The Windows Kill Chain — Metasploitable 3 (Pentest Range Module M3)

The Windows Kill Chain: Metasploitable 3 (Module M3)

Pentest Range series · Part 3 of 5 · by Vinh NTT

Windows is where most real intrusions actually happen, and it plays by its own rules: SMB shares, Active Directory, NTLM hashes, service accounts and tokens. Module M3 of the CertInstructor Pentest Range puts a Windows Server 2008 R2 box (Metasploitable 3) at 10.10.10.12 and walks you through eleven labs — from the first null-session all the way to reboot-proof persistence.

Simulation only. Every technique in M3 is simulated in your browser. No real Windows host is touched.

The M3 kill chain — eleven labs

Step by step: the flagship chain (recon → EternalBlue → SYSTEM)

The heart of M3 is the first three labs, which chain together into the single most instructive attack in the range.

1. From the portal, enter the Windows platform (M3) and open Stage 01 · Nmap.
2. Scan the target: nmap -sV 10.10.10.12. Note port 445 (SMB) and the SMBv1 fingerprint. Finish the missions and quiz.
3. Open Stage 02 · SMB Enumeration. Run a null session against the SMBv1 server — no credentials — and pull back shares, user accounts and the OS version. This is discovery: you now know the box is old, unpatched, and speaking a protocol that should have died years ago.
4. Open Stage 03 · EternalBlue. Everything you just learned points here. Fire the MS17-010 exploit at the SMBv1 service and watch it hand you an unauthenticated shell as NT AUTHORITY\SYSTEM — total control, no password. Complete the missions, then the quiz explains why the vulnerability works and how patching or disabling SMBv1 stops it dead.

That three-lab arc — find the service, enumerate it, exploit it to SYSTEM — is the shape of a huge share of real-world Windows compromises. Do it once here and you'll recognise it forever.

Working the rest of the module

Once you're SYSTEM, the module becomes a tour of everything an attacker does after the break-in — the part that turns one compromised box into a compromised network:

• Web Exploitation gives you a second, separate way in — through exposed Jenkins and ElasticSearch consoles — landing you as a service account instead of SYSTEM (which sets up the token-theft lab later).
• WinRM shows lateral movement with no exploit at all — just a default password (vagrant:vagrant) over port 5985 for a remote PowerShell.
• Mimikatz → Pass-the-Hash is the credential-theft one-two: dump hashes and cleartext straight from LSASS memory, then replay the Administrator hash over SMB to move without ever cracking a password.
• Token Impersonation escalates that service-account foothold to SYSTEM by abusing SeImpersonatePrivilege — privilege escalation with no CVE.
• RDP reuses your stolen credentials (or the hash, via Restricted Admin) for a full interactive desktop.
• Persistence makes it durable: install an auto-start Windows service — or hijack an existing one's binPath — so your access survives a reboot.
• Blue Team flips it: every one of those techniques leaves a fingerprint in the Windows Security and Sysmon logs. Hunt them and rebuild the timeline.

Where M3 fits in your certification path

M3 is the offensive lifecycle again — this time on the platform that dominates enterprise environments — so it sits squarely in PenTest+ territory, with the credential-access and lateral-movement labs reaching toward the advanced, enterprise-scale thinking that SecurityX (CASP+) expects.

Next step when you're ready:

• CompTIA PenTest+ CertMaster Labs (PT0-003 V3) — the hands-on offensive path, on official lab environments.
• CertMaster Labs for CompTIA SecurityX (CAS-005) — when you're ready for enterprise-grade attack and defense at the architect level.

Up next

Linux and Windows down. The third target isn't a host at all — it's a stack of broken web applications, and it's where a growing share of real breaches begin.

→ Continue to Module M4 — Breaking the Web Stack (OWASP-BWA)

About the author — Vinh NTT (Nguyễn Trần Tường Vinh), founder of CertInstructor, 20+ years in IT-security training. Full CompTIA security stack (Security+, CySA+, PenTest+, SecurityX); two-time EC-Council Instructor Circle of Excellence Award winner (2022 & 2023). The Pentest Range is his original work, shared free.