[LICH-SEC]
[リッチ-セク]
← Back|$cat /research/internal-network-exploits.txt

>> INTERNAL NETWORK EXPLOITS

Advanced techniques for lateral movement and exploitation within internal networks. Master SMB relay attacks, LLMNR/NBT-NS poisoning, Kerberoasting, pass-the-hash, token impersonation, and network segmentation bypasses. Complete attack chains from initial foothold to domain admin.

[TOPIC]

Domain Compromise Through Lateral Movement

During an Active Directory security assessment, we successfully compromised the domain through a chain of vulnerabilities involving Kerberoasting, password cracking, and privilege escalation. This write-up demonstrates how attackers can move from initial enumeration to full domain administrative rights through lateral movement techniques.

Published:2025.12
Severity:CRITICAL
Impact:Domain Administrative Access | 700+ User Credentials Compromised
KERBEROASTINGLATERAL_MOVEMENTDOMAIN_COMPROMISEPRIVILEGE_ESC
[CLICK TO VIEW] → Complete attack chain from Kerberoasting to Domain Admin
[TOPIC]

SAP Exploitation

During an internal penetration test, we identified and exploited weak credentials on SAP servers that led to partial domain compromise. This write-up demonstrates how attackers can use SAP infrastructure as a pivot point to escalate privileges and move laterally toward Domain Admin accounts.

Published:2025.12
Severity:CRITICAL
Impact:Partial Domain Compromise | High-Value SAP Servers (NRDASAP) | Cached Domain Credentials
SAP_EXPLOITATIONBRUTE_FORCECREDENTIAL_DUMPINGLATERAL_MOVEMENT
[CLICK TO VIEW] → SAP credential exploitation leading to domain compromise
[TOPIC]

Zero Logon Exploitation

During a security assessment, we identified and exploited the ZeroLogon vulnerability (CVE-2020-1472) on a Domain Controller, resulting in complete domain compromise. This write-up demonstrates how this critical authentication bypass vulnerability allows attackers to gain administrative access to domain controllers without valid credentials.

Published:2025.12
CVE:CVE-2020-1472
Severity:CRITICAL
Impact:Domain Controller Compromised | Enterprise Administrator Access | Persistent Backdoor
ZERO_LOGONAUTH_BYPASSDOMAIN_CONTROLLERENTERPRISE_ADMIN
[CLICK TO VIEW] → ZeroLogon exploitation leading to complete domain compromise