A Pentester’s Voyage – The First Few Hours

This blog post walks through an internal penetration test demonstrating rapid credential theft and lateral-movement techniques (LLMNR/NBNS poisoning, NTLM relaying, exposed Cisco Smart Install with Type 7 passwords) and documents findings, detection methods (event ID 4624 and a SIGMA rule), and defensive recommendations such as enforcing SMB signing, disabling vulnerable services, patching, and improved logging/segmentation.