Windows & AD Pentesting - Hands-on Lab Scenarios

Master Windows remote management with WinRM and PS remoting to securely access remote hosts using remote PowerShell, Invoke-Command, and WinRS. Use evil-winrm and crackmapexec for credentialed remote access.

Explains how SMB, or CIFS, enables file, printer, and resource sharing, highlights hidden admin shares like c$ and admin$, and surveys tools and exploits such as Eternalblue and SMB Ghost.

Learn Windows management instrumentation (WMI) to enumerate hardware and applications via command line or PowerShell. Remote access requires local admin privileges and a Windows transport layer like Winterim or Dycom.

Learn how Windows Kerberos authenticates users and services in a domain using tickets. Explore abuses such as golden tickets and roasting with Rubeus and Mimikatz in a lab.

Explore Bloodhound, a graphical active directory attack path tool, to enumerate domains, map relationships, and identify shortest paths to domain admins, with cypher queries and gpo insights.

Explore Windows domain enumeration with Powerview, a PowerShell tool for domain info, groups, trusts, and SPNs. Learn commands to enumerate users, GPOs, and Kerberos settings on a domain-joined machine.

Explore ldapsearch, a linux tool that connects to ldap servers from kali using domain credentials to search domain controllers and extract computer, user, and group objects.

Explore dsquery, a Windows binary for LDAP searches across a domain, demonstrating searches of computers, users, and groups with wildcards and filters, including domain trusts.

Explore a Windows pentesting lab focused on defender and antivirus status, protection, and methods to check status, disable features, and avoid detection using binaries and living off the land tools.

Explore early exploitation in Windows networks by examining Kerberos pre-authentication and AS-REP roasting, including how attackers obtain a TGT and crack passwords offline.

Explore kerberoasting by identifying SPN objects, requesting a TGS, and offline cracking of service account hashes using Metasploit and John the Ripper.

Explore exploiting ms17-010 (eternalblue) with metasploit to identify vulnerable targets using an auxiliary scan. Deploy a reverse shell and obtain a meterpreter session.

Spray a set of known domain users with weak passwords across SSH, SMB, and RDP to illustrate how lax password policies enable credential compromise.

Demonstrate authenticated remote code execution against SharePoint Server 2019 through a hands-on lab, using a proof-of-concept exploit, Visual Studio, domain credentials, and a public web path.

Use webdav to upload a web shell on a Windows target, achieving initial code execution. Upgrade to a meterpreter shell with MSF venom, deploying via dev test and http/https uploads.

NTLM relay attacks that intercept and relay authentication to access domain resources, with offline cracking of captured hashes in a safe, small lab setup.

Explore local Windows privilege escalation using WinPEAS and related scripts to inspect stored credentials, unquoted service paths, vulnerable services, and elevation checks for local or domain scope.

Describe unquoted service path vulnerabilities that allow injecting a malicious binary due to spaces in a service path, running with non-admin privileges; include Always Install Elevated and msf venom payloads.

Explore practical file transfer techniques between Windows and Kali, including PowerShell downloads with Invoke-WebRequest, SCP transfers via SSH, and SMB shares with net use.

Examine the local account token filter policy registry key and how flipping it enables remote access with high integrity tokens for local admins, and the effects on domain users.

Explore collecting NTLM and Miss Cache credentials on Windows hosts, dump LSA and SAM hives, and crack offline with Hashcat or John the Ripper.

Dump Alsace memory to extract passwords of logged-in and domain users with mimikatz or procdump, then crack ms-cache and secrets dumps using John with a password list.

Learn how DC Sync in Mimikatz dumps domain controller password hashes from Active Directory using the Microsoft Directory Replication Service Remote Protocol, with permissions and output options.

Learn how pass-the-hash uses hashed credentials and tlm authentication to access targets, collect a.l.m hashes from domain and local accounts, and execute remote operations.

Explore the data protection API (DPAPI) in Windows, a built-in encryption mechanism that stores Chrome, RDP, Wi-Fi, and other credentials, and how master keys and domain backup keys enable decryption.

Demonstrates obtaining and exporting Kerberos tickets from the KDC, using pass-the-hash and pass-the-ticket to move laterally with Mimikatz and Rubeus.

Explore golden ticket attacks that forge Kerberos tickets from a domain user hash to impersonate any user, access domain services, and escalate to enterprise admin with DC sync rights.

Execute an aggressive nmap scan and SMB enumeration to access the corporate share, exploit a PoC, evade Defender, extract sticky notes, harvest credentials, and pivot to Moondust.

Explore hands-on Windows and AD pentesting through a simulated breach, including Nmap discovery, FTP exploitation, Meterpreter payloads, web shells, privilege escalation, PowerShell history analysis, and WinRM pivoting.

simulate a multi-stage adversary attack on a zero domain, exploiting dotnetnuke via deserialization, dumping domain cache credentials, and escalating from domain admin to enterprise admin using a golden ticket.

Explore hands-on methods for crafting and using Kerberos golden tickets to escalate from a child to a parent domain, including prerequisites, remote access setup, and ticket management.

Explore hands-on windows and ad pentesting: discover a public code-execution exploit, pivot with crack map exec, harvest credentials, and deploy remote code execution to exodus target.

Explore a dual-nicked Windows and AD lab network by harvesting credentials, enumerating SMB shares, performing password spraying and brute-force attacks, and exploiting printnightmare with tunneling to establish a reverse shell.