Rapid Domain Admin in a Hospital Internal Test: What Next?
During a five-day internal penetration test at a 600-bed hospital, a tester obtains domain administrator rights in the first two hours by Kerberoasting a service account with a 12-character password and then using an unconstrained delegation host. The client's objectives are to assess ransomware exposure and test whether the blue team detects lateral movement. The environment includes 1,800 Windows endpoints, 220 servers, a 24/7 clinical application used for medication dispensing, and a separate cardiac device VLAN that the client calls "sensitive but in scope". The tester has captured hashes for 40 service accounts and has not yet touched the clinical application. The blue team has not alerted. The contract permits lateral movement but prohibits denial-of-service and any action that could affect patient care. A change freeze is in effect for clinical systems. The engagement lead must decide how to use the remaining three days.
1. What should the lead decide about further exploitation of domain administrator rights, and why?
Read the worked answer
Stop broad exploitation and switch to objective-driven validation. Domain admin in two hours already proves the core weakness: weak service-account passwords plus unconstrained delegation. Continuing to harvest hashes or move laterally without a specific question adds risk with little new evidence. The contract prohibits actions affecting patient care, and the clinical application is 24/7; touching it could disrupt medication dispensing. The cardiac VLAN is 'in scope', but that does not make it low-risk; the lead should require explicit clinical and engineering approval before any action there.
Instead, the lead should preserve evidence of the Kerberoast and delegation path, define a short list of remaining objectives (detection of lateral movement and ransomware exposure), use non-clinical systems and canary accounts, and coordinate with the blue team on deconfliction. If the client wants proof of ransomware impact, propose a tabletop exercise or isolated lab, not production encryption. Document the decision to limit exploitation as a risk-management choice, not a failure to complete the test. This protects patients and still answers the client's real questions.
2. Design a safe test to evaluate the blue team's detection of lateral movement without disrupting patient care.
Read the worked answer
Use a controlled detection test rather than indiscriminate lateral movement. Select two non-clinical lab servers and a test workstation on a segmented VLAN; create a low-privilege test account with a known name; use the captured service-account hash only to request a Kerberos service ticket for the test service, then attempt SMB access to the lab host. Place canary files with realistic names in a lab share and attempt a benign rename or access, with no encryption. Notify the SOC duty lead before and after each action, agree on stop conditions such as any alert from the clinical VLAN or any unexpected host, and log timestamps.
Measure time to detection, alert quality, and whether the SOC correlates the Kerberos and SMB events. Do not touch the cardiac VLAN or clinical application. If the blue team detects the activity, stop and debrief; the objective is detection, not persistence. This design tests the defender without patient risk and stays within the contract. It also produces evidence the client can use to improve monitoring rather than just a list of compromised hosts.
3. The client asks you to demonstrate ransomware impact by encrypting a few files on a production file server. How do you respond?
Read the worked answer
Decline to encrypt files on a production file server. The contract forbids denial-of-service and actions that could affect patient care; encryption is inherently disruptive, and even a few files can trigger backup or clinical workflow issues. Instead, offer three alternatives: demonstrate ransomware impact in an isolated lab environment with a copy of a file server and written approval; run a tabletop exercise with IT and clinical leadership using the access already obtained; or simulate impact non-destructively by creating a benign canary file and showing that the account could write to a share, without encryption.
If the client insists, require a signed change approval, a tested backup restore, a defined maintenance window, and clinical sign-off. Document the refusal and the reason in the report. The lead's job is to prove risk, not create it. A production encryption test can turn an authorized assessment into a real incident, damage patient trust, and invalidate the engagement's legal protections.