Windows network protocols: SMB, Kerberos, NTLM, LDAP, RDP
You decode the protocols of corporate Windows networks in traffic and detect the packet traces of lateral movement and credential abuse.
Level 301 · 15 lessons · 12 practice labs
Lessons
File sharing
- SMB2/3 sessions: negotiate, session setup, tree connect
- Reading, writing and deleting files over SMB
- How SMB signing and encryption look in traffic
- Short task: list the files copied from a share
Authentication
- The NTLM three-message exchange and its weaknesses
- Kerberos: AS, TGS and AP exchanges
- Kerberos anomalies: RC4 ticket requests and bulk TGS
- LDAP queries: seeing directory discovery in traffic
- Short task: find the client that requested many service tickets in a short time
Remote administration and lateral movement
- DCE/RPC and the endpoint mapper: which service is being called
- Traces of remote service creation and scheduled tasks
- WinRM and PowerShell remoting traffic
- RDP connections: handshake, NLA and session length
- Short task: order the admin connections spreading from one host in time
- Capstone: prove a lateral movement chain in a domain with packets
Practice labs
- Order the steps of an SMB session: Show the negotiate, session setup and tree connect steps of an SMB2 session with packet numbers.
- List the files copied from a share: Work out which files were copied and their sizes from SMB read operations.
- Audit signing and encryption: Classify the SMB sessions in a capture as signed, unsigned and encrypted and report the servers left unsigned.
- Find the three NTLM messages: Show the negotiate, challenge and response messages of an NTLM authentication and write the user and domain name.
- Separate the Kerberos exchanges: Find the AS, TGS and AP exchanges in a logon and list the requested service names.
- The client requesting service tickets in bulk: In a lab domain capture find the client requesting many RC4 service tickets in a short time and write the detection criterion.
- Read LDAP queries: List the base name and filter of the LDAP search requests in a capture.
- See directory discovery in traffic: Find the broad LDAP queries pulling all users and groups and report the querying host.
- Which RPC service is being called: Extract the called interfaces from the endpoint mapper exchange and mark the remote service creation call.
- Extract RDP connections and durations: List the RDP sessions in a capture with source, target and duration.
- Recognise WinRM traffic: Find the remote management sessions on ports 5985 and 5986 and state which account used them.
- Order the spreading management connections: In the Lodoskaya Denizcilik lab domain, place the SMB, RPC and WinRM connections spreading from one host to others on a timeline.
About this course
You decode the protocols of corporate Windows networks in traffic and detect the packet traces of lateral movement and credential abuse.
What you will learn
- File sharing
- Authentication
- Remote administration and lateral movement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.