NetExec Walkthrough Demonstrates Active Directory Lab Compromise and Defenses
Summary
A hands-on NetExec tutorial walks through compromising a Windows Server 2019 Active Directory lab from low-privileged credentials to domain control and SYSTEM on an MSSQL host, then maps the chain to hardening and detection measures.
Key points
- The lab walkthrough uses NetExec and BloodHound to enumerate users, groups, privileges, and Active Directory attack paths.
- It demonstrates credential harvesting from PowerShell history and LSASS, plus Backup Operators abuse to dump NTDS and obtain domain hashes.
- The tutorial shows ForceChangePassword abuse and a pivot from MSSQL impersonation to sa, xp_cmdshell execution, and SYSTEM via PrintSpoofer.
- Defensive recommendations include LDAP signing, privileged-group and ACL hygiene, LSA Protection, Credential Guard, SMB and WinRM restrictions, and disabling xp_cmdshell.
- Suggested monitoring includes alerts for bulk LDAP collection, DCSync activity, privilege changes, and PrintSpoofer indicators.
Article Details
- Topic
- NetExec-based Active Directory penetration testing in a lab, demonstrating enumeration, credential access, privilege escalation, lateral movement, and defensive mitigations.
MITRE ATT&CK
T1003.001 · LSASS MemoryLSASSY remotely dumps LSASS memory to extract Kerberos tickets, NTLM hashes, and cached credentials.T1003.002 · Security Account ManagerThe Backup Operators abuse workflow saves and parses SAM, SYSTEM, and SECURITY registry hives to extract credentials.T1003.003 · NTDSThe Backup Operators workflow dumps NTDS.dit and retrieves domain account hashes.T1021.001 · Remote Desktop ProtocolNetExec enables Remote Desktop on the domain controller, followed by an rdesktop connection.T1021.006 · Windows Remote ManagementThe walkthrough uses a WinRM password spray and describes using the successful account for remote management access.T1059.003 · Windows Command ShellThe SQL Server xp_cmdshell procedure is enabled and used to execute a Windows command.T1069.002 · Domain GroupsThe walkthrough enumerates Active Directory group memberships, including Backup Operators and Remote Management Users.T1087.002 · Domain AccountNetExec is used to enumerate domain user accounts through LDAP.T1110.003 · Password SprayingNetExec attempts the same password against a list of domain users over WinRM.T1134.001 · Token Impersonation/TheftPrintSpoofer is used to abuse SeImpersonatePrivilege and obtain a SYSTEM shell.
Products
Microsoft Active DirectoryIf you are chasing the OSCP, the Active Directory set is the section that decides your fate.SQL ServerThe domain ignite.local is hosted on a Windows Server 2019 domain controller at 192.168.1.9, with an additional Windows host at 192.168.1.7 running Microsoft SQL Server.Windows Server 2019This walkthrough shows an end-to-end compromise of the ignite.local Windows Server 2019 domain controller, starting from one low-privileged credential and ending with krbtgt, full domain control, and SYSTEM on an MSSQL
Tools
BloodHoundIt uses NetExec, BloodHound, LSASSY, Backup Operators abuse, ForceChangePassword, xp_cmdshell, and PrintSpoofer to map each step of the attack chain and pair it with defenses.lsassyIt uses NetExec, BloodHound, LSASSY, Backup Operators abuse, ForceChangePassword, xp_cmdshell, and PrintSpoofer to map each step of the attack chain and pair it with defenses.NetExecIt uses NetExec, BloodHound, LSASSY, Backup Operators abuse, ForceChangePassword, xp_cmdshell, and PrintSpoofer to map each step of the attack chain and pair it with defenses.PrintSpooferIt uses NetExec, BloodHound, LSASSY, Backup Operators abuse, ForceChangePassword, xp_cmdshell, and PrintSpoofer to map each step of the attack chain and pair it with defenses.rdesktopAttacker — Kali Linux with NetExec, BloodHound, rdesktop, and Impacket installed.