CoreQ Academy4.4 Given a scenario, perform host-based attacks using the appropriate tools.
Once on a host, testers look for ways to gain higher privileges, harvest credentials and avoid defences, demonstrating what a real intruder could do.
Attack types
- Privilege escalation
- Gaining admin or root from a standard account via misconfigurations or vulnerabilities.
- Credential dumping
- Extracting credentials from memory (LSASS), SAM or config files. Defence: Credential Guard, LSA protection, EDR.
- Circumventing security tools
- Evading or disabling AV/EDR; testing whether defences detect tampering.
- Misconfigured endpoints
- Weak permissions, writable services, stored credentials.
- Payload obfuscation
- Encoding or packing payloads to evade signatures.
- User-controlled access bypass
- Bypassing controls users can influence, such as UAC prompts.
- Shell escape
- Breaking out of a restricted shell into a full one.
- Kiosk escape
- Breaking out of a locked-down kiosk app to the underlying OS.
- Library injection
- Forcing a process to load a malicious DLL or shared library (e.g. DLL search-order hijacking).
- Process hollowing and injection
- Running code inside a legitimate process to hide it.
- Log tampering
- Clearing or altering logs; tests whether log forwarding and alerts catch it.
- Unquoted service path injection
- A Windows service path with spaces and no quotes lets a writable earlier path run an attacker binary as SYSTEM. Defence: quote paths, fix permissions.
Tools
- Mimikatz
- Extracts credentials, hashes and Kerberos tickets from Windows memory.
- Rubeus
- Kerberos abuse toolkit (ticket requests, roasting, pass-the-ticket).
- Certify
- Finds and abuses misconfigured AD Certificate Services templates.
- Seatbelt
- Host survey tool that collects security-relevant configuration.
- PowerShell/PowerShell Integrated Scripting Environment (ISE)
- Scripting for enumeration and automation on Windows hosts.
- PsExec
- Sysinternals tool for remote command execution.
- Evil-WinRM
- Interactive WinRM shell for testers with valid credentials.
- Living off the land binaries (LOLbins)
- Built-in, signed OS tools (certutil, rundll32, mshta) abused to blend in. Defence: application control and behaviour monitoring.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.4 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.