Internal network pentest — execution methodology

Internal network pentest — execution methodology

TL;DR: An internal pentest emulates a foothold (assumed-breach or rogue insider) and runs the AD attack chain — recon, credential access, lateral movement, domain dominance — within a contracted window. Unlike a red-team engagement, scope is broad and noisy; goal is finding ALL exploitable paths, not staying quiet.

What it is

The standard 5–10 day internal engagement. Customer hands the consultant a wired or VPN drop and a (sometimes) low-priv domain account; consultant must demonstrate impact (Domain Admin / Tier-0 access, sensitive data exposure) and produce a defensible coverage report.

Preconditions / where it applies

  • Signed SOW: in-scope subnets, out-of-scope hosts (e.g., production OT), exclusion of destructive techniques
  • VPN credentials or onsite kit drop (laptop, Wi-Fi Pineapple if scoped)
  • Low-priv domain user (optional — assumed-breach scenario) OR no creds (post-physical-access scenario)
  • Emergency contact, after-hours phone, rules of engagement signed

Phase playbook

1. Network situational awareness (Day 1 AM)

  • DHCP + IPv4/IPv6 leases; identify default gateway, DNS, domain controllers
  • responder -A passive — list NetBIOS / mDNS / LLMNR traffic (recon only, no poisoning yet)
  • ARP scan + nmap -sn on local /24 to map live hosts
  • DNS zone transfer attempt (dns-enum)
  • Identify domain: nltest /dsgetdc:, nslookup -type=srv _ldap._tcp.dc._msdcs.<domain>

2. Identity surface mapping (Day 1 PM)

  • Anonymous LDAP / SMB enumeration: NetExec (netexec-nxc-workflow), enum4linux-ng, ldapsearch
  • Null-session SMB + IPC$ check
  • Kerberos pre-auth enumeration → AS-REP roastable users (asreproast)
  • Username list from LDAP for spray
  • Password policy via nxc smb dc01 --pass-pol

3. Credential access — low-noise first (Day 2)

In assumed-breach scenario, the provided account is the starting point. Without creds:

  • Targeted password spray against discovered users (1 password × all users, 1 attempt per lockout window)
  • LLMNR/NBT-NS/mDNS poisoning (ntlm-relay) — Responder + ntlmrelayx
  • IPv6 spoofing via mitm6 + ntlmrelayx → relay to LDAPS
  • Coerce + relay chains (ad-coercion-and-relay-matrix-2025)

With a low-priv account:

4. ADCS attack surface (Day 2-3)

5. Lateral movement (Day 3-4)

  • Map session info: BloodHound HasSession edges
  • Pass-the-hash / overpass-the-hash with collected hashes
  • WMI / WinRM / SMB exec (wmi-exec, winrm-exec, smb-exec)
  • Token impersonation when local admin lands on a server with privileged user logged in
  • DCSync from positions with Replicating Directory Changes right (dcsync)

6. Domain dominance (Day 4-5)

7. Sensitive-data hunt (Day 5)

Always required for client value:

  • Snaffler share mining (snaffler-share-mining) for credentials, KeePass, .pst, .config
  • Database access tests (mssql-enum, mssql-trusted-links)
  • Code repos on internal GitLab / Bitbucket — read secrets
  • Backup shares — historical NTDS / SYSTEM hives
  • File servers tagged with sensitive labels (PII, PCI, PHI)
  • Confluence / SharePoint search for “password” — often hits

8. Defensive depth observations (Day 5)

Note for report:

  • LSASS protection (RunAsPPL) presence on workstations
  • Credential Guard status
  • LAPS deployment + read-perm scope
  • SMB signing on / off across hosts (nxc gen-relay-list output)
  • LDAP signing + channel binding on DCs
  • KDS root key rotation cadence
  • ADCS template ACLs
  • BloodHound run-vs-attacker self-assessment evidence

9. Reporting (Day 6-7)

  • Attack path narrative: foothold → DA in chronological order with screenshots
  • Per-finding: severity, repro steps, defender remediation, references
  • Coverage map: what was tested vs SOW
  • Tier-0 recommendations: top 5 changes that close most attack paths

Time budget reference (10-day engagement)

Day Phase
1 Network + identity recon
2 Credential access (spray, coerce/relay)
3 BloodHound, kerberoast, ADCS
4 Lateral movement
5 Domain dominance
6 Cross-trust / multi-domain
7 Sensitive data hunt
8 Cleanup + verification
9-10 Report draft + review

OPSEC notes (NOT red-team-quiet)

  • Internal pentest is high-noise by design — clients want detection signal
  • Run BloodHound + Snaffler openly; document timestamp for SOC correlation
  • AVOID destructive techniques unless SOW permits: cme rb hash dumping on prod boxes can crash old systems
  • ALWAYS revert shadow-credentials writes (shadow-credentials) once cert is used
  • Document EVERY cleanup action: deleted scheduled tasks, removed ACL grants, reverted KeyCredentialLink writes
  • If you create an account / add to group / register a device, log it for cleanup
  • Do not exfil data: take screenshots, list filenames, note byte count — never copy real customer data off-site

Common mistakes consultants make

  • Spraying without checking lockout policy → locking out 500 accounts at 4 AM
  • Running responder in poisoning mode without ntlmrelayx ready → log noise without captures
  • BloodHound collection from a workstation, not a control box → triggers EDR’s LDAP-query anomaly
  • Forgetting to filter BloodHound output to in-scope OUs in multi-OU environments
  • Reporting “Domain Admin obtained” without showing impact (data, persistence, blast radius)

References

See also: pentest-engagement-execution, pentest-proposal-and-scoping, pentest-report-writing-deep, web-app-pentest-methodology, osep-ad-attack-chain-walkthrough, ad-recon-low-noise, lateral-movement-playbook, bloodhound, certipy-toolkit-deep, ad-coercion-and-relay-matrix-2025, defender-for-identity-evasion