MeshForge

Series: The Community's Red Team Post: 17 of 17 Tags: bloodhound, active directory, SharpHound, attack paths, AD, tools Read time: ~13 min Prerequisites: Post 01 — Methodology Overview, Post 14 — Impacket Active Directory is a maze. Thousands of users, hundreds of groups, dozens of computers, nested group memberships, ACL permissions, delegation rights, session data — the relationships between AD objects are too complex to map manually and too important to leave unmapped. A u

Series: The Community's Red Team Post: 16 of 17 Tags: ligolo-ng, pivoting, tunneling, network interface, proxychains, tools Read time: ~10 min Prerequisites: Post 15 — Chisel Post 15 covered Chisel — excellent for simple tunneling when you need a SOCKS proxy. Ligolo-ng solves the same problem differently, and the difference matters: instead of routing your traffic through proxychains, Ligolo-ng creates an actual virtual network interface on your attack machine. The result is

Series: The Community's Red Team Post: 15 of 17 Tags: chisel, pivoting, tunneling, SOCKS, proxychains, port forwarding, tools Read time: ~10 min Prerequisites: Post 01 — Methodology Overview You compromised a machine. That machine sits in a DMZ — it can reach the internal network, but your attack box cannot. The firewall allows outbound HTTP from the DMZ but blocks everything else. You need to get your tools into that internal network. Chisel builds an encrypted tunnel over H

Series: The Community's Red Team Post: 14 of 17 Tags: impacket, psexec, wmiexec, secretsdump, kerberoast, DCSync, Windows, tools Read time: ~12 min Prerequisites: Post 06 — CrackMapExec, Post 12 — Metasploit Impacket is a Python library that implements Windows network protocols — SMB, MSRPC, LDAP, Kerberos, MSSQL, and more — at a level that lets you interact with Windows infrastructure from a Linux machine without needing to be domain-joined or running Windows at all. For red

Series: The Community's Red Team Post: 13 of 17 Tags: linpeas, winpeas, privilege escalation, post-exploitation, Linux, Windows, tools Read time: ~11 min Prerequisites: Post 12 — Metasploit, Post 11 — Netcat You've got a shell. You're running as a low-privilege user. The goal is root or SYSTEM. The question is: where's the opening? Privilege escalation is the art of finding misconfiguration — SUID binaries that shouldn't be SUID, cron jobs running writable scripts, sudo rules

Series: The Community's Red Team Post: 12 of 17 Tags: metasploit, msfconsole, meterpreter, exploitation, post-exploitation, tools Read time: ~13 min Prerequisites: Post 01 — Methodology Overview, Post 11 — Netcat Metasploit has a reputation problem. In movies and TV it's the "press button, get hacked" tool that makes hacking look trivial. In beginner CTF writeups it's treated as a crutch. In real security work, it's an industrial-grade framework that senior red teamers use ev

Series: The Community's Red Team Post: 11 of 17 Tags: netcat, reverse shells, bind shells, file transfer, port scanning, tools Read time: ~11 min Prerequisites: Post 01 — Methodology Overview Netcat has been called the TCP/IP Swiss Army knife, and that description has stuck for thirty years because nothing better has come along to replace it. It reads and writes raw data across TCP and UDP connections. That's it. That single capability, applied creatively, makes it the tool y

Series: The Community's Red Team Post: 10 of 17 Tags: john the ripper, hash cracking, ssh keys, zip, pdf, office, password attacks, tools Read time: ~10 min Prerequisites: Post 09 — Hashcat Post 09 covered Hashcat — GPU-accelerated cracking for raw hashes. Hashcat is faster at cracking hashes once you have them. John the Ripper's edge is in everything that comes before that: converting password-protected files into a format that can be cracked. Find a password-protected zip f

Series: The Community's Red Team Post: 09 of 17 Tags: hashcat, hash cracking, offline cracking, NTLM, kerberoast, password attacks, tools Read time: ~12 min Prerequisites: Post 01 — Methodology Overview You're inside a system. You ran a credential dump and came back with a file full of hashes. Or you captured NetNTLMv2 traffic with Responder. Or you grabbed Kerberos tickets with Impacket. The plaintext passwords are locked inside these strings of hex characters. Hashcat's job

Series: The Community's Red Team Post: 08 of 17 Tags: medusa, brute force, ftp, ssh, parallel attacks, password attacks, tools Read time: ~9 min Prerequisites: Post 07 — Hydra (understand the brute force concepts first) Hydra and Medusa solve the same problem: trying a list of credentials against a network service. If you already read Post 07, you might be wondering why you need another brute force tool. The answer is that they're complementary, not redundant — each has cases