Post-Exploitation and Lateral Movement
Post-exploitation and lateral movement
This domain demonstrates business impact after the first foothold: escalating privilege, harvesting credentials, moving to other hosts and proving access to sensitive data, all inside the rules of engagement and data-handling limits.
Objectives and constraints
Prove impact; do not maximize damage. Agree the crown-jewel target in advance and stop there. Demonstrate exfiltration with dummy files, redact PII in screenshots, log every command with timestamps, and remove persistence before closeout.
Privilege escalation
Linux: SUID/SGID binaries, sudo misconfiguration, writable cron jobs, capabilities, kernel exploits, writable /etc/passwd, NFS exports with no_root_squash. Windows: unquoted service paths, weak service ACLs, AlwaysInstallElevated, token impersonation via SeImpersonate, Group Policy Preferences cpassword in SYSVOL, kernel exploits, DLL hijacking.
Credential access
Mimikatz sekurlsa::logonpasswords against LSASS, SAM and NTDS.dit extraction, /etc/shadow, application config files, browser stores. Kerberos abuse: Kerberoasting accounts with SPNs, AS-REP roasting accounts without pre-authentication, golden and silver tickets, DCSync.
Lateral movement and pivoting
Pass-the-hash, PsExec, WMI, WinRM, RDP, SMB shares and SSH keys move you between hosts; BloodHound maps Active Directory paths toward Domain Admin. Pivot with ssh -L/-R/-D, proxychains, Meterpreter route and portfwd, or chisel, and tunnel over DNS or ICMP when TCP egress is filtered.
Worked example
A foothold as a low-privilege domain user on a workstation. BloodHound shows GenericAll over a service account. Kerberoast that account's SPN, crack the TGS offline, authenticate, and discover the account is local administrator on the file server holding the target data. Before each hop, check the ROE: the file server is in scope, the service account's other privileges are not, so access stops at a directory listing rather than a copy of the data. Then remove artifacts and return credentials.
Traps
Pivoting into an out-of-scope subnet because it was reachable. Leaving backdoor accounts or scheduled tasks behind. Exfiltrating real customer data. Kerberoasting when offline cracking is not permitted by the ROE. Failing to record commands, which makes the finding unreproducible in the report.