On this page
Most internal tests start from an assumed breach: a laptop or a virtual machine on the corporate network and one ordinary domain account, the position an attacker has after one successful phish. The first hour decides where the rest of the week goes. We spend it reading before we try anything that could lock an account or break a service. Everything here happens only on networks and with accounts named in the scope letter.
What to check first
- Our own address, gateway, DNS servers and the domain name the network hands out.
- Where the domain controllers are, and the domain password policy, before any authentication attempt.
- Whether hosts answer broadcast name resolution (LLMNR, NBT-NS, mDNS).
- Which servers do not require SMB signing.
- Whether Active Directory Certificate Services is deployed, and which templates low-privilege users can enroll in.
- Where administrators log in from.
Where am I
ip addr; ip route; cat /etc/resolv.conf
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.example.com
From a Windows foothold, ipconfig /all and nltest /dclist:corp.example.com answer the same questions. The DNS servers handed out by DHCP are usually domain controllers.
Fix. Nothing here is a weakness on its own. What limits an attacker at this point is segmentation: a user network that can reach every server subnet and every management interface gives the rest of this page a much larger target.
Read the password policy first
nxc smb dc01.corp.example.com -u tester -p "$PASS" --pass-pol
The lockout threshold and observation window decide whether any password testing later is safe. Fine-grained password policies can set different rules for admins and service accounts, so we read those too.
Fix. Set a lockout threshold that stops guessing without handing an attacker a way to lock out the company; the Windows security baseline uses ten attempts and a fifteen minute window. A threshold of zero, meaning no lockout at all, goes in the report.
Host discovery and SMB signing
nmap -sn 10.20.0.0/22 -oA live-hosts
nxc smb 10.20.0.0/22 --gen-relay-list no-signing.txt
A host that does not require SMB signing accepts relayed NTLM authentication. Combined with a way to make a privileged machine authenticate to us, that is often a short route to admin on that host.
Fix. Require SMB signing on every server and workstation by Group Policy. Domain controllers have required it for years, and Windows 11 24H2 and Windows Server 2025 require it by default; older member servers, NAS devices and printers are where it is missing. Close the matching relay path to the directory as well: require LDAP signing and LDAP channel binding on domain controllers.
LLMNR and NBT-NS poisoning (analyze mode)
sudo responder -I eth0 -A
Analyze mode listens and answers nothing. It shows which hosts fall back to LLMNR or NBT-NS when DNS fails, and which names they ask for. It does not show accounts or credentials: those arrive only after something answers the query, and that is the poisoning step. Poisoning is a separate step that we take only when the rules of engagement allow it.
Fix. Disable LLMNR with the "Turn off multicast name resolution" policy, disable NetBIOS over TCP/IP through DHCP options or adapter settings, and keep wpad on the DNS global query block list unless you actually use proxy autodiscovery.
BloodHound and Kerberoasting
nxc ldap dc01.corp.example.com -u tester -p "$PASS" --bloodhound --collection All --dns-server 10.20.0.10
nxc ldap dc01.corp.example.com -u tester -p "$PASS" --kerberoasting kerberoast.txt
BloodHound turns group memberships, sessions and ACLs into paths from our account to Domain Admins. We look for the shortest, and for the surprising ones: helpdesk groups with reset rights over admins, or a service account with local admin on every server. Its session data also answers where administrators log in from: a domain admin session on a workstation is a path in its own right. The second command lists user accounts with service principal names; their tickets can be cracked offline if the passwords are weak.
Fix. Separate admin accounts by tier and keep Tier 0 credentials off workstations. Run the same BloodHound collection yourself every quarter and remove the paths it shows. Move service accounts to group managed service accounts, and where you cannot, give them long random passwords and AES-only encryption.
AD CS template abuse (ESC1 and ESC8)
certipy find -u tester@corp.example.com -p "$PASS" -dc-ip 10.20.0.10 -vulnerable -stdout
A template that lets the requester supply the subject name, combined with client authentication and enrollment open to domain users, lets any user request a certificate as any other user, including a domain admin. Certipy also flags web enrollment endpoints that accept NTLM over HTTP, which turns a coerced machine authentication into a certificate for that machine, a domain controller included.
Fix. Remove "supply in the request" from templates that low-privilege groups can enroll in, or require manager approval on them. Restrict enrollment rights to the groups that need them, and enable strong certificate mapping on domain controllers. Turn off AD CS web enrollment if nobody uses it; where it is needed, serve it over HTTPS only with Extended Protection for Authentication and NTLM disabled.
The password spray page covers what comes next when the password policy allows it.
What the defender sees
Analyze mode is silent. The ping sweep and SMB checks show in network monitoring. BloodHound collection is a burst of LDAP queries from one workstation, which identity-focused detection tools flag. Kerberoasting shows as ticket requests (event 4769) for many services in a short window, often with RC4 encryption. If none of it raised an alert, the client learns as much from that as from the findings.