Pathfinder Map — Windows, Linux, Ports & Web Vulns

Click node to open · coral selected · blue parent · green child

85%

Windows

AD / Windows workflow

Starting Point

Branch

Nmap network scan

Starting Point

Find hostnames & domain name

Starting Point

Initial access provided

Starting Point

Bloodhound Scan

Branch

Setup Bloodhound and bloodhound-python

Bloodhound Scan

Collect data using bloodhound-python

Bloodhound Scan

Start bloodhound and upload JSON files

Bloodhound Scan

Look for shortest path to DC

Bloodhound Scan

Access shell

Branch

If port 5985 open — evil-winrm

Access shell

If port 445 open — impacket-psexec

Access shell

Enumerate User

Branch

whoami

Enumerate User

Check if user is in Admin group

Enumerate User

whoami /priv

Enumerate User

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege

whoami /priv

Using PrintSpoofer

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege

Using GodPotato

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege

SeBackupPrivilege

whoami /priv

SeShutdownPrivilege

whoami /priv

SeRestorePrivilege

whoami /priv

SeTakeOwnershipPrivilege

whoami /priv

SeDebugPrivilege

whoami /priv

SeDebug → psgetsys (SYSTEM)

SeDebugPrivilege

SeDebug → Mimikatz

SeDebugPrivilege

SeDebug → comsvcs LSASS dump

SeDebugPrivilege

SeLoadDriverPrivilege

whoami /priv

SeManageVolumePrivilege

whoami /priv

Store usernames for future enum

Enumerate User

View all files and folders

Enumerate User

Search file contents

Enumerate User

Check internal ports/IPs

Enumerate User

Get service name

Enumerate User

Check running processes

Enumerate User

Check services

Enumerate User

Check scheduled services

Enumerate User

Find specific files

Enumerate User

Check non-Windows programs

Enumerate User

Look for .ini files

Enumerate User

Run winPEAS

Enumerate User

Get netcat

Enumerate User

Look at webfiles

Enumerate User

Enumerate Admin

Branch

Execute Mimikatz

Enumerate Admin

Execute nxc dumps

Enumerate Admin

Enumerate files/folders of all users

Enumerate Admin

On same shell — Invoke-Command

Branch

Reverse shell payload

Branch

Pivoting — ligolo

Branch

Discover more

Branch

Usernames — lookupsid

Discover more

(Spray) credentials

Discover more

Check permission of the user

Branch

GenericAll

Check permission of the user

ForceChangePassword

Check permission of the user

GenericWrite / Kerberoasting

Check permission of the user

Transfer files

Branch

Use RottenPotato with meterpreter

Branch

From other enumeration

Branch

User Enumeration After New Access / Lateral Movement

Branch

Pass-the-Hash (PtH)

Lateral Movement

Get accounts with SPN

User Enumeration After New Access / Lateral Movement

Get AS-REP hash

User Enumeration After New Access / Lateral Movement

Persistence / post admin access

Branch

Create local admin user

Persistence / post admin access

Enable RDP

Persistence / post admin access

Connect to RDP

Persistence / post admin access

Turn off firewall

Persistence / post admin access

File Transfer (Windows)

Basics

enum4linux-ng / NetBIOS

Information Gathering

GPP passwords

Password Attacks

Kerbrute

Password Attacks

AD CS / Certipy

Post Exploitation

Shadow Credentials

Post Exploitation

Rubeus

Kerberos

Seatbelt / PrivescCheck / JAWS

Windows enum

powercat / RunasCs

Shell helpers

Local Privilege Escalation

Branch — user → admin/SYSTEM

Unquoted service path

Local Privilege Escalation

Modifiable service / weak DACL

Local Privilege Escalation

AlwaysInstallElevated

Local Privilege Escalation

Writable scheduled task

Local Privilege Escalation

Stored credentials (cmdkey / vault)

Local Privilege Escalation

AutoLogon registry creds

Local Privilege Escalation

DLL hijack / PATH interception

Local Privilege Escalation

Kernel exploit (Windows CVE)

Local Privilege Escalation

UAC bypass (medium → high integrity)

Local Privilege Escalation

HiveNightmare (CVE-2021-36934)

Local Privilege Escalation

SMB / NFS misconfig (Windows)

Recon + LPE

PrintNightmare (CVE-2021-1675 / 34527)

Local Privilege Escalation

JuicyPotato / RoguePotato

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege

SweetPotato / EfsPotato

Local Privilege Escalation

PowerUp.ps1 quick wins

Local Privilege Escalation

Got admin / SYSTEM — post LPE

Local Privilege Escalation

AV / EDR Evasion

Branch — post-shell tradecraft

AMSI & ETW bypass

AV / EDR Evasion

C# in-memory loader

AV / EDR Evasion

Process injection & syscalls

AV / EDR Evasion

AppLocker / WDAC bypass

AV / EDR Evasion

Client-side initial access

AV / EDR Evasion

DCSync & Golden Ticket

Domain dominance

RBCD & delegation abuse

Domain dominance

C2 frameworks & SOCKS

AV / EDR Evasion

Binary Exploit Development

Branch — Windows binary exploitation

Debuggers & pattern

Binary Exploit Development

Stack overflow (32-bit)

Binary Exploit Development

SEH overwrite

Binary Exploit Development

Egghunter

Binary Exploit Development

DEP / ROP (VirtualProtect)

Binary Exploit Development

Bad chars & encoders

Binary Exploit Development

WinDbg deep debug

Binary Exploit Development

Kernel exploitation

Binary Exploit Development

Toolkit install

Binary Exploit Development

Stack overflow (64-bit)

Binary Exploit Development

Static analysis

Binary Exploit Development

Optional — Metasploit workflow

Binary Exploit Development

Format string

Binary Exploit Development

pwntools exploit script

Binary Exploit Development

ASLR bypass

Binary Exploit Development

Heap overview

Binary Exploit Development

Fuzz & crash

Binary Exploit Development

LFH / segment heap

Binary Exploit Development

UAF / type confusion

Binary Exploit Development

CFG bypass

Binary Exploit Development

Lookaside / fast allocation

Binary Exploit Development

Advanced tradecraft

Branch — APT-documented techniques

Pass-the-Ticket (PtT)

Advanced tradecraft

NTLM relay

Advanced tradecraft

Coercer / PetitPotam

Advanced tradecraft

AD CS — ESC abuse

Advanced tradecraft

DCShadow

Advanced tradecraft

Unconstrained delegation

Advanced tradecraft

Golden SAML

Advanced tradecraft

LSASS protection bypass

Advanced tradecraft

Direct syscalls

Advanced tradecraft

EDR unhooking

Advanced tradecraft

Process hollowing

Advanced tradecraft

Module stomping

Advanced tradecraft

DLL sideload / search order

Advanced tradecraft

COM hijack persistence

Advanced tradecraft

WMI event subscription

Advanced tradecraft

EternalBlue (MS17-010)

Advanced tradecraft

Early bird / APC injection

Advanced tradecraft

Silver Ticket

Advanced tradecraft

Skeleton Key

Advanced tradecraft

Token impersonation

Advanced tradecraft

0-day discovery workflow

Advanced tradecraft

Exploit weaponization

Advanced tradecraft

Constrained delegation

Advanced tradecraft

Relay prep & signing check

NTLM relay chain

Responder (hash capture)

NTLM relay chain

ntlmrelayx listener

NTLM relay chain

Relay → AD CS (ESC8)

NTLM relay chain

mitm6 + IPv6 relay

NTLM relay chain

PetitPotam (EFSR)

Coercer chain

PrinterBug / SpoolSample

Coercer chain

DFSCoerce / Shadow Coerce

Coercer chain

Coercer (multi-method)

Coercer chain

Pool overflow

Binary Exploit Development

User-mode pool overflow

Pool overflow

Kernel pool overflow

Pool overflow

Pool grooming (feng shui)

Pool overflow

hashcat / john (Windows hashes)

Password Attacks

Recon (by tool)

Branch — start here

Nmap

Recon (by tool)

RustScan

Recon (by tool)

Masscan

Recon (by tool)

AutoRecon

Recon (by tool)

NetExec (nxc)

Recon (by tool)

ldapsearch

Recon (by tool)

windapsearch

Recon (by tool)

rpcclient

Recon (by tool)

smbmap / smbclient

Recon (by tool)

enum4linux-ng

Recon (by tool)

PowerView

Recon (by tool)

Impacket enum

Recon (by tool)

ADRecon

Recon (by tool)

PingCastle

Recon (by tool)

AD ACL / ACE abuse

ired.team

DnsAdmins → SYSTEM

ired.team

AdminSDHolder backdoor

ired.team

noPac / SamAccountName

CVE-2021-42278/42287

Zerologon

CVE-2020-1472

Parent/Child trust EA

ired.team

PrinterBug coerce

MS-RPRN

Ports → vuln map

Branch — AD / Windows services

Port 445 — SMB

Ports → vuln map

Port 5985 — WinRM

Ports → vuln map

Port 3389 — RDP

Ports → vuln map

Port 88 — Kerberos

Ports → vuln map

Port 389 — LDAP

Ports → vuln map

Port 80/443 — IIS / HTTP

Ports → vuln map

Port 1433 — MSSQL

Ports → vuln map

Responder

Recon (by tool)

BloodHound / SharpHound

Recon (by tool)

Kerbrute

Recon (by tool)

Lab runbooks (Windows)

Step-by-step workflows

Box methodology

Lab runbooks (Windows)

Advanced Windows ops

runbooks (Windows)

Windows BOF development track

runbooks (Windows)

Kernel & advanced exploit track

runbooks (Windows)

Environment setup

Box methodology

Recon

Box methodology

Foothold

Box methodology

Stabilize shell

Box methodology

Windows privesc

Box methodology

AD environment

Box methodology

Buffer overflow box

Box methodology

Proof & handoff

Box methodology

Client-side initial access

Advanced Windows ops

AV / AMSI / ETW / AppLocker

Advanced Windows ops

Process injection

Advanced Windows ops

C2 operations

Advanced Windows ops

Advanced AD attack chains

Advanced Windows ops

Lateral movement (ops)

Advanced Windows ops

PS credential encrypt/decrypt

Advanced Windows ops / batch automation

Static RE (pre-fuzz)

Windows BOF development track

Fuzz to crash

Windows BOF development track

Stack overflow path

Windows BOF development track

SEH overflow path

Windows BOF development track

DEP / ROP path

Windows BOF development track

Driver RE & IOCTL map

Kernel & advanced exploit track

Kernel debugging setup

Kernel & advanced exploit track

Pool / heap exploitation

Kernel & advanced exploit track

Fuzzing at scale

Kernel & advanced exploit track

Windows tool index

Box methodology

AD 1 — Domain enum (no creds)

AD environment

AD 2 — AS-REP roasting

AD environment

AD 3 — Password spray (safe)

AD environment

AD 4 — BloodHound path

AD environment

AD 5 — Kerberoasting

AD environment

AD 6 — ACL abuse

AD environment

AD 7 — Lateral movement

AD environment

AD 8 — High-value targets

AD environment

AD 9 — DCSync / DA proof

AD environment

AD 10 — Finish AD set

AD environment

mona.py command reference

Buffer overflow box

Lab tools (Windows track)

Copy-paste cheat sheets

Stuck? Decision tree

Box methodology

Hydra (Windows services)

tools (Windows track)

Chisel (pivot / tunnel)

tools (Windows track)

Proxychains

tools (Windows track)

Searchsploit

tools (Windows track)

Metasploit quick reference

tools (Windows track)

Impacket secretsdump

tools (Windows track)

xfreerdp

tools (Windows track)

SNMPwalk

tools (Windows track)

Netcat listener

tools (Windows track)

Certutil / file transfer

tools (Windows track)

Impacket psexec / wmiexec

tools (Windows track)

Hashcat mode reference

tools (Windows track)

Responder + ntlmrelayx (full chain)

tools (Windows track)

Exploit Development Labs

Windows pathfinder

Stack overflow (Windows)

Exploit Development Labs

Heap / pool (Windows)

Exploit Development Labs

Kernel / driver / rootkit

Exploit Development Labs

Exploitation framework

Exploit Development Labs