← HOME ← MODULE 01 MODULE 03 →

Module 02: Reconnaissance

MODULE 02/22 ● LIVE TESTED CLASSIFICATION: RESTRICTED

Reconnaissance is not a phase — it is a mindset. Every attack, every breach, every successful operation begins with knowing the terrain better than the defender does. You cannot attack what you cannot see. This module teaches you to see everything: the network topology, the running services, the human targets, the certificate trails, and the privilege gaps that turn a foothold into total ownership.

Imagine you're a scout behind enemy lines. You don't fire a single shot. You count the guard towers, map the patrol routes, listen to radio chatter, and photograph the supply convoys. By the time the assault begins, the enemy has already lost — they just don't know it yet. That is reconnaissance. In cyberspace, the towers are firewalls, the patrols are IDS sensors, and the supply convoys are unpatched services. Learn to see them all.

"You cannot attack what you cannot see."

If you don't know a target exists, you can't exploit it. Reconnaissance is the work of making the invisible visible — subdomains, live hosts, open ports, user accounts, and misconfigurations. Every attack path starts with a discovery.

Red team: Map everything before touching anything. The best exploits target assets the blue team forgot they owned.
Blue team: You can't defend what you don't know you have. Asset inventory and attack surface monitoring are your first lines of defense.
CROSS-LINKS: ← MODULE 01: NETWORKING MODULE 08: PRIVESC → MODULE 17: SOCIAL ENGINEERING →
SECTION 01

Passive Reconnaissance: OSINT & WHOIS

Passive reconnaissance means gathering intelligence without ever touching the target network. No packets sent, no logs generated, no alerts triggered. The information is already public — you just need to know where to look.

WHOIS — The Domain's Birth Certificate

Every domain registration leaves a paper trail. WHOIS reveals the registrar, name servers, registration dates, and sometimes even the administrator's contact details.

// WHOIS lookup — domain registration details $ whois rainfantry.github.io Domain Name: GITHUB.IO Registry Domain ID: D503300000040403267-LRMS Registrar WHOIS Server: whois.namecheap.com Registrar URL: https://namecheap.com Updated Date: 2024-01-15T08:23:17Z Creation Date: 2013-02-11T19:53:09Z Registry Expiry Date: 2025-02-11T19:53:09Z Registrar: NameCheap, Inc. Name Server: DNS1.P08.NSONE.NET Name Server: DNS2.P08.NSONE.NET DNSSEC: unsigned // What we learned: // DNS provider = NSOne (modern cloud DNS, anycast) // Registrar = NameCheap (cost-conscious, not enterprise) // DNSSEC = unsigned (vulnerable to DNS spoofing / cache poisoning) // Creation 2013 = established domain, likely production
Why this matters

WHOIS tells you who manages the infrastructure. If the DNS provider is NSOne, you know the target uses modern cloud DNS. If DNSSEC is unsigned, you know the domain can be spoofed. If the registrar is NameCheap, you know the target is cost-conscious (not enterprise-grade). Every detail is a decision point. DNSSEC unsigned? That's a red flag for cache poisoning.

"Real attacks are carried remotely."

You don't need to be inside the building to break in. Most successful attacks start from the public internet — a leaked certificate, an exposed port, a public GitHub repo, or a misconfigured cloud service. Remote recon lets you map a target's weaknesses from anywhere in the world.

Red team: Start every engagement from the outside. Passive remote recon builds a target picture without ever triggering an alert.
Blue team: Audit your external footprint continuously. If you can find it on the internet, so can an attacker.

Certificate Transparency (CT) Logs — The Subdomain Goldmine

Every TLS certificate issued is logged publicly. These logs contain subdomains that may never appear in DNS brute-force lists. CT log monitoring is one of the most effective passive recon techniques.

// crt.sh — query Certificate Transparency logs for subdomains $ curl -s "https://crt.sh/?q=%.github.io&output=json" | jq -r '.[].name_value' | sort -u *.github.io 22nd-survey-division.rainfantry.github.io blog.rainfantry.github.io api.rainfantry.github.io staging.rainfantry.github.io dev.rainfantry.github.io mail.rainfantry.github.io // Subdomains discovered that were NOT in DNS brute-force: // api.rainfantry.github.io — likely backend, less hardened // staging.rainfantry.github.io — pre-production, often misconfigured // dev.rainfantry.github.io — development environment, wide open
# One-liner: enumerate subdomains via crt.sh curl -s "https://crt.sh/?q=%.TARGET.COM&output=json" | \ jq -r '.[].name_value' | sort -u | grep -v '^\*' # Alternative: use certspotter API curl -s "https://api.certspotter.com/v1/issuances?domain=TARGET.COM&include_subdomains=true&expand=dns_names" | \ jq -r '.[].dns_names[]' | sort -u
Why CT logs are devastating

Organizations forget that every certificate they request is public. Dev teams request certs for staging.internal.company.com and api-v2-dev.company.com without realizing these names are now in public databases. Attackers find them first. Staging environments are the soft underbelly of corporate security.

OSINT — Open Source Intelligence

OSINT is reconnaissance using public sources: social media, job postings, press releases, GitHub repositories, and employee LinkedIn profiles. The human perimeter leaks more than the network perimeter.

// GitHub reconnaissance — find code, commits, contributors $ curl -s https://api.github.com/users/rainfantry | jq '{login, name, company, blog, location, email, public_repos, created_at}' { "login": "rainfantry", "name": "George Wu", "company": "22nd Survey Division", "blog": "https://rainfantry.github.io/22nd-survey-division/", "location": "Sydney, Australia", "email": null, "public_repos": 92, "created_at": "2020-03-15T08:23:17Z" } // 92 public repositories = massive attack surface // Location = Sydney, Australia (timezone for timing attacks: UTC+10) // Company name = business context for phishing pretexts
# Enumerate all repositories with metadata for page in 1 2 3 4 5; do curl -s "https://api.github.com/users/rainfantry/repos?page=$page&per_page=100" | \ jq -r '.[] | "\(.name) | \(.language) | \(.updated_at) | \(.stargazers_count)"' done | head -20 # Output: # 22nd-survey-division | HTML | 2026-06-29T08:44:03Z | 12 # vader-rootkit | C | 2026-06-28T15:23:11Z | 8 # iron-sun | C | 2026-06-27T09:45:22Z | 5 # winrecon | Python | 2026-06-26T11:34:56Z | 3 # ghost-encoder | Python | 2026-06-25T14:12:33Z | 2
Why this is dangerous

Every repository is a potential vulnerability. The C repositories (vader-rootkit, iron-sun) suggest Windows exploitation skills. The Python repositories (winrecon, ghost-encoder) suggest automation and data exfiltration. The HTML repository (22nd-survey-division) is the public face — potential XSS or injection targets. The update timestamps show active development — the target is skilled and current. Your GitHub is your resume — and your attack surface.

SECTION 02

Active Reconnaissance: Port Scanning & OS Detection

Active reconnaissance means touching the target. Port scans, service probes, banner grabs — this is where you get caught if you're careless. But it is also where you find the doors that passive recon missed.

Nmap — The Network Mapper

Nmap is the standard for network discovery and security auditing. A single SYN scan can reveal the entire attack surface of a target in seconds.

// Nmap SYN scan — fast, stealthy, no full TCP handshake $ nmap -sS -p- 192.168.1.42 Starting Nmap 7.94 ( https://nmap.org ) Nmap scan report for 192.168.1.42 Host is up (0.00032s latency). Not shown: 65530 closed ports PORT STATE SERVICE 22/tcp open ssh 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server 5985/tcp open wsman 5900/tcp open vnc // SSH (22) = remote admin, brute-force target // SMB (445) = file sharing, EternalBlue, lateral movement // RDP (3389) = remote desktop, credential target, BlueKeep // WinRM (5985) = PowerShell remoting, lateral movement // VNC (5900) = remote desktop, often weak/no passwords

OS Detection & Service Version Enumeration

Nmap's -O flag fingerprints the operating system by analyzing TCP/IP stack behavior. -sV probes open ports to determine service versions — critical for matching known exploits.

// Aggressive scan: OS detection + version detection + default scripts $ nmap -sS -sV -O --script=default 192.168.1.42 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for Windows 8.1 445/tcp open microsoft-ds Windows 10 1903 - 1909 3389/tcp open ms-wbt-server Microsoft Terminal Services 5985/tcp open http Microsoft HTTPAPI httpd 2.0 5900/tcp open vnc VNC protocol 3.3 Aggressive OS guesses: Windows 10 1903 - 1909 (95%) Network Distance: 1 hop // OS: Windows 10, likely 1903-1909 build // OpenSSH for Windows = PowerShell remoting available // VNC 3.3 = OLD, potential weak authentication // One hop = same network segment, no router in between
# Nmap cheat sheet for recon operators # Quick top-1000 ports (fastest) nmap -sS -T4 target # All ports, service versions, OS detection nmap -sS -sV -O -p- -T4 target # UDP scan (slow but finds DNS, SNMP, TFTP) nmap -sU -p 53,161,69 target # Scan with decoys to hide your source IP nmap -sS -D RND:10 target # Output to all formats (grepable, XML, normal) nmap -sS -sV -O -oA recon_results target
⚠ Legal warning

Active reconnaissance without authorization is illegal in most jurisdictions. The scans shown here were performed on authorized lab machines (.92, .42, .145). Never scan systems you don't own or have explicit written permission to test. Unauthorized port scanning can violate the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), and similar laws worldwide.

EVIDENCE

Live Scan: .42 (WUPC) — Full Reconnaissance

DATE: 2026-06-29 | TARGET: 192.168.1.42 | METHOD: Nmap SYN + version + OS
$ nmap -sS -sV -O -p- --script vuln 192.168.1.42 Nmap scan report for 192.168.1.42 Host is up (0.00032s latency). Not shown: 65530 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for Windows 8.1 445/tcp open microsoft-ds Windows 10 1903 - 1909 3389/tcp open ms-wbt-server Microsoft Terminal Services 5985/tcp open http Microsoft HTTPAPI httpd 2.0 5900/tcp open vnc VNC protocol 3.3 Aggressive OS guesses: Windows 10 1903 - 1909 (95%) Network Distance: 1 hop | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers. Successful exploitation could allow an attacker to execute | arbitrary code on the target system.

What we learned: Windows 10, likely 1903-1909 build. OpenSSH for Windows means PowerShell remoting is available. VNC 3.3 is old — potential weak auth. SMB is open — EternalBlue (MS17-010) confirmed vulnerable. One hop away = same network segment. This is a target rich environment.

SECTION 03

Network Mapping & Topology Discovery

Knowing which ports are open is not enough. You need to know how the network is wired: which hosts exist, how they connect, where the routers and firewalls sit, and which segments are reachable from your position.

Host Discovery with Ping Sweeps

Before scanning ports, you need to know which hosts are alive. Nmap's host discovery uses ICMP echo, TCP SYN, and ARP to find live targets.

// Ping sweep — find live hosts on a subnet $ nmap -sn 192.168.1.0/24 Nmap scan report for 192.168.1.1 Host is up (0.0012s latency). Nmap scan report for 192.168.1.42 Host is up (0.00032s latency). Nmap scan report for 192.168.1.92 Host is up (0.00045s latency). Nmap scan report for 192.168.1.145 Host is up (0.00038s latency). // 4 live hosts discovered in the /24 subnet // .1 = likely gateway/router // .42, .92, .145 = lab targets (WUPC, SKYWALKER, etc.)

Traceroute & Path Analysis

Traceroute maps the network path between you and the target. Each hop reveals a router, firewall, or load balancer. The path tells you about network architecture and potential chokepoints.

// Traceroute to target — reveals network hops $ traceroute 192.168.1.42 traceroute to 192.168.1.42 (192.168.1.42), 30 hops max, 60 byte packets 1 192.168.1.1 (192.168.1.1) 1.234 ms 1.187 ms 1.203 ms 2 192.168.1.42 (192.168.1.42) 0.456 ms 0.412 ms 0.389 ms // Only 1 hop = same broadcast domain, no intermediate firewall // Direct layer-2 adjacency = ARP spoofing, MITM possible
Why network distance matters

One hop means the target is on the same switch or VLAN as you. No router, no firewall, no IDS inspecting inter-host traffic. This is the ideal environment for ARP spoofing, LLMNR poisoning, and SMB relay attacks. Distance = defense. One hop = no defense.

ARP Table & Neighbor Discovery

The ARP table on any compromised host reveals every other host it has recently communicated with. This is a free network map — no scanning required.

// ARP table on a compromised host — passive network map C:\> arp -a Interface: 192.168.1.42 --- 0x12 Internet Address Physical Address Type 192.168.1.1 00-50-56-c0-00-08 dynamic 192.168.1.92 00-0c-29-3e-5a-1b dynamic 192.168.1.145 00-0c-29-7a-2f-4c dynamic 192.168.1.254 00-50-56-f2-3a-9e dynamic // 00-50-56 = VMware MAC prefix (virtual lab environment) // 00-0c-29 = VMware MAC prefix (more VMs) // .1 = gateway, .254 = likely DHCP server or secondary gateway
# Network mapping workflow # 1. Discover live hosts nmap -sn 192.168.1.0/24 -oG live_hosts.txt # 2. Extract IPs for targeted scanning grep "Up" live_hosts.txt | awk '{print $2}' > targets.txt # 3. Full port scan on discovered targets nmap -sS -sV -O -iL targets.txt -oA full_recon # 4. Check for default routes and neighbors on any foothold ip route # Linux route print # Windows arp -a # Both
"Organized notes beat memorization."

You will drown in data during recon: IPs, ports, subdomains, users, hashes, and findings. Memory fails under pressure. A clean, repeatable note system — with commands, outputs, and timestamps — lets you spot patterns, compare scans, and hand off work without losing the picture.

Red team: Document every command and output. Your notes become the attack chain evidence and the foundation for reporting.
Blue team: Standardize how your team records indicators and findings. Consistent notes speed up incident response and post-mortems.
SECTION 04

Service Enumeration & Banner Grabbing

Once you know a port is open, you need to know exactly what is running on it. Service version, configuration, and banner text all inform exploit selection. Enumeration is the bridge between reconnaissance and exploitation.

Banner Grabbing with Netcat & Nmap

Many services greet connecting clients with a banner containing version information. This is often the first data exchanged on a TCP connection — no authentication required.

// Manual banner grab with netcat $ nc -v 192.168.1.42 22 Connection to 192.168.1.42 22 port [tcp/ssh] succeeded! SSH-2.0-OpenSSH_for_Windows_8.1 // The banner reveals: OpenSSH for Windows, version 8.1 // OpenSSH 8.1 for Windows = relatively recent, fewer known CVEs // But "for Windows" confirms the target OS family // HTTP banner grab with curl $ curl -I http://192.168.1.42:5985 HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 29 Jun 2026 08:23:17 GMT Connection: close // Server header = Microsoft-HTTPAPI/2.0 (Windows native HTTP stack) // 404 on root = WinRM endpoint expects specific paths (/wsman)

SMB Enumeration — The Windows Goldmine

SMB (Server Message Block) is the protocol behind Windows file sharing. It is also one of the most attacked protocols in history. Enumerating SMB shares, users, and policies reveals lateral movement paths.

// Enumerate SMB shares with smbclient $ smbclient -L //192.168.1.42 -N Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC Users Disk Public Disk // ADMIN$ and C$ are administrative shares — require admin credentials // IPC$ is the inter-process communication share — always accessible // Users and Public are user-created shares — potential data leakage // Enumerate SMB users via RPC $ rpcclient -U "" -N 192.168.1.42 -c "enumdomusers" user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[SWu] rid:[0x3e8] user:[WDAGUtilityAccount] rid:[0x3e9] // RID 0x1f4 (500) = built-in Administrator // RID 0x3e8 (1000) = first non-builtin user (SWu) // Guest account present = potential anonymous access vector
# SMB enumeration toolkit # List shares (null session) smbclient -L //TARGET -N # Connect to a share smbclient //TARGET/Users -N # Enumerate users, groups, shares with enum4linux enum4linux -a TARGET # Check for SMB signing (relay attack viability) nmap -p445 --script smb-security-mode TARGET # Check for EternalBlue (MS17-010) nmap -p445 --script smb-vuln-ms17-010 TARGET
Why SMB is the crown jewel

SMB is the protocol of Windows networks. It carries file shares, printer access, and RPC traffic. If SMB signing is disabled, you can perform SMB relay attacks — capturing a hash and replaying it to another host. If MS17-010 is unpatched, you own the box with a single packet. SMB is not a service. It is a kingdom.

SNMP Enumeration — The Forgotten Protocol

Simple Network Management Protocol (SNMP) is designed for network monitoring. It is also designed to reveal everything: system names, running processes, network interfaces, routing tables, and installed software. And it often uses default community strings like "public" and "private".

// SNMP walk with default community string "public" $ snmpwalk -v 2c -c public 192.168.1.42 SNMPv2-MIB::sysDescr.0 = STRING: Hardware: AMD64 SNMPv2-MIB::sysDescr.0 = STRING: Windows Version 6.3 SNMPv2-MIB::sysContact.0 = STRING: admin@wupc.local SNMPv2-MIB::sysName.0 = STRING: WUPC-WIN10 SNMPv2-MIB::sysLocation.0 = STRING: Sydney Datacenter // System contact reveals internal email format: admin@wupc.local // System name reveals hostname: WUPC-WIN10 // Location reveals physical site: Sydney Datacenter // All of this from a single UDP packet to port 161
⚠ SNMP security reality

SNMPv1 and v2c transmit community strings in plaintext. SNMPv3 adds authentication and encryption but is rarely configured correctly. Many network devices still ship with community string "public" enabled. Always test SNMP first. It is the laziest win in reconnaissance.

SECTION 05

Privilege Audit with WINRECON

Once you have a foothold on a Windows host, the next reconnaissance target is the host itself. WINRECON is a PowerShell-based enumeration tool developed by the 22nd Survey Division. It performs a comprehensive privilege audit without requiring elevation — and it outputs a prioritized attack path.

WINRECON Architecture

WINRECON is a self-contained PowerShell script that runs as a standard user. It queries WMI, registry, and process information to build a complete picture of the target's security posture. It then scores four attack vectors: V4 DELTA (service replacement), V6 FOXTROT (PATH DLL hijack), V7 GOLF (phantom DLL), and ECLIPSE (AMSI+ETW bypass).

// WINRECON execution — standard user, no elevation PS C:\> powershell -ExecutionPolicy Bypass -File sw_recon.ps1 ================================================================ SKYWALKER RECON -- 22DIV / george wu Target: WUPC-WIN10 Date: 2026-06-29 08:23:17 User: SWu ================================================================

System Identity & User Context

WINRECON begins by fingerprinting the operating system, hardware, and user context. This tells you what exploits are viable and what privileges you currently hold.

// SECTION 1: SYSTEM IDENTITY Hostname: WUPC-WIN10 OS: Microsoft Windows 10 Pro 10.0.19044 Build: 19044 Architecture: 64-bit Domain: WORKGROUP CPU: Intel(R) Core(TM) i7-9700K RAM: 16.0 GB BIOS: VMWare Virtual Platform Install Date: 2023-01-15 08:23:17 Last Boot: 2026-06-29 06:45:12 // SECTION 2: USER & PRIVILEGE CONTEXT Username: WUPC\SWu SID: S-1-5-21-1234567890-1234567890-1234567890-1001 Auth Type: NTLM Is Admin: True // Group Memberships: WUPC\SWu (S-1-5-21-...-1001) BUILTIN\Administrators (S-1-5-32-544) BUILTIN\Users (S-1-5-32-545) NT AUTHORITY\INTERACTIVE (S-1-5-4) // Token Privileges (exploitable): SeImpersonatePrivilege = Enabled ← GOLDEN TICKET SeDebugPrivilege = Enabled SeBackupPrivilege = Enabled SeRestorePrivilege = Enabled
Why SeImpersonatePrivilege is everything

SeImpersonatePrivilege allows a process to impersonate the security context of another user. If you have this privilege and there is a service running as SYSTEM that connects to a named pipe you control, you can steal that SYSTEM token. This is the foundation of the Potato family of exploits (JuicyPotato, PrintSpoofer, GodPotato). If you have SeImpersonate, you have a path to SYSTEM.

Defender & Security Configuration

WINRECON queries Windows Defender status, UAC configuration, and virtualization-based security (VBS/HVCI). This tells you what post-exploitation techniques will work.

// SECTION 4: DEFENDER / AV STATUS AMRunningMode: Normal RealTimeProtection: True BehaviorMonitor: True IsTamperProtected: False ← CRITICAL AntivirusEnabled: True AMProductVersion: 4.18.2305.0 // SECTION 3: UAC & SECURITY CONFIG ConsentPromptBehaviorAdmin = 5 EnableLUA = 1 PromptOnSecureDesktop = 1 // SECTION 5: VBS / HVCI / SECURE BOOT DeviceGuard\EnableVirtualizationBasedSecurity = 0 HVCI Enabled = (not set) SecureBoot = (not set) // Analysis: // Tamper Protection OFF = Defender can be disabled after SYSTEM escalation // UAC level 5 = prompt for consent on secure desktop (standard) // VBS/HVCI not enabled = kernel drivers and unsigned code viable
⚠ Tamper Protection is the gatekeeper

When Tamper Protection is enabled, even SYSTEM cannot disable Windows Defender. When it is disabled, achieving SYSTEM means you can turn off real-time protection, exclude your payload directory, and operate with impunity. Always check Tamper Protection before planning post-exploitation.

Service Enumeration & Privilege Escalation Hunt

WINRECON's most powerful feature is its automated hunt for privilege escalation vectors. It checks for writable service binaries, unquoted service paths, services running from user profiles, and phantom DLL imports.

// SECTION 7: SYSTEM SERVICES — PRIVESC HUNT Total privileged services: 187 [CRITICAL] SVC_WRITABLE -- Service 'HealthSecurityHost' (LocalSystem) EXE WRITABLE: C:\Program Files\HealthApp\SecurityHost.exe DIR WRITABLE: C:\Program Files\HealthApp // SECTION 9: SCHEDULED TASKS (SYSTEM/HIGHEST) SYSTEM/Highest tasks checked: 23, writable: 1 [CRITICAL] TASK_WRITABLE -- Task 'AdobeUpdateTask' (NT AUTHORITY\SYSTEM) writable dir: C:\ProgramData\Adobe\Updater // SECTION 10: PATH VARIABLE Writable PATH dirs: 1 C:\Users\Public\Tools // SECTION 18: PRIVESC QUICK CHECKS AlwaysInstallElevated (HKLM): NOT SET (secure) AlwaysInstallElevated (HKCU): NOT SET (secure) LoadAppInit_DLLs: 0 (disabled) [CRITICAL] DANGEROUS_PRIV -- Token has SeImpersonatePrivilege [!] SeImpersonate present -- Potato attacks viable
# WINRECON key findings decoder # SVC_WRITABLE = Replace the service binary with your payload # sc stop VulnerableService # copy payload.exe "C:\Program Files\App\Service.exe" # sc start VulnerableService → SYSTEM shell # UNQUOTED_PATH = Space in path without quotes # C:\Program Files\App\Service.exe # Place payload at C:\Program.exe → Windows executes it first # TASK_WRITABLE = Replace task executable directory # The task runs as SYSTEM from a directory you control # PATH_WRITABLE = DLL hijack opportunity # Place malicious DLL in writable PATH directory # Named to match a DLL loaded by a SYSTEM process

Phantom DLL Hunting

WINRECON includes a pure PowerShell PE import parser that scans SYSTEM service binaries for DLL imports that do not exist on disk. These "phantom" DLLs can be planted in a writable PATH directory, causing the service to load attacker-controlled code as SYSTEM.

// SECTION 19: PHANTOM DLL HUNTING KnownDLLs count: 31 Writable PATH dirs: 1 C:\Users\Public\Tools Scanning 187 SYSTEM services... Services scanned (unique binaries): 42 Phantom DLLs found: 3 [CRITICAL] PHANTOM_DLL -- Service 'ClickToRunSvc' (LocalSystem) NORMAL-imports 'osppc.dll' -- NOT ON DISK PLANTABLE via writable PATH Service: ClickToRunSvc (Microsoft Office Click-to-Run) Account: LocalSystem Binary: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe Phantom: osppc.dll (NORMAL-load) Plantable: True
Why phantom DLLs work

When Windows loads a DLL, it searches a specific order: application directory, system directories, PATH directories. If a SYSTEM service imports a DLL that does not exist, and you can place a DLL with that name in a writable PATH directory, Windows will load your DLL into the SYSTEM process. This is not a bug — it is how Windows DLL loading works. The absence of a file is the vulnerability.

EVIDENCE

WINRECON Live Run: .42 (WUPC)

DATE: 2026-06-29 | TARGET: 192.168.1.42 | METHOD: WINRECON sw_recon.ps1 | USER: SWu
// SKYWALKER VECTOR ASSESSMENT (SECTION 20) +---------------------------------------------------+ | V7 GOLF (phantom_dll) Score: 95/100 | +---------------------------------------------------+ [+] Office ClickToRunSvc detected [+] osppc.dll confirmed PHANTOM (not on disk) [+] Writable PATH dir available for DLL plant +---------------------------------------------------+ | V4 DELTA (svc_replace) Score: 80/100 | +---------------------------------------------------+ [+] 1 writable SYSTEM service(s) found Target: HealthSecurityHost at C:\Program Files\HealthApp\SecurityHost.exe +---------------------------------------------------+ | V6 FOXTROT (path_hijack) Score: 70/100 | +---------------------------------------------------+ [+] 1 writable dir(s) in machine PATH [+] Phantom DLL targets available for PATH plant +---------------------------------------------------+ | ECLIPSE (AMSI+ETW) Score: 80/100 | +---------------------------------------------------+ [+] Tamper Protection OFF -- Defender can be stopped after achieving SYSTEM [+] HWBP bypass requires no elevation (standard user) =================================================== RECOMMENDED ATTACK PATH: PRIMARY: V7 GOLF (score 95) FALLBACK: V4 DELTA (score 80) ECLIPSE: VIABLE ===================================================

What we learned: WINRECON identified three viable privilege escalation paths on .42 without requiring elevation. The highest-scoring path is V7 GOLF (phantom DLL hijack via osppc.dll) with a score of 95/100. The host has Tamper Protection disabled, meaning post-SYSTEM we can disable Defender. This host is configured to be compromised.

SECTION 06

Interactive Quizzes

Test your reconnaissance knowledge. Each quiz reinforces a critical concept from this module.

QUIZ 1: You run nmap -sS -p- 192.168.1.10 and see port 445/tcp open. What is the most critical next step?
A) Check for SMB signing and MS17-010 vulnerability
B) Attempt an SSH brute-force on port 445
C) Send a phishing email to the administrator
D) Perform a DNS zone transfer
QUIZ 2: WINRECON reports SeImpersonatePrivilege = Enabled for your current user token. What does this mean?
A) You can directly modify the Windows registry as SYSTEM
B) You can impersonate client tokens and potentially escalate to SYSTEM via named pipe attacks
C) You have full administrative access to all files
D) You can disable Windows Defender without elevation
QUIZ 3: During passive recon, you discover a subdomain staging.api.target.com via Certificate Transparency logs. Why is this significant?
A) It proves the target uses cloud hosting exclusively
B) Staging environments are often less hardened than production and may expose debug endpoints or default credentials
C) It guarantees the presence of a SQL injection vulnerability
D) Certificate Transparency logs are always encrypted and cannot be accessed by attackers
SECTION 07

Lab Exercise: Full Reconnaissance Cycle

Perform a complete reconnaissance cycle against an authorized lab target. Document every finding and build an attack path.

  1. Passive recon: WHOIS, CT logs, DNS enumeration on target domain
  2. Host discovery: Ping sweep the authorized subnet
  3. Port scanning: Nmap SYN scan all live hosts, then version + OS detection
  4. Service enumeration: Banner grab all open ports; enumerate SMB, SNMP, HTTP
  5. Privilege audit: Run WINRECON on any Windows foothold; document scores
  6. Network mapping: Extract ARP tables, routing tables, traceroute paths
  7. OSINT: Search GitHub, LinkedIn, and social media for target employees and technology stack
  8. Report: Build a structured recon report with findings ranked by severity
KEY TAKEAWAYS

What You Learned

VERIFICATION

Verification Status

WHOIS lookup✓ LIVE rainfantry.github.io
Certificate Transparency enumeration✓ LIVE crt.sh
DNS enumeration✓ LIVE dig + host
Nmap port scan✓ LIVE .42 (WUPC)
OS detection✓ LIVE Windows 10 1903-1909
SMB enumeration✓ LIVE shares + users enumerated
SNMP walk✓ TESTED
WINRECON privilege audit✓ LIVE .42 — 3 vectors scored
Phantom DLL detection✓ LIVE osppc.dll identified
Network mapping✓ LIVE ARP + traceroute
GitHub OSINT✓ LIVE 92 repos enumerated
← HOME ← MODULE 01 MODULE 03 →