CRASH COURSE // PERSONAL PATH

What a CPU, RAM, and disk actually do. What a process is and why attackers care. What the Windows API is and why it's the attacker's toolkit. How to set up every tool.

What the mentor means: "Eventually all comes to networking." Every attack, every payload, every C2 beacon — it all rides on TCP/IP. If you don't understand sockets, ports, byte order, and how data actually moves across a wire, you're just copy-pasting commands you don't understand.

What to do: Build a raw TCP client/server in C. No libraries. Just Winsock2 on Windows, sys/socket.h on Linux. Understand why connect() is the victim reaching OUT. Understand why bind() vs listen() vs accept() matters for attacker vs victim perspective. Learn htons/htonl because IP addresses and ports must be in network byte order.

Key concept: STDIN/STDOUT/STDERR redirection over a socket — this is how reverse shells actually work. Replace all 3 file descriptors with the socket handle, and suddenly cmd.exe thinks it's talking to a terminal when it's talking to your listener.

mentor: "Linux terminal is way easier, it's almost like English." Set up bashrc aliases. Learn sudo. This is the base layer.

Week 1: Socket programming + reverse shells → Deliverable: Working C reverse shell (Windows + Linux)
Week 2: OpenSSH persistence + VNC → Deliverable: .42 with SSH + VNC, documented
Week 3: PowerShell remoting + AMSI bypass → Deliverable: Lateral movement lab, obfuscated scripts
Week 4: AD advanced (BloodHound, DCSync, tickets) → Deliverable: AD lab attack path report
Week 5: Linux privilege escalation → Deliverable: 10 THM boxes completed
Week 6: Cloud persistence (AWS, Azure) → Deliverable: Cloud-based C2 proof of concept
Week 7: EDR deep-dive → Deliverable: Research paper: "EDR evasion beyond HWBP"
Week 8: iOS + Flutter → Deliverable: Jailbreak persistence, Flutter RE report

What the mentor means: "You should have your notes organized with commands, you shouldn't memorize." Recon isn't about running tools — it's about knowing what to look for and having the commands at your fingertips. Build cheat sheets. Dump commands you need. Evaluate and add to readme.

What to do: Start with Windows recon framework. WMI enumeration for system info. AD discovery for domain context. Privilege audit for attack paths. The mentor's approach: dump the output, evaluate what matters, organize by category.

Key concept: Recon is iterative. First pass: what OS, what patches, what users. Second pass: what services, what permissions, what misconfigurations. Third pass: what can I exploit right now. Document each pass.

mentor: "Why use script for it? Why not just dump commands you need. Take that, evaluate and add to readme."

What the mentor means: "PowerShell and cmd yes, Linux terminal way easier." Windows is the target, Linux is the tool. But you need both. PowerShell is the native Windows automation engine — if you can't use it, you can't operate on Windows effectively.

What to do: Learn execution policies (and how to bypass them). Learn AMSI (and how to bypass it). Learn remoting via WinRM for lateral movement. The mentor's approach: send commands to PowerShell, don't just type them manually. Automate everything.

Key concept: PowerShell without powershell.exe — use dotnet, msbuild, installutil. These are LOLBAS (Living Off The Land Binaries and Scripts) techniques. The defender watches powershell.exe. They don't watch msbuild.exe loading a .csproj that contains PowerShell code.

mentor: "Send this to PowerShell." Automate. Script. Don't do manually what you can do programmatically.

C, Python, PowerShell fundamentals. No prior coding required. Build tools from scratch — don't just use them.

Position-independent code, syscalls, encoding. Build payloads from scratch. Understanding how the chain starts.

Volatility, memory dumps, injected code detection. Find the needle in the haystack. Understand how defenders catch you.

Windows registry deep-dive. Persistence locations, forensic artifacts, hidden keys. Where the chain hides.

What the mentor means: "Privilege escalation is easy. On Linux it's so fucking easy. Also on Windows is easy." It's not about 0days. It's about misconfigurations — what the admin fucked up. Weak service permissions, unquoted paths, missing patches, token abuse. The system is already broken; you just need to find where.

What to do: Run automated enumeration first — PowerUp, WinPEAS, PrivescCheck. These find the holes automatically. Then verify manually. The mentor's approach: automated enum → manual verification → exploit → save the rung.

Key concept: Privilege escalation is a ladder, not a single jump. User → Admin → SYSTEM. At each level, install persistence so you never lose ground. The mentor: "You get initial access as user, you install persistence to save that. You privilege escalated to admin, you install persistence as admin, to save that. You got to system, you install persistence as system to save that."

Live evidence: WUPC .42 (192.168.1.42) — SeImpersonatePrivilege ENABLED. HealthSecurityHost service with Authenticated Users:(M) permissions. SYSTEM in one service restart. Verified via SSH, documented in KILL_CHAIN_LAB_EVIDENCE.md.

Dropper architecture, payload delivery, execution methods. Build IRON-DOME from scratch. WARNING: Last tested 2026-06-23 (6 days ago). Probably detected now. Re-test before use.

DLL injection, process hollowing, APC injection. Get your code into another process. The chain's delivery mechanism.

What the mentor means: "Save every rung." You don't just escalate privileges and move on. You cement each level so you never lose ground. User persistence (registry Run key). Admin persistence (scheduled task or service). SYSTEM persistence (WMI event subscription or boot execute). If you lose one shell, you have three backups at different privilege levels.

What to do: Install multiple persistence mechanisms at each level. Registry Run keys for user-level. Services or scheduled tasks for admin-level. WMI event subscriptions or boot execute for SYSTEM-level. The mentor's approach: SSH server + VNC + registry + service + WMI = five ways back in.

Key concept: Persistence is insurance. The mentor: "I establish persistence with SSH... then I install VNC." Legitimate services (OpenSSH server) are hard to detect because they're supposed to be there. Add-WindowsCapability -Online -Name OpenSSH.Server — this is a built-in Windows feature, not a hack.

Live evidence: WUPC .42 verified: User HKCU Run key → Admin service hijack → SYSTEM service install. All three rungs cemented. Documented in KILL_CHAIN_LAB_EVIDENCE.md.

Verify your evasion. Test against live AV. Document results honestly. Build GeoDefend. Rule: Assume everything is detected. Test against latest AV, not last week's.

Bypass CrowdStrike, SentinelOne, Carbon Black. Kernel callbacks, ETW, AM-PPL. MSRC VULN-195458: HWBP bypass disclosed. May be patched. Research only.

Steganography, covert channels, dead drops. Hide data in plain sight. Ghost-Encoder. Zero-width Unicode — still viable, needs re-test.

Pass-the-Hash, WMI, PSExec, RDP hijacking. Move through the network. The chain's expansion phase.

What the mentor means: "Reverse shell is the basic for everything." Even if you find a massive bug or vulnerability, you still need to push your reverse shell payload to make it work. The reverse shell is the bridge between your machine and the target. Without it, your exploit is just a crash.

What to do: Build a C2 from scratch. Not a tool — understand every component. The beacon (client on target). The listener (server on your machine). The protocol (how they talk). The encryption (so defenders can't read the traffic). The jitter (random sleep intervals so the traffic doesn't look mechanical). The mentor's approach: build it, test it, burn it, build it better.

Key concept: C2 is not just a connection — it's a control system. You need: initial beacon, command execution, file upload/download, screenshot, persistence check, and a kill switch. The mentor: "Why use script for it? Build it yourself." Understanding every byte that crosses the wire.

Warning: cheyanne commit 5057de3 said "EVADED KAV" — but that was 2026-06-23 (6 days ago). Probably detected now. Kaspersky updates daily. Re-test before claiming evasion.

What the mentor means: "Real attacks are carried remotely." Physical network attacks (WiFi, BadUSB, monitor mode) are niche. The money is in remote access: phishing, RDP, VPN, web shells, C2. You don't need to be in the building. You need to be in the inbox.

What to do: Learn initial access vectors. Phishing with malicious attachments (Office macros, PDF exploits, ISO files). Credential stuffing with leaked databases. RDP compromise with weak passwords or NLA bypass. VPN exploitation with known CVEs (Fortinet, Pulse Secure). Web shell deployment on IIS, Apache, Tomcat. The mentor's approach: find the weakest remote entry point, not the strongest physical one.

Key concept: The human is the weakest link, but the network is the widest attack surface. The mentor: "You only need [WiFi/monitor mode] for physical network attacks. Real attacks are being carried remotely." Focus on what works at scale: email, credentials, remote services.

Practical: Build a phishing payload. Not a fake login page — a real malicious document that executes code when opened. Test it in a VM. Document what AV catches and what it misses. This is how you learn what works.

StarKiller RAT in Kotlin. GPS, SMS, camera, Play Protect bypass. Mobile attack surface. The chain's mobile link.

Kerberoasting, DCSync, Golden Ticket, ACL abuse. The crown jewels. The chain's enterprise target.

Recon → Weaponize → Deliver → Exploit → Install → C2 → Action on Objectives. Put it all together. The chain complete.

Build an automated defensive platform. Detect the techniques you learned. Blue team perspective. Understanding both sides of the chain.

Dollar impact of every technique. Board-ready language. Risk quantification. Compliance mapping. Translate the chain into business value.

What the mentor means: "Reverse shell is the basic for everything because even if you will find a massive bug or vulnerability, you will still need to push your reverse shell payload to make it work." The exploit gets you execution. The reverse shell gets you control. Without the shell, your exploit is just a crash report.

What to do: Build a reverse shell in C for both Windows (Winsock2) and Linux (sys/socket.h). Understand every function: socket(), connect(), dup2(), execve() / CreateProcess(). The mentor's approach: don't use a tool, build the tool. When you understand every byte, you can modify it, obfuscate it, and evade detection.

Key concept: The reverse shell is the bridge. The victim connects OUT to you (reverse) rather than you connecting IN to the victim (bind). This bypasses firewalls because outbound connections are usually allowed. The mentor: "connect = victim reaches OUT" — this is why reverse shells work when bind shells fail.

What the mentor means: "You should have your notes organized with commands, you shouldn't memorize." The brain is for understanding, not for storage. Storage is what files are for. Build cheat sheets, organized by category, searchable, with examples.

What to do: Create structured notes: Networking, Recon, Privesc, Persistence, Evasion, C2. Under each: commands, what they do, when to use them, example output. The mentor's approach: dump commands, evaluate, add to readme. Don't memorize — organize.

Key concept: When you're in an engagement, you don't have time to remember. You need to find. A well-organized cheat sheet lets you copy-paste and modify in seconds. The mentor: "Take that, evaluate and add to readme." Continuous improvement of your personal knowledge base.

What the mentor means: "On Linux it's so fucking easy. Also on Windows is easy." It's not about 0days. It's about misconfigurations — what the admin fucked up. Weak service permissions, unquoted paths, missing patches, token abuse. The system is already broken; you just need to find where.

What to do: Run automated enumeration first — PowerUp, WinPEAS, PrivescCheck. These find the holes automatically. Then verify manually. The mentor's approach: automated enum → manual verification → exploit → save the rung. Don't look for fancy 0days. Look for what the admin forgot to patch.

Key concept: Privilege escalation is a ladder, not a single jump. User → Admin → SYSTEM. At each level, install persistence so you never lose ground. The mentor: "I have a 0day that you just paste to the fucken terminal and it gives you root." But even without 0days, misconfigurations are everywhere.

What the mentor means: "You get initial access as user, you install persistence to save that. You privilege escalated to admin, you install persistence as admin, to save that. You got to system, you install persistence as system to save that." Each level of access is fragile. Persistence makes it permanent.

What to do: At each privilege level, install multiple persistence mechanisms. User: registry Run keys, scheduled tasks, startup folders. Admin: services, scheduled tasks with SYSTEM privileges, WMI events. SYSTEM: boot execute, kernel drivers, firmware. The mentor's approach: SSH server + VNC + registry + service + WMI = five ways back in.

Key concept: Persistence is insurance. If you lose one shell, you have three backups at different privilege levels. The mentor: "I establish persistence with SSH... then I install VNC." Legitimate services (OpenSSH server) are hard to detect because they're supposed to be there. Add-WindowsCapability -Online -Name OpenSSH.Server — this is a built-in Windows feature, not a hack.

What the mentor means: "You only need [WiFi/monitor mode] for physical network attacks. Real attacks are being carried remotely." Physical network attacks (WiFi, BadUSB, monitor mode) are niche. The money is in remote access: phishing, RDP, VPN, web shells, C2. You don't need to be in the building. You need to be in the inbox.

What to do: Learn initial access vectors. Phishing with malicious attachments (Office macros, PDF exploits, ISO files). Credential stuffing with leaked databases. RDP compromise with weak passwords or NLA bypass. VPN exploitation with known CVEs (Fortinet, Pulse Secure). Web shell deployment on IIS, Apache, Tomcat. The mentor's approach: find the weakest remote entry point, not the strongest physical one.

Key concept: The human is the weakest link, but the network is the widest attack surface. The mentor: "Real attacks are carried remotely." Focus on what works at scale: email, credentials, remote services. Physical attacks require proximity. Remote attacks require an internet connection.

What the mentor means: Full arsenal of AV evasion techniques. Not just "disable Defender" — that's noisy. Learn exclusions (silent), disabling (moderate), destructive removal (nuclear), and cleanup (covering tracks). Each has a time and place.

What to do: Learn the full spectrum: Add-MpPreference -ExclusionPath (silent, works even with tamper protection). Set-MpPreference -DisableRealtimeMonitoring $true (moderate, visible in logs). Uninstall-WindowsFeature Windows-Defender (nuclear, requires reboot). Event log clearing after the fact (cleanup, but also a detection signal). The mentor's approach: use the least destructive method that achieves the goal.

Key concept: AV is not an impenetrable wall. It's a speed bump. The mentor worked for Elastic (an AV company). He knows how defenders think. "I used to work for anti-virus companies." He knows the blind spots because he built the eyes.

What the mentor means: PowerShell execution policies, Explorer settings, Defender checks — these are the configuration details that make or break an operation. You need to know how to check and modify system settings programmatically.

What to do: Learn to check execution policy (Get-ExecutionPolicy), modify it (Set-ExecutionPolicy Unrestricted), check Defender status (Get-MpComputerStatus), and modify Explorer settings (Show hidden files, show extensions). The mentor's approach: script everything. Don't click through GUIs when you can type one command.

Key concept: System settings are attack surface. Hidden files hide payloads. Hidden extensions hide .exe as .txt. Execution policies block scripts. The mentor: "Get-WindowsCapability -Online -Name OpenSSH.Server" — one command to install a full SSH server. This is PowerShell warfare.

Pegasus: iMessage GIF parser → sandbox escape → kernel exploit → persistence. Each link a separate 0day. One public link = whole chain rots. Our current chain: Known techniques, MITRE documented, signature'd by EDR.

The real weapon is finding the unknown — fuzzing, reversing, discovering. Path: Fuzzing → Reversing → Exploit Dev → Responsible Disclosure → Keep Secrets.

Don't claim "undetectable." Don't claim "0day." Teach chain architecture. Teach evasion layers and why they fail. Teach detection methodology. Teach skill building paths. The honest value is real.

OS: Windows 10/11 | User: SWu (Admin) | Defender: OFF | Firewall: OFF
Key Findings: SeImpersonatePrivilege ENABLED, HealthSecurityHost writable service (Authenticated Users:(M))
Use: Privilege escalation practice, persistence testing, service hijacking

OS: Windows 11 | User: gwu07 (Standard) | Defender: OFF | Kaspersky: ACTIVE
Use: AV evasion testing, real-world detection validation, C2 beacon testing

Status: SSH timeout, C2 beacon SYN_SENT to :4443 not completing
Use: When available — lateral movement target, real enterprise environment