Post-Exploitation and Lateral Movement
Post-Exploitation and Lateral Movement
Once access is proven, the engagement continues under the same scope, with more caution. Post-exploitation objectives typically include privilege escalation, credential access, persistence, lateral movement, data discovery, and - only if authorized - exfiltration.
Privilege escalation on Linux means SUID/SGID binaries, sudo misconfigurations, cron jobs, writable service files, and kernel exploits; on Windows, unquoted service paths, weak service permissions, token impersonation (SeImpersonate), AlwaysInstallElevated, and missing patches. Credential access covers dumping SAM/LSASS, hash extraction, Kerberoasting, AS-REP roasting, and credentials found in files, scripts, and configuration. Lateral movement uses SMB admin shares, PsExec-style service creation, WMI, WinRM, RDP, SSH, and scheduled tasks; pass-the-hash and pass-the-ticket reuse captured material without cracking it. Pivoting uses SSH local/remote forwarding, SOCKS proxies, and port relays to reach internal segments only through a compromised host.
Traps: every hop must be checked against scope - pivoting into a client's partner network is out of scope even if reachable through an in-scope host. Do not confuse persistence with covering tracks; deleting logs or hiding activity is normally out of scope for a penetration test and destroys evidence, yet you must still remove implants, added accounts, scheduled tasks, and modified configurations during cleanup. Document every command, timestamp, and artifact so cleanup can be verified and the report is defensible. Avoid touching real customer data; use benign proof files instead.
Rule of thumb: before pivoting, ask "is the destination in scope?"; before leaving, ask "can I prove I removed everything I added?"
Track objectives against the ROE - demonstrating impact to the agreed depth is the goal, not maximum damage.