Plan a Large Technology Conference
DREAM company
  staff computer ( the first initial access from a leaked VPN credential and getting access into the local network and forest ) 8.8.8.10
  this is the router. it has a lan segment in US. 8.8.8.0
  us.dream.net 8.8.8.3
    Legal-WS01 8.8.8.75
    logal-docs-storage 8.8.8.87
    us-mgmt 8.8.8.4
    us-texas-helpdesk 8.8.8.5
    us-exchange-server-admin 8.8.8.6
    us-mssql 8.8.8.7
    us-web 8.8.8.8
    us-mallmgmt 8.8.8.9
    dream-ca 8.8.8.20
    us-sharepoint 8.8.8.55
  dream-dc ( this is the primary DC or DC-01 ) 8.8.8.2
  wazuh XDR 8.8.8.26
  dream-vpn
its going to have tow Adapters :
Adapter 1: Host‑only or a network that simulates the external side (IP: 192.168.200.200, gateway: 192.168.200.1, DNS: 8.8.8.1)
Adapter 2: Internal lab network (IP: 8.8.8.250, no gateway)
using this the staffs are able to connect to the internet while they are still in their internal network this allows them to change their website preference and work with their website that is located on world wide web
  DREAM company external domains and forests
    Dream-Production.local 8.8.8.9
      production-dc
        products-audit 8.8.8.13
        production-DB 8.8.8.12
  privilege scalation to administrator using a dll hijacking in DreamSchedulerApp
  getting access to the internal email and message panel of the us-exchange-server-admin
  what is dream company? dream company is an active company in selling products and this company has alots of stores and mall's in USA. one of the most important and popular mall's of the dream company is located in texas. according to the recon process it seems that the servers of the texas mall they are storing very important data and high value databases. so our second primary goal is to get access to the server of the texas mall
  using the krbtgt hash we can generate a golden ticket for both DA and EA and we can control the whole forest
  and identifying the emails that we can use later on
  attacker machine
  cobalt strike and team server has been installed on it
  jenkins-server 8.8.8.30
  using the access on jenkins web panel and server now we can use the jenkins to improve our opsec by creating a External C2 server on jenkins and making our request legit in the eyes of IPS/IDS and defenders and SOC. the perfect way to hide our C&C. and also we can use it for file sharing and delivering our payloads and making the traffic legit
  we can get a access on jenkins-server with a Leaked credential file we have found in Nova computer
  now we can use the CVE-2025-53770 we can get access to the sharepoint server
  using the certificate we have found on the Nova computer we can use that to sign our jenkins go client executable for better opsec
  after we have compromised every impotant assets in the dream company without detection we can finally own the whole network
  zabbix monitoring service
  Nova computer ( she is working remotely )
  now using the vpn credential on the nova computer we can access the internal network
  C2 domain