If the SOC team’s screen doesn’t light up with red alerts the moment you fire off mimikatz.exe "privilege::debug" "lsadump::lsa /inject", then that company’s real headache is just starting. You see 'system compromised' in many pentest reports, but the true measure of skill is how long you stayed inside and what you could manipulate without being seen. Today, let’s talk about how to move like a ghost in the internal network after that initial access, and how the blue team can actually catch these ghosts.
First Stop: Where Am I and Who Am I?
When you breach a system, you usually start with a low-privileged service account or the session of a distracted user. Running whoami /all tells you who you are, but it doesn’t tell you where you stand within the testCompany.local domain. The first mistake people make is immediately 'pouncing' on the entire network with nmap. Don't. It’s the digital equivalent of shouting in a library.
Instead, you should sniff out the existing configurations on the system. For instance, you can silently view other machines and potential targets on the network with these simple yet effective queries via cmd.exe:
# Defanged network discovery attempts
net view /domain
net group "Domain Admins" /domain
# Finding critical servers by poking at DNS records
nslookup -type=any internal-service.example.com 127.0.0.1
Lateral Movement: Going Door to Door
Lateral movement is the most artistic part of a penetration test. It’s almost impossible to leave no trace while moving from one machine to another, but it is possible to hide that trace in the crowd. We used to use PsExec to jump everywhere as System. Now, modern EDRs (Endpoint Detection and Response) catch those specific Service Control Manager logs created by the PsExec service in seconds.
We have more 'elegant' methods now. Take WinRM (Windows Remote Management), for example. If ports 5985 or 5986 are open on the target machine and you have an NTLM hash, you can flow through PowerShell using tools like Evil-WinRM or Invoke-Command.
# Defanged WinRM connection logic
$session = New-PSSession -ComputerName "target-workstation" -Credential $cred
Invoke-Command -Session $session -ScriptBlock { Get-Process }
The biggest line of defense here is 'Privileged Access Management' (PAM) and network segmentation. If an accountant's computer can connect to a sysadmin's server via WinRM, there’s a major architectural flaw. On the Red Team side, we love these mistakes; but on the defensive side, you should hate them.
The Achilles' Heel of Active Directory: Kerberoasting
One of my favorite techniques that still works like a charm in domain environments is Kerberoasting. Why? Because this type of attack makes almost zero 'noise.' Our goal is to request tickets (TGS) belonging to Service Principal Names (SPN). These tickets are encrypted with the hash of the service account's password. We download this ticket to our own machine and try to crack it offline.
# Defanged representation of a service ticket request
# In a real scenario, this involves Rubeus or GetUserSPNs.py
# Target: [email protected]
To defend against this, you don't necessarily need fancy tools. Just ensure that service accounts have long, complex passwords that are rotated regularly. If I can crack your 'sql_svc' account password in 10 minutes because it's 'Summer2023!', the problem isn't the protocol; it's the policy.