domain controller.

Install VMware workstation to support hacking and pentesting practices. Download and install the software, then rely on snapshots to recover data if the system is compromised.

Install kali as the attacking machine by downloading the kali linux vm image, setting up in vmware, logging in with Carly, and increasing ram to 4 gb.

Install Windows Server 2022 in a VM, enable the Active Directory Domain Services, and promote the server to a domain controller for a new forest named Ultimate Active Directory Pentesting.local.

Install Windows 10 Enterprise on a VMware virtual machine, configure 64-bit edition, allocate 3 GB RAM, install VMware Tools, rename the VM to ms01, and repeat steps for ms02.

Set up Active Directory users and groups, create an organizational unit and a shared learning SMB share, and deploy a GPO to disable Defender Antivirus with enforcement.

Join m01 and s02 to the domain controller, configure IP and DNS, enable network discovery and sharing, and create domain users and local administrators in Active Directory.

Explain the difference between Active Directory trees and forests, how separate domains form a forest when combined, and distinguish one-way and two-way relationships.

Discover how to create users and groups in a domain controller using Active Directory users and computers, and prepare for command-line user management in pentesting scenarios.

Group policy objects enforce policies to grant or prohibit access, such as disabling the control panel. Learn to create, link, and test a GPO to restrict access in Active Directory.

Explore how to create a service principal name (SPN) in Active Directory, assign a service account (SQL_SVC), and verify registration for proper service mapping.

Explore authentication in active directory, comparing general authentication with Kerberos authentication. Understand how identity is verified before access, illustrated by a campus ID analogy.

Explore how ntlm authentication uses a challenge-response mechanism, where the domain controller verifies the user's response to grant or deny access, with the server as a mediator in Active Directory.

Explain how Kerberos uses tickets PGS, PGT, and TGS from a KDC to authenticate a client and grant access to services such as SQL.

Learn to use nmap to identify open ports, enumerate service versions with -sC and -sV, and inspect robots.txt and firewall behavior for red-team footholds.

Learn dns enumeration and subdomain discovery using port 53, adding discovered domains to the hosts file, and performing zone transfers to reveal additional subdomains and potential credentials.

Enumerate Kerberos on port 88 with nmap and Khirbet to test domain usernames, including mantis and administrator, and assess riposting vulnerability with the impact tool.

Enumerate port 135 for rpc to gather active directory information on users, groups, and cities located in the active directory domain, and identify sids, rids, and domain admin memberships.

Demonstrates enumerating smb shares via ports 139 and 445, using smb client to check permissions, list, download with get, and upload with put, illustrated on a learning share.

Explore smb enumeration with enum4linux on the target IP address to discover shares, operating system details, access rights, and password policy, while noting false positives and access restrictions.

Learn how to obtain an interactive shell over smb using wmi exec and exec tools, requiring administrative privileges and awareness of port 445 exposure in Windows Server 2022 environments.

enumerate active directory data via ldap on ports 389 and 636, using ldapsearch to query information, users, machines, and policies, while understanding naming contexts, base versus depth, and domain components.

Explains how to enable and access remote desktop protocol on port 3389 to control Windows GUI from Kali, using xfree rdp, with firewall and registry rules, and sharing folders.

Explore how port 5985 and 5986 enable a WinRM shell on a Windows host in an active directory pentesting scenario, using credentials or hashes to gain access.

Explore http-based file transfers between Windows and Kali by running a Python http server and using PowerShell, certutil, wget, and curl to upload and download files.

Transfer files between Kali and Windows using smb by running an smb server with a share name and dot as the current directory, then copy e.txt to Windows and back.

Transfer files between Kali and Windows using netcat, set up a listener, and exchange text and shells with nc.exe and SMB methods.

Identify a vulnerability as a system flaw, and explain how an exploit uses it, followed by a payload that performs the actual work, such as keyloggers or remote access trojan.

Explain the difference between reverse shell and bind shell for red team pentesting. See how a victim connects to attack machine with netcat, versus the attacker binding to the victim.

Compare stateless (stageless) payloads with staged payloads for windows reverse shells, detailing a dropper and stage, one-step vs two-step delivery, and how file size and antivirus evasion affect detection.

Generate a stage less payload on a Kali machine, start a Python server, download and run the shell to obtain a reverse shell, and preview a Meterpreter session.

Generate Meterpreter reverse shells using msfvenom and msfconsole, choosing stage or stageless payloads, configure handlers, and verify staged downloads to establish a remote session.

Identify windows-specific initial attack vectors, including poisoning ldap relay, smb relay, a man-in-the-middle attack on rdp, html-based footholds, and VBA, using a doc file to gain initial foothold.

Learn how llmnr poisoning triggers local name resolution misdirection, enabling an attacker to broadcast queries, capture a v2 hash, crack it with hashcat, and gain administrator access.

Explain how rdp traffic on port 3389 can be hijacked by a man-in-the-middle attacker who eavesdrops and captures credentials during authentication in a typical client-server interaction.

Explore how html applications (hta) can be abused to gain initial access, generate a Windows reverse-shell payload with msfvenom, and establish a netcat listener for a foothold.

Learn how a malicious Word document can deliver a reverse shell, using Kali Linux, Metasploit, and a crafted macro to establish an initial foothold for red-team pentesting.

Learn how JavaScript can deliver a PowerShell payload to obtain a shell by simulating a phishing workflow, using a base64-encoded payload and a netcat listener.