Skip to content

Latest commit

 

History

History
183 lines (91 loc) · 4.08 KB

crtp-methodology.md

File metadata and controls

183 lines (91 loc) · 4.08 KB
description
This Methodology is intended to help to stay focus and don't miss anything during the exam.

⚙ CRTP Methodology

{% hint style="info" %}

Important to know:

{% hint style="warning" %} CRTP consists on Live Of The Land then no phishing, no exploits, and no CVEs. {% endhint %}

{% hint style="info" %} The exam environment won't include any tools, but we can add the tools we need to a specific folder in Windows Defender exclusion settings. {% endhint %}

{% hint style="success" %} What you have learned in the course is everything you need in order to pass the exam. {% endhint %}

{% hint style="info" %} The exam goal is to execute OS command on 5 targets not matter what privileges the user have {% endhint %} {% endhint %}

0. Defenses

Policy language mode

Enumerate PS Language Mode - #language-mode

if the Language is constrained:
try to bypass using PS v2 or #list-applocker-rules

Bypass AMSI

Bypass AMSI every new PowerShell session -#amsi-bypass

Also #invisi-shell can be used

Bypass Defender

#windows-defender

Turn off Firewall

#firewall

1. Local Privilege Escalation

check our privileges using whoami /all

Use #powerup-1 and discover the vectors:

  • Unquoted Service
  • Modifiable Service File
  • Modifiable Service

Once we are Local admin use lsass-dump.md to find other users logons

2. Domain Enumeration

ACL

acl.md

Better to write down the interesting ACL so they might be useful later

BloodHound is very useful visualizing ACLs

General

gnereral.md

Start to build up a mind map for attacking paths

  • Domain
  • Domain Controller
  • Users
  • Computers
  • Domain and Enterprise Administrators
  • OUs
  • GPOs
  • SPNs

Forests and Trusts

Understand trusts and map them between the domains

forests-and-trusts.md

3. Domain Privileges Escalation

Reverse shell by abusing Jenkins

User Hunting

#user-hunting - Hunt for local admin access

AD CS

ad-cs.md

Delegations

delegations.md - Search for Delegations

ACL

acl.md

abusing ACL can lead

4. Lateral Movement

Bypass Defenses

#0.-defenses

OPTH

lsass-dump.md after getting Admin privileges then moving inside the domain using over-pass-the-hash.mdthen spawn PowerShell session using winrm.md.

User Hunting

#user-hunting - Hunt for local admin access

5. Cross Domain Privilege Escalation

MSSQL

mssql-servers.md

Inter-Realm TGT

trusts.md - After abusing Trust keys or krbtgt of trusted domain it is possible to abuse other forest abusing Inter-Realm TGT