Internal Network Pentesting and Lateral Movement

[Stakshh]

Hello,

I got access via vpn to some corps but i am stuck moving internally.

I have already got a lot of resources like the famous network manual by basterlord and many other
from the forum.

I tried moving laterally by enumerating AD users and the password spray inside the network.

I also tried vuln scanning the network but i am not going far.

I already know that i must gather credentials or exploit servers and moving from there using mimikatz for example.

I understand that it takes a lot of practice and time.

Can you suggest your methods of lateral movement inside AD and what works best for you?

Any help is appreciated as the forum and the community in general is very helpful so far.

 

[Bimarck]

pm lets talk , i can help you

 

[vei]

i think you posted in the wrong section, but i usually start checking where i have access and exploring different ways to collect credentials/hashes

 

[phant0m]

Have you checked for kerberos vulns ? Domain admin accounts so you can maybe phish them ? etc...

 

[Kecog]

1. Try LLMNR poisoning. This way, you can get hashes and then try to crack them or use pass-the-hash attack.
2. Look for printer EWS(embedded web server), if you find one, try passback attack.
3. Perform port scan and look for public exploits.
4. Look for web servers and check default credentials. Maybe you will find useful information.