Windows & AD Pentesting - Hands-on Lab Scenarios

This 2023 course is targeted for Beginner to Intermediate security professionals and enthusiasts who want to learn more about Windows and Active Directory security. Topics covered are 100% Windows related and dive into the full pentesting lifecycle of Windows and Active Directory.

The course guides the student through red team and ethical hacking TTP's while showcasing real-world scenarios on a Windows cyber-range which mimics a corporate network. The cyber-range, Kinetic is hosted by SlayerLabs and contains 25 Windows VM's with 5 Domains and 6 subnets all engineered to exploit!

The mission of this course and cyber-range is to provide the user with a technical high-level overview of Windows and Active Directory security, along with realistic scenarios and learning opportunities to become proficient in Windows AD Pentesting. The goal is to provide real-world scenarios so the student can get hands-on keyboard and start running through the entire process from Reconnaissance to Post-Exploitation.

The course has been designed to trim the fat and only covers Windows related topics. With that, the student is expected to know basic TTP's in relation to offensive security, ethical hacking and pentesting. For example - covering how to setup a VM in VirtualBox, explaining the basics of networking or installing additional tools on Kali will not be covered.

Each topic dives into the technical side, providing command-line examples and explanations along the way. Topics covered (but are not limited to):

• Domain Enumeration with BloodHound, PowerView, ldapsearch and Dsquery.

• Initial Exploitation of AS-REP Roasting, Kerberoasting, Follina, Sharpoint Exploits, and Password Spraying.

• PrivEsc with WinPEAS, Saved 3rd party creds, and AlwaysInstallElevated.

• Post-Exploitation using Golden Ticket attacks, Pass-the-Ticket, Overpass-the-Hash, Pass-the-Hash, Dumping & Cracking NTLM & MsCache hashes and DPAPI.

Course content uses Kali the majority of the time, but also uses Slayer Labs Kinetic range Windows targets as jump boxes, utilizing built-in services such as WinRM and SMB. Students should be comfortable using Kali Linux along with Linux and Windows command-line. Majority of the commands used throughout this course are provided as a downloadable resource once purchased. Common tools used on Kali are Impacket Suite, CrackMapExec, Evil-Winrm and Metasploit.