Tagged: ActiveDirectory
12 posts · browse all tags
-
Living Off the Land: certutil, mshta, rundll32, and Bitsadmin as Attacker Primitives
The LOLBAS project's own documented syntax for certutil, mshta, rundll32, and bitsadmin — signed Microsoft binaries repurposed as download-and-execute primitives against WKS01 in the CONTOSO.LOCAL lab, plus the Sysmon event IDs that actually flag it.
-
CVE-2026-56155 and CVE-2026-20833: Why Patch Tuesday Keeps Rediscovering the Impacket Series
July 2026's record Patch Tuesday shipped a Kerberoasting CVE and an AD FS key-theft zero-day that map almost exactly onto techniques from the Impacket Deep Dive series. Real transcripts from that series, held up against four CVEs, to show why the same trust-chain weaknesses keep resurfacing.
-
Impacket Deep Dive Part 1: Why Real Red Teams Skip the Metasploit Tutorials
Every beginner tutorial teaches Nmap, Hydra, and a Metasploit one-liner. Nobody assessing a real Windows domain works that way — they live in Impacket. Part 1: what it actually is, the lab this series runs against, and a verified tour of the toolkit.
-
Impacket Deep Dive Part 10: Defense in Depth and Detection
Nine posts of offense, consolidated into one defensive reference: every hardening control and detection signature from this series, an event ID cheat sheet, and where network-layer segmentation fits when the domain itself is already compromised.
-
Impacket Deep Dive Part 2: Domain Recon Without a Single Exploit
Before any password is cracked or any exploit fires, a Windows domain will hand an unauthenticated or low-privilege connection its entire user list, computer list, and RID space. Part 2: GetADUsers, lookupsid, rpcdump, and samrdump — and how to stop them talking.
-
Impacket Deep Dive Part 3: AS-REP Roasting with GetNPUsers.py
One unset checkbox — Kerberos pre-authentication — turns a domain account into a crackable hash that any authenticated, or sometimes any unauthenticated, client can request. Part 3: GetNPUsers.py, what AS-REP roasting actually exploits, and how to close it.
-
Impacket Deep Dive Part 4: Kerberoasting with GetUserSPNs
Any authenticated domain user can request a service ticket for any account with a registered SPN, and that ticket is encrypted with the service account's own password hash. Part 4: GetUserSPNs, why pre-auth doesn't save you here, and the gMSA fix.
-
Impacket Deep Dive Part 5: ntlmrelayx and the Passwordless Hijack
ntlmrelayx.py never cracks a password. It intercepts an NTLM authentication attempt already in flight and replays it, live, to a second target — turning a coerced login into administrative access before the victim's own request even completes.
-
Impacket Deep Dive Part 6: The Ghost Shells — wmiexec, smbexec, and atexec
Four Impacket scripts get you a remote shell on a Windows host, and they all abuse a different legitimate management protocol to do it. Part 6: wmiexec, smbexec, atexec, and dcomexec compared against classic PsExec, and why one of them is dramatically quieter than the rest.
-
Impacket Deep Dive Part 7: secretsdump.py, SAM, LSA, and DCSync
One shell on one member server is a foothold. secretsdump.py is what turns it into the entire domain's password material — local SAM hashes, cached domain logons, LSA secrets, and, if the account is right, every credential in Active Directory via DCSync.
-
Impacket Deep Dive Part 8: Forging Tickets with ticketer.py
With the krbtgt hash from Part 7 in hand, an attacker doesn't need any account's password ever again. ticketer.py forges Kerberos tickets outright — Golden Tickets for full-domain impersonation, Silver Tickets for a single quiet service, both bypassing the domain controller entirely.
-
Impacket Deep Dive Part 9: The Full Chain, Foothold to Domain Admin
Eight posts, eight tools, one domain. Part 9 runs CONTOSO.LOCAL's compromise start to finish, in the order a real intrusion actually uses these techniques — one phished workstation to a persistent, forged Domain Admin ticket.