Exploitation and Post-Exploitation
Exploitation and Post-Exploitation
This domain tests controlled exploitation, privilege escalation, lateral movement, persistence decisions, and evidence handling. The goal is to prove impact, not to cause damage.
Core rules and concepts
- Exploit selection: match the vulnerability, target version, architecture, and payload constraints. Prefer a reliable, minimally invasive exploit; validate in a lab or test window.
- Initial access yields a shell or session. Stabilize it, record the exact command and output, and note the account context.
- Privilege escalation: Linux SUID/SGID, sudo rights, cron, capabilities, kernel; Windows service permissions, unquoted paths, tokens, scheduled tasks, credential stores.
- Credential access: Mimikatz, secretsdump, SAM/LSA, Kerberos tickets. Handle credentials as sensitive evidence.
- Lateral movement: PsExec, WMI, WinRM, SSH, RDP, and pass-the-hash where authorized. Map paths with BloodHound.
- Persistence and exfiltration only if the rules of engagement allow; prefer proof over real data theft.
- Clean up artifacts you create and document any changes.
Worked example
A low-privilege Linux shell runs sudo -l and shows NOPASSWD: /usr/bin/vim. The tester runs sudo vim -c ':!/bin/sh', obtains root, and records the command and id output. They do not add a cron backdoor because persistence is out of scope. The finding is 'sudo misconfiguration allows root,' with remediation to remove NOPASSWD or restrict the binary. The proof is the command and output, not a modified system.
Traps that cost marks
- Using destructive exploits or real malware.
- Installing persistence when the RoE forbids it.
- Failing to capture proof of privilege level.
- Exfiltrating real customer data beyond a minimal proof.
- Leaving created accounts, files, or services behind.