How Far Is Far Enough
You have SYSTEM on a claims-department Windows 11 workstation, gained through an unpatched SSL VPN appliance that was in scope. The SOW says: demonstrate the maximum business impact achievable, but do not modify Active Directory, do not touch domain controllers beyond read-only queries, and do not exfiltrate real customer data. A well-known EDR agent runs on every server in detect-only mode; the SOC is not a white cell and has not been told the attack timeline.
Enumeration so far: the local administrator password hash is identical across all 210 workstations; a service account with a Kerberoastable SPN sits in a group that BloodHound shows has GenericAll over an OU containing two Domain Admin accounts; and a file share on a claims server holds 40,000 claim records. The engagement has two days left.
1. You can likely crack the service account and reach Domain Admin. How do you demonstrate that impact without violating the SOW's no-modification rule?
Read the worked answer
Separate proving the path from exercising it.
Safe proof:
- Request the service ticket for the SPN and crack it offline. Ticket requests are normal Kerberos traffic and the cracking happens on your hardware, not the client's.
- If it cracks, authenticate as the service account only to the extent needed to enumerate rights - read-only LDAP queries, nothing written - and capture the ACL chain showing GenericAll over the Domain Admin OU.
- Present the chain as evidence: foothold → workstation local admin reuse → Kerberoastable service account → ACL right → Domain Admin, each step with its artefact.
Where to stop: do not log on to a domain controller, do not add or modify accounts, do not touch krbtgt, do not exercise GenericAll to reset a Domain Admin password. Modification of AD is explicitly prohibited, and a password reset on a DA account is an outage with a recovery cost.
If the client wants the final hop demonstrated, that requires a signed amendment and a scheduled window with client staff watching.
2. EDR is in detect-only mode and the SOC is not read in. How do you operate, and what does a detection mean for the deliverable?
Read the worked answer
Do not disable or tamper with the EDR - that is a modification outside the SOW, it destroys the data the client most needs, and it may breach the endpoint's licensing terms.
Operate with restraint: prefer native tooling and existing credentials over dropping new binaries, minimise the number of distinct actions per host, and avoid noisy techniques when a quiet equivalent proves the same thing. The reused local administrator hash is ideal here - it is legitimate authentication, not an exploit, and it demonstrates the real risk the client has.
If the EDR fires, treat it as a result, not a failure. Record the timestamp, the host, the alert, and how long until the SOC responded (if at all). That detection story is often the most valuable section of an internal report: it tells the client whether their monitoring works.
Only pause the operation if the RoE requires it; otherwise continue and document.
3. You reach the claims share with 40,000 records. What do you do to evidence access without breaching the data-handling clause?
Read the worked answer
Demonstrate reachability, not possession.
- List directory contents and capture filenames and counts; that alone proves the share is readable by the compromised account.
- Open one file and record its header or column structure with values masked, or record a file hash and size rather than the contents.
- Do not copy the share, do not bulk-read files, and do not move data to your own infrastructure. Exfiltration of real customer data is prohibited by the SOW and would create notification obligations for the client.
- If the client wants a stronger demonstration, ask them to place a canary file with a unique marker in the share; retrieving that proves write-to-read reach without touching real records.
Record the evidence path in the report, note the access date and account used, and confirm at debrief that no customer data left the environment. The judgement being tested is that demonstrating impact and causing impact are different acts, and only one of them is the job.