pentest-infra-internal

name

pentest-infra-internal

description

Internal infrastructure penetration testing from a network foothold. Use when the user mentions internal pentest, lateral movement, privilege escalation (LPE), LSASS dump, Mimikatz/NanoDump/secretsdump, PsExec, WMI, WinRM, NTLM relay, Responder, mitm6, LLMNR/NBT-NS poisoning, IPv6 takeover, DPAPI, GPP cpassword, LAPS, KeePass, SUID/GTFOBins, sudo NOPASSWD, container escape, kernel exploit, MSSQL link, or generic Windows/Linux post-exploitation.

Pentest — Internal Infrastructure

Apply 04-infra-internal/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 04-infra-internal/00-overview.md first.

Phase order

1. 04-infra-internal/01-passive-recon.md — broadcast sniff, LLMNR/NBT/mDNS, DHCP, CDP/LLDP.
2. 04-infra-internal/02-active-discovery.md — host-up, port scan with ROE-aware rate.
3. 04-infra-internal/03-network-protocol-attacks.md — LLMNR/NBT poisoning, mitm6, NTLM relay, VLAN hop, NAC bypass.
4. 04-infra-internal/04-service-attacks.md — SMB, RDP, WinRM, databases, web admin.
5. 04-infra-internal/05-credential-access.md — file shares, LSASS, SAM, NTDS, DPAPI, GPP, LAPS, SCCM NAA, browsers, vaults.
6. 04-infra-internal/06-privesc-windows.md — service misconfig, Potato family, UAC bypass, BYOVD.
7. 04-infra-internal/07-privesc-linux.md — sudo, SUID, capabilities, cron, kernel exploits.
8. 04-infra-internal/08-lateral-movement.md — PsExec/WMI/WinRM, PtH/PtT, RDP, DB links, SSH.
9. 04-infra-internal/09-persistence.md — scheduled task, service, SSH key, web shell.

How to operate

1. Confirm foothold type (drop-box, VPN, joined VM, starting credential) and ROE allowances for noisy primitives.
2. Passive before active: 30–60 minutes of broadcast capture before any TX often surfaces NTLMv2 or DHCP context.
3. For each user question, locate the matching phase file and stable ID; expand How to test for tooling. Note per-item destructive (⚠) and post-ex (🎯) markers per CONVENTIONS.md.
4. AD-specific attack chains → switch to pentest-active-directory for depth (BloodHound, Kerberos, ADCS, NTLM-relay→DA).
5. Track every dropped binary / service / scheduled task for cleanup at engagement end.

When NOT to use

• Active-Directory-specific operations → pentest-active-directory (Kerberos, ADCS, BloodHound).
• Pre-foothold / external → pentest-infra-external.

Pre-conditions

• Network foothold or starting credential.
• Tester staging area for tooling that may flag EDR.
• NetExec, impacket, BloodHound, Responder, ntlmrelayx, mitm6, NanoDump, Rubeus, PowerView/SOAPHound installed.

OPSEC

• Responder is loud (broadcast announcements) — confirm SOC tolerance.
• mitm6 disrupts IPv6 on the segment; limited blast radius but coordinate.
• LSASS dumps trigger most modern EDR — prefer NanoDump / comsvcs LOLBin path.
• PsExec writes service binary + Event 7045 — prefer WMI/DCOM for stealth.
• Cleanup: confirm services / scheduled tasks / dropped binaries removed before disengaging.

References inside the library

• Cheatsheet: cheatsheets/lateral-movement.md.
• Tooling: tools/install-infra.md, tool-mappings/04-infra-internal-tools.md.
• Frameworks: frameworks/mitre-attack-enterprise.md.
• Playbook: playbooks/01-first-24h-internal-pentest.md.