Windows-Penetration-Testing - Technical notes, AD pentest methodology, list of t

项目说明

Windows Acti penetration testing

Technical notes, AD pentest methodology, list of tools, scripts and Windows commands that are useful for internal penetration tests and assumed breach exercises (red teaming).<br>
>The output files included here are the results of tools, scripts and Windows commands that I ran against a Windows AD lab that I created to test attacks/exploits and deli penetration testing training sessions.

Table of contents

> #### <i> Classic internal penetration test methodology - Windows Acti attack paths </i>

Step 1. Bypassing Network Access Control (NAC) - if any

Step 2. Reconnaissance

Step 3. Gaining access

Step 4. Post-exploitation and local pri escalation

Step 5. Network lateral mo and pri accounts hunting

Step 6. Windows domain compromise (Pri escalation to become 'Domain Admin' + Persistence)

Step 7. Forest root domain compromise (Pri escalation to become 'Enterprise Admin')

Others

- Defense e techniques - Bypassing AV, EDR and SIEM solutions
- List of useful tools and scripts
- Useful resources

----------------
#### STEP 1. BYPASSING NETWORK ACCESS CONTROL (NAC) - if any 🔐
<i>If a NAC solution is implemented, the purpose of this phase will be to bypass it to get access to the internal network and start the internal penetration test.</i>

-----------------
#### STEP 2. RECONNAISSANCE 🕵
<i>The purpose of the reconnaissance phase is to gather as much as possible information about the targets (Windows domains and internal network). It includes Windows domain(s) enumeration, DNS enumeration, targeted network scans...</i>

-----------------
#### STEP 3. GAINING ACCESS 🔓
<i>The purpose of this phase is to gain (unauthorized) access to several internal systems (e.g. servers, file shares, databases) by exploiting common security issues such as: default/weak passwords, OS security misconfiguration, insecure network protocols and unpatched known .</i>

---------------
#### STEP 4. POST-EXPLOITATION and LOCAL PRI ESCALATION 🛠
<i>The purpose of the post-exploitation phase is to determine the value of the systems compromised during the previous phase (e.g. sensitivity of the data stored on it, usefulness in further compromising the network) and to escalate pri to obtain local administrator rights. This phase also in har credentials and potentially taking over any pri accounts currently logged into the compromised systems. Additionally, compromised systems can be configured as pivot to reach machines that are located in other network segments.</i>

> EXAMPLE 1 – You ha unauthorized access to a Windows server or workstation

> EXAMPLE 2 – You ha a Web server

> EXAMPLE 3 – You ha unauthorized access to a MSSQL/PostgreSQL/Oracle database

-----------------
#### STEP 5. NETWORK LATERAL MO and PRI ACCOUNTS HUNTING 🕸
<i>The purpose of the lateral mo phase is to identify Windows servers and laptops on which high pri user and service accounts are logged (e.g. administrator of all servers and/or databases, administrator of all workstations/laptops, Domain Admin account). Then try to log into these Windows servers and laptops (for example by re-using the credentials har during the previous phase) and take over the high pri accounts using hacking techniques (e.g., dumping credentials from memory, token impersonation). </i>

-----------------
#### STEP 6. WINDOWS DOMAIN COMPROMISE (Pri escalation to become "Domain Admin" + Persistence) 🔥
<i>The purpose of this phase is to take full control over the target Windows domain.</i>

-----------------
#### STEP 7. FOREST ROOT DOMAIN COMPROMISE (Pri escalation to become "Enterprise Admin") 🔥🔥
<i>The purpose of this phase is to take full control over the Forest root domain and all the other domains in the target network.</i>

-----------------
#### DEFENSE E TECHNIQUES - BYPASSING ANTIVIRUS, EDR and SIEM SOLUTIONS
> During penetration tests, it is important to know how to bypass at least antivirus solutions to be able to identify and exploit without being blocked.
>
> In general, during Red Team exercises, in addition to assessing the security posture of a company by trying to achie goals (e.g., becoming 'Domain Admin' of the Windows prod en(s), getting unauthorized access to critical applications, "crown-jewel" data and email boxes of employees, etc.), we also want to e the effecti of the Security Operation Center (SOC) and its detection capabilities. Thus, it is important for red teamers to know how to be stealthy and bypass security detection solutions such as AV, EDR, SIEM, IDS/IPS, etc.
For instance, in Red teaming, avoid at all costs using "noisy & easy to detect" hacking tools (e.g. Mimikatz, Metasploit C2) and techniques (e.g. aggressive and wide network port and scans).

-----------------
#### LIST OF USEFUL TOOLS & SCRIPTS

| TOPIC | TOOL | URL | DESCRIPTION |
| :-----: | :-----: | :-----: | :------: |
| Recon, Audit, Post-Exploitation | Windows Sysinternals | </br> | Adexplorer, procdump, procmon, autorun, ... |
| Recon, Audit, Post-Exploitation | Windows nati | - | Windows native DOS commands (e.g. net commands, nltest) and PowerShell commands (including AD module) |
| Recon, Audit | ADRecon | </br> | Acti gathering information tool |
| Recon, Audit | ADCollector | </br> | Tool to quickly extract information from the AD en for both attacking and defending |
| Recon, Audit | NMAP | </br> | Network port scanner and (NSE) scripts |
| Recon, Audit | PingCastle | </br> | Acti security audit tool |
| Recon, Audit | BloodHound | </br> | Tool to easily identify complex Windows domain attack paths |
| Recon, Audit | ACLight | </br> | A tool for ad discovery of pri accounts including Shadow Admins|
| Recon, Audit | ADACLScanner | </br> |A tool with GUI used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Acti|
| Recon, Audit | Liza | </br> | Acti Security, Permission and ACL Analysis |
| Recon, Audit | LAPSToolkit | </br> | LAPS auditing for pentesters |
| Gaining Access | Rubeus | </br> | Toolset for raw Kerberos interaction and abuses |
| Audit, Privesc | Certify | </br> | C# tool to enumerate and abuse misconfigurations in Acti Certificate Services (AD CS) |
| Audit, Privesc | Certipy | </br> | Python tool to enumerate and abuse misconfigurations in Acti Certificate Services (AD CS) |
| Audit, Privesc | PassTheCert | </br> | Proof-of-Concept tool to authenticate to an LDAP/S server with a certificate through Schannel |
| Gaining Access, MITM | Responder | </br> | LLMNR/NBTNS/mDNS poisoner and NTLMv1/2 relay |
| Gaining Access, MITM | Inveigh | </br> | .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers |
| Gaining Access, MITM | Smbrelayx & Ntlmrelayx | </br> | SMB and NTLM relay tools which are part of the Python offensi framework 'Impackets' |
| Recon, Gaining Access | scanners | </br> () () () () | e.g. OpenVAS, Nessus, Qualys, Nexpose, ... |
| Recon, Gaining Access | SMBmap | </br> | SMB enumeration tool |
| Recon, Gaining Access | SauronEye | </br> | Search tool to find files containing passwords in network shares |
| Gaining Access | SharpSpray | </br> | Acti password spraying tool. Auto fetches user list and avoids potential lockouts |
| Gaining Access | Hydra | </br> | Online password bruteforce tool |
| Post-Exploitation, Privesc | Mimikatz | </br> | Extract plaintexts passwords, hash, PIN code and kerberos tickets from memory|
| Post-Exploitation, Creds dumping | SharpKatz | </br> | Porting in C# of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands |
| Post-Exploitation, Creds dumping | Nanodump | </br> | The swiss army knife of LSASS dumping |
| Password cracking | Hashcat | </br> | World's fastest and most ad password recovery utility |
| Password cracking | John the Ripper | </br> | Offline password cracker |
| Post-Exploitation, Privesc | PowerSploit (incl. PowerView & PowerUp) | </br> | PowerShell offensi framework |
| Recon, Audit, Post-Exploitation, Privesc | PowerSharpPack | </br> | Many usefull offensi Projects wraped into Powershell for easy usage |
| Post-Exploitation, Privesc | Pri | </br> | This script aims to enumerate common Windows configuration issues that can be le for local pri escalation |
| Post-Exploitation, Privesc | Seatbelt | </br> | C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive & defensi perspectives |
| Post-Exploitation, Privesc | KrbRelayUp | </br> | KrbRelayUp - a uni no-fix local pri escalation in windows domain en where LDAP signing is not enforced (the default settings) |
| Privesc | Juicy-potato exploit | </br> | Local privesc tool |
| Privesc | Rotten-potato exploit | </br> | Local privesc tool |
| Privesc | God-potato exploit | </br> | Local privesc tool |
| Privesc | Efs-Potato exploit | </br> | Local privesc tool |
| Post-Exploitation, Privesc | Nightly builds of common C# offensi | </br> | Nightly builds of common C# offensi, fresh from their respecti branches built and released in a CDI fashion using Azure DevOps release pipelines |
| Post-Exploitation, Privesc | SharpImpersonation | </br> | A user impersonation tool or Shellcode injection |
| Post-Exploitation, Privesc | Tokenvator | </br> | Windows Tokens impersonation tool|
| Post-Exploitation, Privesc, Network Lateral Mo | CcmPwn | </br> | Lateral mo and privesc script that le the CcmExec service to remotely hijack user sessions |
| AD Privesc | BloodyAD | </br> |BloodyAD is an Acti Pri Escalation Framework |
| Post-Exploitation, Defense e | AMSI.fail | <br> | It generates obfuscated PowerShell snippets that break or disable AMSI for the current process |
| Post-Exploitation, Defense e | Nuke-AMSI | <br> | AMSI bypass tool |
| Post-Exploitation, Defense e | SharpKiller | </br> | AMSI bypass tool |
| Post-Exploitation, Defense e | ProtectMyTooling | </br> | Multi-Packer wrapper letting us daisy-chain packers, obfuscators and other Red Team oriented weaponry.|
| Post-Exploitation, Defense e | IronSharpPack | </br> | Repository of popular C# offensi projects (e.g., Rubeus, Certify) embedded into IronPython scripts that execute an AMSI bypass and then reflective load the C# projects |
| Post-Exploitation, Defense e | Pyramid | </br> | Perform post-exploitation task in an e manner, executing offensi from a signed binary (e.g. python.exe) by importing their dependencies in memory |
| Post-Exploitation, Defense e | FilelessPELoader | </br> | Load, decrypt and execute in-memory remote AES encrypted PE |
| Post-Exploitation, Defense e | EAPrimer | </br> | Load and execute in-memory remote .Net assemblies (C# projects) after bypassing AMSI |
| Post-Exploitation, Defense e | BetterNetLoader | </br> | Load and execute in-memory remote .Net assemblies (C# projects) with AMSI and ETW bypass |
| Post-Exploitation, Defense e | In | </br> | PowerShell scripts obfuscator|
| Post-Exploitation, Defense e | Chameleon | </br> | PowerShell scripts obfuscator|
| Post-Exploitation C2, Network Lateral Mo, Pi | Cobalt Strike | </br> | Cobalt Strike gives you a post-exploitation agent and covert channels to emulate a quiet long-term embedded actor in your customer's network |
| Post-Exploitation C2, Network Lateral Mo, Pi | Metasploit | </br> | Penetration testing framework and post-exploitation C2 |
| Post-Exploitation C2, Network Lateral Mo, Pi | Sliver | </br> Open source cross-platform ad emulation/red team framework |
| Post-Exploitation C2, Network Lateral Mo, Pi | Havoc | </br> Havoc is a modern and malleable post-exploitation command and control framework|
| Post-Exploitation C2, Network Lateral Mo, Pi | Co | </br> Co is a collaborative .NET C2 framework for red teamers|
| Recon, Gaining Access, Network Lateral Mo, Pi | Impacket Framework | </br> | Python offensi framework (e.g. WMIexec.py, SMBexec.py, Secretsdump.py) |
| Recon, Gaining Access, Network Lateral Mo, Pi | NetExec | </br> | Swiss army knife for pentesting Windows networks|
| Recon, Gaining Access, Network Lateral Mo, Pi | CrackMapExec (legacy)| </br> | Swiss army knife for pentesting Windows networks|
| Recon, Gaining Access, Network Lateral Mo, Pi | SharpMapExec | </br> | Swiss army knife for pentesting Windows networks |
| Network Lateral Mo, Pi | Powercat | </br> | PowerShell TCP/IP swiss army knife like netcat |
| Network Lateral Mo, Pi | In | </br> | It contains PowerShell functions for performing pass-the-hash WMI and SMB tasks |
| Network Lateral Mo, Pi | Chisel | </br> | Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH |
| Network Lateral Mo, Pi | Rpivot | </br> | Socks4 reverse proxy for penetration testing |
| Network Lateral Mo, Pi | Ligolo | </br> | Reverse Tunneling made easy for pentesters, by pentesters |
| Network Lateral Mo, Pi | Ligolo-ng | </br> | A simple, lightweight and fast tool that allows to establish tunnels from a reverse TCP/TLS connection using a tun interface |
| NAC bypass | Fenrir | </br> | Tool/script designed to bypass wired network 802.1x protection (NAC) |

----------------
#### USEFUL RESOURCES

项目信息

开发语言：C

Star 数：329

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Technical notes, AD pentest methodology, list of tools, scripts and Windows commands that are useful for internal penetration tests and assumed breach exercises (red teaming).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。