Skip to content

Internal Lab: From Scope to Evidence

This walkthrough follows a local, isolated lab exercise with SMB enumeration, a real LLMNR response followed by SMB NTLMv2 authentication capture, and an HTTP observation carried into a reviewed retest and a basic report. It uses fictional credentials and no AI. Adapt the checks to your lab; an engagement does not need to run every available tool.

If you have not started Raven yet, follow Quick Start. For a remote operator host, keep the agent placement and recovery guide open alongside this walkthrough.

Start with one engagement and a known lab

Use an isolated lab with an SMB share server, a web service, and a machine that can generate LLMNR requests and fictional authentication. Keep ordinary client work separate from the lab. This example uses 172.31.88.10 for the SMB/web server and 172.31.88.20 for the machine generating the lab authentication. Neither requires a Windows execution agent: the operator agent runs on Linux.

  1. Choose New Engagement and create an internal or mixed lab engagement.
  2. In Scope & assets → Scope, enter 172.31.88.0/24 in Targets. Put addresses/networks to omit in the separate Exclusions field. Save both.
  3. Start with one known service host for the first check rather than interpreting a scan of the whole network as proof that every host was examined. Inspect the prepared target list and current exclusions before running.
  4. In Settings → Data & recovery → This installation, confirm that Credential encryption is On before attempting a capture. Keep the installation key backed up separately; it is not an engagement export file.

Put execution on the right machine

Use the Raven host when it has the route/tools you need; Docker supplies its local toolchain. For this lab's raw-network listener, choose the connected Linux operator agent on the lab segment.

Open Testing → Agents, prepare/download the binary for the operator host, and follow the Remote Agent → Place an agent on another host recipe. The agent needs this Raven server's token, the reachable callback/tunnel URL, and -engagement with the lab's client/display name. Select the connected agent and check its hostname, available tools, privileges, and interface.

The callback tunnel carries agent messages. It does not make a local command originate on the lab interface. Review the execution machine for each command. If the agent becomes stale or disappears, preserve your draft and follow the lost-connection guide; do not infer that a job stopped because the callback did.

Discover, then enumerate SMB

  1. Prepare a discovery check for the known lab service host. Review the chosen machine and explicit ports/profile. Follow the run's actual output.
  2. Import its supported result, then open the host's discovered services. An Nmap XML artifact containing TCP/445 and TCP/8080 should retain both ports after reviewed import. The original artifact remains available from the run.
  3. Use SMB Signing Check, or a reviewed NetExec command on the agent, for the selected SMB host. Inspect the output that establishes signing behavior and the resulting finding's host and source.
  4. Run SMB enumeration with the authorized fictional lab credentials when the server requires them. Inspect the share/access listing in the run output. A reported READ/WRITE permission is an enumeration result; record it as reported and validate an actual read/write operation separately if needed.

A completed process with exit code 0 does not establish successful coverage. If Nmap reports a host timeout and records no ports, keep that limitation with the run. It is not evidence that the host has no services. A targeted successful artifact and a broader timed-out run are separate observations.

Capture the lab authentication and preserve its origin

  1. Open Start agent tool on the connected lab agent. Select the Responder command and review its execution-host interface and flags. Reference material is a draft: replace example interfaces and use ASCII hyphens in flags such as -I; do not run an unchanged example merely because it was copied.
  2. Choose the listener behavior that matches the isolated lab exercise. Its interface is on the agent host, not on the Raven controller. An interface-wide listener is not restricted to the single host selected in Testing.
  3. Start the reviewed run, then generate the agreed fictional authentication from the lab machine. Inspect both the LLMNR response line and the subsequent SMB NTLM capture lines. These are separate stages of the observed sequence.
  4. Open Credentials and inspect the capture type, username/domain, and source IP. Open the automatic NTLM Authentication Capture finding and inspect its evidence and linked producing run. The captured victim is the authentication source; the agent's own address is the listener, not the victim.
  5. Request Stop and wait for the executor's exit acknowledgement. Retain the captured output. A disconnected agent or a stop-request toast is not that acknowledgement.

The demonstrated lab sequence is LLMNR response followed by SMB NTLMv2 capture. It does not demonstrate NBT-NS/mDNS poisoning, recovered passwords, or successful relay. Captured authentication material belongs in the captured-credential library; it is not a verified plaintext credential for later authenticated checks.

Record an observation and retest the actual check

For an observation made outside an automatic parser, open Findings → Add Finding. Record the title, affected host/service, severity, and the facts observed. Attach or record the relevant evidence; preserve the original run artifact rather than replacing it with rewritten output.

Link the saved background/agent run that established the observation. Declare its complete target set when the authored command did not save a target snapshot. In the demonstrated HTTP example, a curl observation against the single lab web host was linked to its saved run and that host was explicitly declared. Retest finding then prepared the same recorded check for review and produced a separate successful run. Credential arguments are masked in the review display; the server retains the original command for execution.

For Responder, keep the producing listener run linked, but do not declare the captured victim as the listener's complete target set. Review the full listener behavior and current scope before preparing another listener run. If that behavior cannot be represented accurately by the retest preparation, prepare a fresh check in Agents instead. Raven does not infer a host-limited listener from one capture, or mark the finding remediated simply because a retest completed.

Use discoveries for the next relevant check

A workflow can use This workflow's discoveries or Existing engagement discoveries. Choose intentionally. For example, a later web check should use the discovered web services and preserve their ports; no matching service can produce a documented skip. Inspect each step's saved targets and output. This is an optional next check, not a requirement to run every module.

Finish, or move the engagement for reporting

Review findings and evidence before generating Deliver → Reports → Basic Report. It needs no AI. Check that scope/exclusions, the discovered services, manual and imported findings, and testing limitations match your recorded work.

For an RDP-only test environment, run Raven on a supported installation on that box and keep the engagement there during testing. Stop active jobs before Deliver → Export → Raven engagement. Transfer the encrypted bundle by the approved file method, then preview/import it into a new local client folder. Verify credentials, evidence links, and historical runs before discarding the protected source. Import is a reporting copy; it does not launch or resume jobs.