santosomar/pt-post-exploitation

Post-Exploitation

Authorized Use Only

Run post-exploitation tasks only after explicit approval for this phase. Keep actions controlled, reversible, and auditable. Avoid destructive changes and unnecessary access to sensitive data.

Objectives

1. Measure realistic impact after initial access.
2. Evaluate privilege escalation and lateral movement opportunities.
3. Identify credential and data exposure paths.
4. Assess logging, detection, and response effectiveness.

Workflow

1. Confirm phase boundaries:
   • Allowed techniques, prohibited actions, and stop conditions
   • Approved systems, accounts, and time windows
2. Stabilize foothold context:
   • Document current privileges and reachable assets
   • Capture baseline telemetry and controls in place
3. Conduct controlled post-exploitation checks:
   • Privilege escalation feasibility
   • Credential access and reuse opportunities
   • Lateral movement paths through trust relationships
   • Data access paths tied to business impact
4. Evaluate defense visibility:
   • Which actions generated alerts
   • How quickly detection and containment occurred
5. Cleanup and rollback:
   • Remove all artifacts created during testing
   • Verify environment returns to expected state

Output Template

# Post-Exploitation Output

## Initial Context
- Entry point:
- Starting privilege:
- Scope constraints:

## Escalation and Movement Findings
- Finding:
  - Preconditions:
  - Evidence:
  - Result:
  - Impact:

## Credential and Data Exposure
- Exposure path:
  - Affected assets/data:
  - Business risk:

## Detection and Response
- Alerts observed:
- Time to detect:
- Time to contain:
- Gaps:

## Cleanup Verification
- Artifacts removed:
- Validation notes:

Quality Checks

• Every action is within approved boundaries.
• Evidence supports reproducibility without sensitive data leakage.
• Findings map clearly from technical path to business consequence.