Red Teaming Tutorial: Scanning a Network to Find Local Admin Access

Summary

The presenter demonstrates a custom C#/.NET utility that uses the current user's token to find domain systems where they have local-admin access, then shows executing it through Sliver and using PsExec for lateral movement.

Key points

• The presenter describes an engagement scenario with access to a compromised workstation and a C2 beacon, but no credentials or Linux system; NXC could not be run in that environment.
• The custom utility uses the current user's token, queries domain computers, and checks which systems are online.
• It tests service-manager access and writable shares to identify systems where the account may have local-admin rights; the presenter says combining checks helps reduce false positives.
• The utility is written in C# for .NET Framework 4.7 and is run as an assembly through a C2 session. The presenter warns that asynchronous scanning can consume substantial resources in large environments.
• In the lab demonstration, the tool distinguishes an account without remote admin access from one with access, and the presenter notes a bug checking the machine where the tool is running.
• The presenter demonstrates using PsExec-style service execution to move to another system. An initial attempt failed; a service-specific payload then succeeded, though one attempt did not remove the service executable.

MITRE ATT&CK

Related Articles

• How to Detect Windows Attacks with Microsoft Defender ASR and Wazuhwazuh.comT1021.002 · T1569.002
• Impacket SMBExec: A Pentester’s Guide to Remote Windows Command Executionhackingarticles.inT1021.002 · T1569.002
• Arctic Wolf Details Qilin Intrusions Using CVE-2026-0257arcticwolf.comT1021.002 · T1569.002
• CloudSEK Details MexicanMafia-Linked Intrusion Campaign Targeting Latin American Organizationscloudsek.comT1021.002 · T1569.002
• Threat Actor Used Komari Monitoring Agent as a SYSTEM-Level Backdoor in VPN Intrusionhuntress.comT1021.002 · T1569.002