PTES: Post Exploitation

Contents
1
Purpose
2
Rules of Engagement
2.1
Protect the Client
2.2
Protecting Yourself
3
Infrastructure Analysis
3.1
Network Configuration
3.1.1
Interfaces
3.1.2
Routing
3.1.3
DNS Servers
3.1.4
Cached DNS Entries
3.1.5
Proxy Servers
3.1.6
ARP Entries
3.2
Network Services
3.2.1
Listening Services
3.2.2
VPN Connections
3.2.3
Directory Services
3.2.4
Neighbors
4
Pillaging
4.1
Installed Programs
4.1.1
Startup Items
4.2
Installed Services
4.2.1
Security Services
4.2.2
File/Printer Shares
4.2.3
Database Servers
4.2.4
Directory Servers
4.2.5
Name Servers
4.2.6
Deployment Services
4.2.7
Certificate Authority
4.2.8
Source Code Management Server
4.2.9
Dynamic Host Configuration Server
4.2.10
Virtualization
4.2.11
Messaging
4.2.12
Monitoring and Management
4.2.13
Backup Systems
4.2.14
Networking Services (RADIUS,TACACS..etc)
4.3
Sensitive Data
4.3.1
Key-logging
4.3.2
Screen capture
4.3.3
Network traffic capture
4.3.4
Previous Audit reports
4.4
User Information
4.4.1
On System
4.4.2
Web Browsers
4.4.3
IM Clients
4.5
System Configuration
4.5.1
Password Policy
4.5.2
Security Policies
4.5.3
Configured Wireless Networks and Keys
5
High Value/Profile Targets
6
Data Exfiltration
6.1
Mapping of all possible exfiltration paths
6.2
Testing exfiltration paths
6.3
Measuring control strengths
7
Persistence
8
Further Penetration Into Infrastructure
8.1
From Compromised System
8.2
Thru Compromised System
9
Cleanup
Purpose
The purpose of the Post-Exploitation phase is to determine the value of the machine compromised and to maintain control of the machine for later use. The value of the machine is determined by the sensitivity of the data stored on it and the machines usefulness in further compromising the network. The methods described in this phase are meant to help the tester identify and document sensitive data, identify configuration settings, communication channels, and relationships with other network devices that can be used to gain further access to the network, and setup one or more methods of accessing the machine at a later time. In cases where these methods differ from the agreed upon Rules of Engagement, the Rules of Engagement must be followed.
Rules of Engagement
The following Rules of Engagement are specific to the Post-Exploitation phase of a penetration test and are intended to ensure that the client’s systems are not subjected to unnecessary risk by the (direct or indirect) actions of the testers and to ensure a mutually agreed procedure to follow during the post-exploitation phase of the project.
Protect the Client
The following rules are to be used as a guideline of rules to establish with a client to ensure that the day to day operations and data of the client are not exposed to risk:
Unless previously agreed upon, there will be no modification of services which the client deems “critical” to their infrastructure.  The purpose of modifying such services would be to demonstrate to the client how an attacker may:
Escalate privileges
Gain access to specific data
Cause denial of service
All modifications, including configuration changes, executed against a system must be documented. After finishing the intended purpose of the modification, all settings should be returned to their original positions if possible. The list of changes should be given to the client after the engagement to allow them to ensure all changes were properly undone. Changes that could not be returned to their original positions should be clearly differentiated from changes that were successfully reversed.
A detailed list of actions taken against compromised systems must be kept. The list should include the action taken and the time period in which it occurred.  Upon completion, this list should be included as an appendix to the final report.
Any and all private and/or personal user data (including passwords and system history) uncovered during the course of the penetration test may be used as leverage to gain further permissions or to execute other actions related to the test only if the following conditions are met:
The client’s Acceptable Use Policy states all systems are owned by the client and all data stored on those systems are the property of the client.
The Acceptable Use Policy states connection to the client’s network is considered consent for the connected machine to be searched and analyzed (including all present data and configurations).
The client has confirmation that all employees have read and understand the Acceptable Use Policy.
Passwords (including those in encrypted form) will not be included in the final report, or must be masked enough to ensure recipients of the report cannot recreate or guess the password. This is done to safeguard the confidentiality of the users the passwords belong to, as well as to maintain the integrity of the systems they protect.
Any method or device used to maintain access to compromised systems and that could affect the proper operation of the system or whose removal may cause downtime may not be implemented without the prior written consent of the client.
Any method or device which is used to maintain access to compromised systems must employ some form of user authentication such as digital certificates or login prompts. A reverse connection to a known controlled system is also acceptable.
All data gathered by the testers must be encrypted on the systems used by the testers.
Any information included in the report that could contain sensitive data (screenshots, tables, figures) must be sanitized or masked using techniques that render the data permanently unrecoverable by recipients of the report.
All data gathered will be destroyed once the client has accepted the final report. Method used and proof of destruction will be provided to the client.
If data gathered is regulated by any law, the systems used and their locations will be provided by the client to ensure that the data collected and processed does not violate any applicable laws. If the systems will be those of the penetration testing team the data may not be downloaded and stored on to their systems and only proof of access will be shown (File Permissions, Record Count, file names..etc).
Third party services for password cracking will not be used,  nor will there be sharing of any other type of data with third parties without the clients prior consent.
If evidence of a prior compromise if found in the assessed environment all logs with actions and times recorded during the assessment by the penetration team will be saved, hashed and provided to the client. The client can then determine how best to respond to and handle the incident response.
No logs should be removed, cleared or modified unless specifically authorized to do so by the client in the engagement contract/statement of work. If authorized, the logs must be backed up prior to any changes.
Protecting Yourself
Due to the nature of a penetration test, you must ensure that you cover all your bases when dealing with the client and the task