I started by creating a simple physical topology consisting of 1 router, 1 switch, and 3 PCs.

I connected the router → switch using a straight-through cable and connected each PC → switch using straight-through cables.

On the switch

enable
configure terminal
hostname SW1
ip domain-name lab.local
no ip domain-lookup

VLAN configuration on the switch

vlan 10
name USERS
vlan 20
name VOICE
vlan 99
name MANAGEMENT

I assigned ports:

interface range fa0/1 - 3
switchport mode access
switchport access vlan 10
exit

interface fa0/10
switchport mode access
switchport access vlan 99
exit

Configure trunk port:

interface fa0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,99

On the router

enable
configure terminal
hostname R1
ip domain-name lab.local
no ip domain-lookup

To allow communication between VLANs, I configured subinterfaces on the router.

interface g0/0
no shutdown

interface g0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0

interface g0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0

interface g0/0.99
encapsulation dot1Q 99
ip address 192.168.99.1 255.255.255.0

To secure remote access with SSH, on the switch, I ran;

username admin privilege 15 secret xxxxxxx
crypto key generate rsa
! choose 1024 or 2048
ip ssh version 2

line vty 0 4
login local
transport input ssh

line console 0
password cisco
login

On the router, I ran;

username admin privilege 15 secret ******
crypto key generate rsa
ip ssh version 2

line vty 0 4
login local
transport input ssh

line console 0
password cisco
login

Trunk port adjustment and default route configuration

interface FastEthernet0/1
switchport mode trunk
ip route 0.0.0.0 0.0.0.0 10.0.0.1

Verification and connectivity testing

show vlan brief
show interfaces trunk
show ip route
ping 192.168.10.1
ping 192.168.20.1
ping 192.168.99.1

• Creating a clear IPv4 addressing plan

• Implementing basic VLAN segmentation

• Applying consistent device naming

• Ensuring the network design could scale as the office grows

To implement the design, I used Cisco Packet Tracer to build a simple logical topology consisting of:

• 1 Edge Router (for internet connectivity)

• 1 Access Switch

• 2 PCs

• 1 Printer

The router acts as the gateway to external networks, while the switch connects internal devices within the LAN.

Network Topology

The network follows a basic router-on-a-stick architecture, where a single router interface routes traffic for multiple VLANs.

Internet
   │
Router
   │ (Trunk Link)
Switch
 ├── PC (User)
 ├── PC (Management)
 └── Printer

Step 1: Configuring the Switch

The first task was to configure the access switch.

I started by assigning a hostname to make device identification easier when managing the network. After that, I created the VLANs required for the network.

VLANs allow different types of traffic to be logically separated even though they share the same physical network.

Example VLAN structure:

Step 2: Configuring the Edge Router

Next, I configured the edge router, which serves as the gateway for the entire network.

The router needed to support inter-VLAN routing, allowing devices in different VLANs to communicate with each other while maintaining network segmentation.

To achieve this, I implemented Router-on-a-Stick.

Router-on-a-stick allows a single physical router interface to handle traffic for multiple VLANs by using subinterfaces and 802.1Q VLAN tagging.

Each VLAN was assigned its own subnet, while the router provided the default gateway for each network.

Step 3: Creating Router Subinterfaces

Inside the router CLI, I created subinterfaces for each VLAN.

Each subinterface was configured with an IP address that serves as the default gateway for that VLAN

Example configuration:

interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

This allows devices in VLAN 10 to send traffic to the router when communicating with other networks.

Step 4: Configuring the Switch Trunk

To allow the router to receive traffic from all VLANs, I configured a trunk link between the switch and the router.

A trunk port carries multiple VLANs across a single connection.

Example configuration on the switch:

interface fa0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,99

This trunk link allows the router to receive tagged VLAN traffic and perform inter-VLAN routing.

Step 5: Enabling the Router Interface

After configuring the subinterfaces, I enabled the physical router interface so that it could process VLAN-tagged traffic.

interface g0/0
no shutdown

Without enabling the interface, the router would not be able to communicate with the switch.

Step 6: Configuring End Devices

Next, I configured the PCs with:

• IP Address

• Subnet Mask

• Default Gateway

Example configuration for a user PC:

This allows the PC to communicate with devices within its VLAN and reach other networks through the router.

Step 7: Enabling Secure Remote Management (SSH)

To improve network management, I enabled SSH remote access on the network devices.

This involved:

1. Setting the device domain name

2. Generating RSA encryption keys

3. Creating a local user account

4. Configuring the VTY lines to allow SSH

SSH allows administrators to securely manage network devices remotely instead of relying only on console access.

Why These VLANs and Subnets Were Chosen

The VLAN IDs and subnet structure were selected to create logical separation of network traffic.

Benefits include:

• Improved security – management traffic is isolated from user traffic

• Better network performance – reduced broadcast domains

• Scalability – new departments or services can be added easily

• Simpler troubleshooting – network segments are clearly defined

This type of structure is commonly used in real-world enterprise and small office networks.

Troubleshooting and Verification

During the lab, several commands were useful for verifying the configuration.

A systematic troubleshooting approach helped identify configuration issues quickly.

Key Lessons Learned

This lab reinforced several important networking concepts:

VLAN Segmentation

Separating network traffic into VLANs improves security, performance, and manageability.

Inter-VLAN Routing

Using router subinterfaces allows multiple VLANs to communicate through a single router interface.

Structured Troubleshooting

Effective troubleshooting requires verifying:

• Physical connectivity

• VLAN configuration

• Trunk links

• Router interfaces

• IP addressing

Default Routing

The router must have a default route to forward traffic to external networks such as the internet.

Future Improvements

While this design works well for a small office, future labs could improve the network by adding:

• Gateway redundancy using protocols like HSRP or VRRP

• Layer 3 switching for faster inter-VLAN routing

• Multiple switches to eliminate single points of failure

• Access control lists (ACLs) for improved security

These improvements would increase reliability, scalability, and network resilience.

Final Thoughts

Even a small office network benefits from structured design principles. Implementing VLAN segmentation, a clear IP addressing plan, and proper device configuration creates a network that is easier to manage and expand.

This lab demonstrated how foundational networking concepts, such as VLANs, inter-VLAN routing, and secure device management, form the basis of reliable real-world network deployments.

• What the technique is

• Why it works

• Exact steps to replicate it

• How to extract the required hash

1. DLL Hijacking — Extract the SHA256 Hash of WININET.dll

What You Are Doing

You will perform a DLL hijacking attack against calc.exe. The goal is to make calc.exe load a malicious DLL and then retrieve the SHA256 hash of that DLL.

Why This Works

Windows follows a predictable DLL search order. If an executable finds a DLL with the right name in its working directory, it will load that version even if it is malicious.

Step-by-Step Instructions

Verify Sysmon Installation

Open PowerShell and check whether Sysmon is running:

Get-Service Sysmon

If it is not installed, run:

sysmon.exe -i -accepteula -h md5,sha256,imphash -l -n

Prepare the Malicious DLL Environment

Copy calc.exe to your desktop:

Copy the reflective DLL:

Rename it to match the DLL that calc.exe will load:

Execute the Hijack

Run calc.exe from your desktop.

If the hijack is successful, you will not see the calculator. Instead, the payload will display a textbox.

Retrieve the SHA256 Hash

Run:

Get-FileHash "$env:USERPROFILE\Desktop\WININET.dll" -Algorithm SHA256

Save the hash output, this is your answer.

2. Unmanaged PowerShell Injection — Extract SHA256 Hash of clrjit.dll

What You Are Doing

You will inject PowerShell code into the spoolsv.exe process using PSInject, then identify the clrjit.dll file it loads and extract its SHA256 hash.

Why This Works

Unmanaged PowerShell allows attackers to run PowerShell in memory, inside a legitimate process, without spawning a standard PowerShell.exe instance. This is harder to detect.

Step-by-Step Instructions

Identify the spoolsv.exe Process

Open Process Hacker 2.
Search for spoolsv.exe and note its Process ID (PID).

Load and Prepare PSInject

Go to the PSInject folder:

cd C:\Tools\PSInject

Start PowerShell with execution policy bypass:

powershell -ep bypass

Import the module:

Import-Module .\Invoke-PSInject.ps1

Inject PowerShell Code

Invoke-PSInject -ProcId <ProcessID> -PoshCode "V3JpdGUtSG9zdCAiSGVsbG8sIEd1cnU5OSEi"

Check Process Hacker, spoolsv.exe should now appear as a managed process.

Locate clrjit.dll

Open Process Hacker → Properties → Modules.
Find clrjit.dll and copy its file path.

Extract the SHA256 Hash

Run:

Get-FileHash "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" -Algorithm SHA256

Record the output; this is your answer.

3. Credential Dumping with Mimikatz — Extract the Administrator NTLM Hash

What You Are Doing

You will run Mimikatz to extract the NTLM hash of the administrator account from memory.

Why This Works

Mimikatz exploits the fact that Windows stores credential material in LSASS memory. Sysmon can detect these memory-access patterns using Event ID 10.

Step-by-Step Instructions

Navigate to the Mimikatz Directory

cd C:\Tools\Mimikatz
ls

2. Execute the Mimikatz Agent

.\AgentEXE.exe

Inside the Mimikatz console, elevate privileges:

privilege::debug

Dump credentials:

sekurlsa::logonpasswords

Look for the Administrator section and note the NTLM hash.

Final Notes

By completing these exercises, you’ve learnt how to:

• Exploit DLL search order weaknesses

• Perform in-memory PowerShell injection

• Extract credentials directly from LSASS

• Use Sysmon to observe execution artefacts

Understanding of these techniques shows us how attackers operate at the system level and prepares you to create effective detections and respond to real-world threats.

sudo nmap 10.129.92.78 -sV -sC

Findings:

• OS: Windows 10

• Open Ports: 111, 135, 139, 445, 2049, 3389

• Services detected: RPC, SMB, NFS, RDP

2. Enumerating NFS

Since NFS (Network File System) was open, I used Nmap’s NFS scripts:

sudo nmap --script nfs* 10.129.92.78 -sV -p111,2049

Then double-checked with:

showmount -e 10.129.92.78

Result:

• The machine exported a folder named /TechSupport

• Anonymous read access was allowed

This is a vulnerability, allowing anonymous users to read exported files can leak sensitive internal data.

3. Mounting the NFS Share Locally

First, create a directory to mount the share:

mkdir local-nfs

Then, mount the exported folder:

sudo mount -t nfs 10.129.16.56:/TechSupport ./local-nfs/ -o nolock

This let me browse /TechSupport as if it were part of my local filesystem.

Note: Mounting requires root permissions because it interacts with kernel-level filesystem structures.

4. Reading Internal Support Files

Once mounted, I listed the available files:

cd local-nfs
ls

Most files were text-based support tickets. I concatenated all contents to scan for interesting information:

cat *

Success:

I found credentials for the user "alex" inside these files.

5. Enumerating SMB with Retrieved Credentials

Using alex’s credentials:

smbclient -L //10.129.16.56 -U alex%password

I discovered a share and downloaded a file named “important.txt“. This file contained another set of credentials, which I saved - likely belonging to a privileged service or database account.

6. Logging into the Machine via RDP

Using the credentials from the NFS share, I logged into the Windows machine through RDP:

• Username: alex

• Password: (from earlier)

Once logged in, I noticed an MSSQL Server icon on the desktop.

7. Accessing the MSSQL Database

I launched MSSQL as an administrator and authenticated using the credentials from important.txt.

Inside the database:

• Navigated to the accounts table (dbo.devsacc)

• Used the "Edit Top 200 Rows" option

Final Result:

I obtained the credentials for the HTB user — the required proof for completing the lab.

🟩 Key Takeaways

• Misconfigured NFS shares can leak sensitive internal credentials.

• Combining small pieces of leaked information can often give full access.

• Scan → Enumerate → Access → Escalate.

💬 If You Found This Helpful

Feel free to like, bookmark, or share the post.
Follow me here on Hashnode as I continue documenting my cybersecurity journey — from labs to real-world concepts.