Altered Security

Attacking & Defending Active Directory (CRTP)

Examination Report

Target: Altered Security Examination Lab ( DOMAIN )

Date:
Owner:
Table of Content
1. EXECUTIVE SUMMARY 3
1.1 Remarks 3
2. Methodology and Goals 4
3. Scenario and Scope 5
3.1 Scenario 5
3.2 Scope 5
4. Attack Narrative 6
4.1 Initial Access: 6
4.1.1 Lateral Movement 6
4.2 Second Machine: 7
4.2.1 Gaining access to 7
4.2.2 Lateral Movement 7
4.3 Third Machine: 8
4.3.1 Gaining access to 8
4.3.2 Lateral Movement 8
4.4 Fourth Machine: 9
4.4.1 Lateral movement 9
4.5 Fifth and Sixth Machine: 10
4.5.1 Gaining access to the 10
4.5.2 Lateral Movement to 10
5. Remediation and Recommendation 11
5.1 11
5.2 11
5.3 11
5.4 11
5.5 11

Attack & Defending Active Directory (CRTP) Examination Report

1. EXECUTIVE SUMMARY
The student performed a Red Team engagement on <DOMAIN> & <DOMAIN>
domains from.

The engagement performed by the student employed real-world adversary

techniques to target the systems under test. The sequence of activities in this
approach involves open-source intelligence (OSINT) collection, enumeration,
exploitation, and attack in order to perform goal specific operational impacts. The
goals included:
● Get OS command execution on all 5 targets.
●

Specific remediation for this assessment is outlined in the “Remediation and

Recommendations” section of this report. The following list is a brief summary of
these remediation:
●

A summary of goals and objectives achieved by the student include the following:
● Execute OS command on all 5 targets.
●

The student has provided specific recommendations for reducing the risks imposed
by these issues in the “Observations and Recommendations” section of this report.

1.1 Remarks

Attack & Defending Active Directory (CRTP) Examination Report

2. Methodology and Goals
Red Team engagements performed by the student employ real-world adversary
techniques to target the systems under test. The student uses a red team model
emulating real adversary tools, techniques and procedures (TTPs) driven by attack
scenarios and goals. Unlike a traditional penetration test, the red team model allows
for the testing of the entire security scope of an organization to include people,
processes and technology.
The three major Red Team phases were used during the engagement to accurately
emulate a realistic threat. Get In, Stay In, and Act.
The sequence of activities in this approach involves open-source intelligence (OSINT)
collection, enumeration, exploitation, and attack. Information gathered during OSINT
collection is used in conjunction with passive and active enumeration. Enumeration
information typically yields details about specific hardware, services, and software
running on remote machines. The next phase involves analyzing all accumulated
information to identify potential attack vectors. If a weakness can be exploited,
operators attempt to obtain additional access into the network or system and to
collect sensitive system information to create effects and demonstrate impact to the
customer. Vetted tools, methodologies, and operator experience were employed to
prevent unintentional disruption, degradation or denial of service to the customer.
The goals included:
● Get OS command execution on all 5 targets.
●

Attack & Defending Active Directory (CRTP) Examination Report

3. Scenario and Scope
3.1 Scenario
The Red Team engagement was based on the Assumed Breach Model utilizing
PowerShell script. A user is assumed to be breached to begin the test. The approach
of the Assumed Breach Model allows the test to begin quickly, and later use access
gained from the exposed access to validate actions.

3.2 Scope
The scope identified by Altered Security is to include the targets:
● .
● .
● .
● .
● .
● .

Attack & Defending Active Directory (CRTP) Examination Report

4. Attack Narrative
4.1 Initial Access:

System Information:
Hostname:
IP Address:

4.1.1 Lateral Movement

Attack & Defending Active Directory (CRTP) Examination Report

4.2 Second Machine:

System Information:
Hostname:
IP Address:

4.2.1 Gaining access to

4.2.2 Lateral Movement

Attack & Defending Active Directory (CRTP) Examination Report

4.3 Third Machine:

System Information:
Hostname:
IP Address:

4.3.1 Gaining access to

4.3.2 Lateral Movement

Attack & Defending Active Directory (CRTP) Examination Report

4.4 Fourth Machine:

System Information:
Hostname:
IP Address:

4.4.1 Lateral movement

Attack & Defending Active Directory (CRTP) Examination Report

4.5 Fifth and Sixth Machine:

4.5.1 Gaining access to the

System Information:
Hostname:
IP Address:

4.5.2 Lateral Movement to

System Information:
Hostname:
IP Address:

At this point, all the targets have been compromised and got OS command execution
on them.

Attack & Defending Active Directory (CRTP) Examination Report

5. Remediation and Recommendation
5.1

5.2

5.3

5.4

5.5

The End

Attack & Defending Active Directory (CRTP) Examination Report