
You have obtained a set of credentials during an engagement. Plan how to maximize their value across the environment.

**Credential Validation**
- How do you quickly validate credentials against multiple services without triggering lockouts?
- What is the difference between password spraying and credential stuffing?
- How do you estimate the lockout threshold of a target before spraying?

**Reuse Targeting**
- Which services should you test discovered credentials against? (SMB, WinRM, SSH, RDP, MSSQL, web portals, VPN)
- How do you prioritize which users to spray first?
- What does a pattern of "same password across multiple accounts" tell you about the organization's password policy?

**Hash Reuse (Pass-the-Hash)**
- What is Pass-the-Hash (PtH) and which protocols support it?
- If you have an NTLM hash but not the plaintext, where can you use it directly?
- What is the difference between PtH and Pass-the-Ticket?

**Spray Execution**
- How do you configure crackmapexec for a safe spray cadence?
- What output tells you a credential is valid vs the user exists vs lockout hit?
- How do you handle a domain with multiple OUs that have different lockout policies?

**Local Admin Reuse**
- Why is local administrator password reuse such a common lateral movement vector?
- What does crackmapexec `--local-auth` tell you about local admin password reuse across machines?

Output:
- Safe spraying cadence formula
- Per-service credential testing commands
- Credential reuse decision tree


Credential Reuse & Password Spraying


You have obtained shell access to a machine on an internal network segment that has access to additional subnets not reachable from your attack box.

Plan a systematic pivoting strategy:

**Situational Awareness**
- How do you map the network interfaces and routing table of your pivot host?
- How do you discover live hosts on adjacent network segments from your pivot?
- What information do ARP tables and /etc/hosts reveal?

**Pivot Technique Selection**
- What is SOCKS proxying and when is it better than port forwarding?
- How does SSH dynamic port forwarding work (`-D`) and what tool chains with it for proxychains?
- What is a reverse tunnel and when do you need one vs a bind tunnel?
- How do tools like Ligolo-ng, Chisel, and Metasploit's route differ in capability?

**Multi-Hop Pivoting**
- You are on Host A, which can reach Host B, which can reach Host C. How do you establish a path from your attack box to Host C?
- How do you maintain stable tunnels while working through multiple hops?
- What happens to your pivot if the intermediate host is rebooted or the connection drops?

**Traffic Routing**
- How do you configure proxychains to use your pivot?
- Which tools work well through SOCKS proxies and which do not?
- How do you handle UDP-based tools when tunneling through TCP-only proxies?

**Detection Avoidance**
- What network artifacts does a SOCKS tunnel generate?
- How does traffic routing through a pivot differ from native traffic in terms of detectability?

Output:
- Tool selection guide per scenario
- SSH pivot setup commands
- Ligolo-ng tunnel setup walkthrough
- Proxychains configuration example


Network Pivoting Strategy


You have a foothold on a Windows host and want to impersonate other users or escalate by abusing Windows token mechanics.

**Windows Token Fundamentals**
- What is the difference between a primary token and an impersonation token?
- What privilege levels are required to impersonate tokens? (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege)
- Which Windows service accounts have SeImpersonatePrivilege by default and why?

**Token Stealing**
- How do you list available tokens on a system using Incognito or Meterpreter?
- What does "impersonating" a Domain Admin token give you vs. "stealing" it?
- How do you use `CreateProcessWithTokenW` or `ImpersonateLoggedOnUser` to leverage a stolen token?

**Potato Attacks**
- What is the "Potato" family of attacks and what do they all exploit?
- When does PrintSpoofer apply vs Juicy Potato vs Sweet Potato?
- What Windows version and patch level affects which Potato variant works?

**Delegation Impersonation**
- How does S4U2Self allow a service to impersonate any domain user?
- When is this useful in lateral movement from a machine with constrained delegation?

**Practical Usage**
- On a Windows host where you have a service account with SeImpersonatePrivilege, walk through the full chain to SYSTEM
- How do you pass from a token on one host to a remote session on another host?

Output:
- Token abuse decision tree: which technique for which privilege level
- Step-by-step PrintSpoofer / SweetPotato chain
- Detection signatures defenders look for


Token & Privilege Impersonation


You have valid credentials for a remote Windows host and need to execute commands on it. Compare and reason about the available remote execution techniques.

**Technique Comparison**
- How does PSExec work at the Windows service level and what artifacts does it leave?
- How does WMI remote execution work and how does it differ from PSExec in terms of detection?
- What is WinRM / PowerShell Remoting and what are its prerequisites?
- What is DCOM lateral movement and why is it useful for bypassing certain defenses?

**Artifact Analysis**
| Technique | Service Created? | Network Share Used? | Event Log? | Registry? |
- Fill this matrix for: PSExec, WMI, WinRM, DCOM, SMB + scheduled task

**Choosing the Right Technique**
- When would you prefer WMI over PSExec?
- When does WinRM give you capabilities that WMI cannot?
- In an EDR-heavy environment, which technique generates the least telemetry?
- What happens if port 445 is blocked but 5985 is open?

**LOLBins for Remote Execution**
- How does `at.exe` and `schtasks.exe` enable remote code execution?
- How can `wmic.exe` be used for lateral movement and why is it monitored?
- What native Windows binary can you use to copy and execute files remotely without PSExec?

**Operational Cleanliness**
- How do you remove artifacts after successful lateral movement?
- Which techniques require manual cleanup vs clean themselves up?

Output:
- Technique selection matrix with detection risk ratings
- CrackMapExec commands for each technique
- Impacket suite commands for each technique


Lateral Movement

Credential Reuse & Password Spraying

Network Pivoting Strategy

Token & Privilege Impersonation

WMI, PSExec & Remote Execution Techniques