🎯Skills Assessment - Complete Password Attacks Workflow

🎯 Overview

This Skills Assessment demonstrates a complete penetration testing workflow that combines multiple password attack techniques to achieve domain compromise. The scenario shows how individual techniques work together in a real-world attack chain.

"This walkthrough represents a practical implementation of password attack methodologies, from initial foothold to complete domain compromise."

🏗️ Attack Chain Architecture

Complete Workflow

Initial Recon → SSH Brute Force → Credential Hunting → Pivoting → Internal Enum → Share Analysis → Password Vault Cracking → Privilege Escalation → Domain Compromise

Key Learning Objectives

  • Username enumeration with username-anarchy

  • SSH brute forcing with Hydra

  • Credential hunting in bash history

  • Network pivoting with ligolo-ng

  • Internal reconnaissance with NetExec

  • Share credential hunting with Snaffler

  • Password vault cracking with hashcat

  • LSASS memory dumping with mimikatz

  • Domain compromise via NTDS.dit extraction

🔍 Phase 1: Initial Reconnaissance & Foothold

Target Information

  • Target IP: Single IP address provided

  • Known Information: Betty Jayde (name), Texas123!@# (potential password)

  • Goal: Gain initial access to the network

Network Enumeration

Username Generation with Username-Anarchy

Installation and Setup

Generated Username Patterns

SSH Brute Force Attack

Hydra SSH Attack

Successful SSH Access

🕵️ Phase 2: Credential Hunting

Bash History Analysis

Extracted Credentials

  • Username: hwilliam

  • Password: dealer-screwed-gym1

  • Target: file01 (internal network)

🌐 Phase 3: Network Pivoting

Ligolo-ng Setup

Download and Extract

File Transfer Setup

Proxy and Agent Setup

Network Routing Configuration

🔍 Phase 4: Internal Network Reconnaissance

Target Enumeration

Credential Validation with NetExec

RDP Connection with File Sharing

📂 Phase 5: Network Share Analysis

Share Enumeration

Snaffler Automated Credential Discovery

Tool Transfer and Execution

Snaffler Results

🔓 Phase 6: Password Vault Cracking

Password Safe File Extraction

Hashcat Password Vault Cracking

Identify Hash Mode

Crack Password Vault

Password Vault Access

⚔️ Phase 7: Privilege Escalation

Credential Validation

Administrative Access via RDP

Mimikatz LSASS Dumping

Tool Transfer

Memory Credential Extraction

👑 Phase 8: Domain Compromise

Pass-the-Hash Attack

NTDS.dit Extraction

🎯 Skills Assessment Questions

Question 1: NEXURA\Administrator NTLM Hash

Answer: {Extract from NTDS.dit output}

Methodology:

  1. ✅ Initial SSH brute force → jbetty:Texas123!@#

  2. ✅ Credential hunting → hwilliam:dealer-screwed-gym1

  3. ✅ Network pivoting → Access to internal network

  4. ✅ Share analysis → Password vault discovery

  5. ✅ Vault cracking → bdavid credentials

  6. ✅ Privilege escalation → mimikatz LSASS dump

  7. ✅ Pass-the-Hash → stom account compromise

  8. ✅ Domain compromise → NTDS.dit extraction

🔧 Tools Integration Summary

Tools Used in Workflow

Phase
Tool
Purpose
Alternative

Recon

username-anarchy

Username generation

Manual creation

Initial

Hydra

SSH brute force

NetExec ssh

Hunting

grep

Credential discovery

Manual file review

Pivoting

ligolo-ng

Network tunneling

Chisel, SSH tunnels

Recon

NetExec

Service enumeration

Nmap, custom scripts

Shares

Snaffler

Automated credential hunting

PowerHuntShares, manual

Cracking

hashcat

Password vault cracking

John the Ripper

Memory

mimikatz

LSASS credential extraction

pypykatz

Domain

NetExec

NTDS.dit extraction

secretsdump.py

Command Reference Quick Sheet

💡 Key Learning Points

Attack Chain Insights

  1. OSINT drives initial success - Real names lead to valid usernames

  2. Credential reuse is common - Users often reuse passwords across systems

  3. Network shares contain secrets - IT environments accumulate credentials

  4. Password managers can be cracked - Vaults often use weak master passwords

  5. Memory contains active credentials - LSASS dumping reveals current sessions

  6. Hash attacks bypass passwords - NTLM hashes work without plaintext

  7. Domain compromise = total control - NTDS.dit contains every domain account

Defensive Lessons

  1. Monitor authentication failures - Detect brute force attempts

  2. Secure credential storage - Use proper secrets management

  3. Network segmentation - Prevent lateral movement

  4. Strong master passwords - Protect password vaults adequately

  5. Memory protection - Implement Credential Guard

  6. Privileged access controls - Limit administrative account usage

  7. Domain controller hardening - Protect NTDS.dit access

Methodology Validation

  • Systematic approach - Each phase builds on previous discoveries

  • Tool integration - Multiple tools working together effectively

  • Real-world applicability - Techniques mirror actual penetration tests

  • Complete coverage - From foothold to domain admin

  • Practical skills - Hands-on experience with industry tools

This Skills Assessment demonstrates the complete password attacks workflow, combining reconnaissance, brute forcing, credential hunting, privilege escalation, and domain compromise techniques in a realistic penetration testing scenario.

PreviousComplete Assessment WorkflowsNextActive Directory Attacks

Last updated