Exploit, escalate privileges and move laterally — Offensive Security & Penetration Testing

What You'll Build

In this phase you will test the attack chain you proposed, gaining an initial foothold, escalating privileges, and moving laterally within the authorized capstone lab, capturing evidence at every step. The deliverable is a validated (or revised) chain: proof of how far an attacker could actually get, documented with the impact demonstrated and, crucially, the remediation that would break each link. This is where the plan meets reality and the engagement's real risk is established through careful, authorized execution.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

The proposed attack chain and target map from Lesson 32, plus the signed authorization and scope confirmed before any exploitation.
Exploitation and escalation skills from Module 2, the disciplined read-verify-execute workflow and the enumerate-verify-report loop.
Web and network exploitation and lateral-movement understanding from Module 3, including blast-radius thinking and containment.
The safe-practice discipline from throughout, preferring non-destructive demonstrations over crash-prone techniques on any host.
Continuous, timestamped documentation, so each foothold, escalation, and hop is captured as evidence for the report.

Setup & Project Structure

Work only within the authorized capstone lab, and prepare your workspace to capture evidence for each phase of the chain: foothold, escalation, and lateral movement. Because this phase establishes the engagement's demonstrated impact, meticulous evidence capture is essential, each step must be reproducible and fully documented for the report. Keep your proposed chain from Lesson 32 open as the plan, ready to be validated where it holds and revised where reality diverges from your hypothesis.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Authorized capstone lab only. Prepare evidence capture for each link.
cd capstone && mkdir -p exploit/foothold exploit/escalate exploit/lateral

# Keep the plan (Lesson 32 chain) open; validate or revise it.
cat chain/attack_chain.md

# Evidence discipline: every step reproducible + timestamped.
echo Capture proof at each link: foothold -> escalation -> movement

Step 1 — Gain the Foothold

Test the first link of your chain by gaining initial access through the foothold you identified, following Module 2's disciplined workflow: understand the weakness, verify applicability, then execute against the in-scope target and manage the result. This should yield limited access, the starting point real engagements face. Capture evidence of the foothold and note what defenders could have observed. If this link fails, revise the chain using your recon, that adaptability is itself a professional skill.

Analogy🏏Cricket

🎬 Think of it like movies: A heist film's break-in is deliberate, not reckless, the crew studies the lock, confirms the approach works, then makes the single planned move that gets them through the door into a small, guarded room. Just as that understood, verified move beats kicking the door blindly, gaining a foothold through the read-verify-execute workflow beats firing exploits at random. Just as the crew notes which cameras saw them, you note what defenders could observe, and you change the plan if the entry fails. This reveals why the foothold is a disciplined first step yielding limited access, not instant control.

bash

# Test link 1: gain the foothold (Module 2 discipline, in scope).
#   understand the weakness -> verify -> execute against the target
#   -> capture proof of LIMITED access (e.g., id / whoami)

# If the foothold holds -> proceed to escalation.
# If it fails -> revise the chain using recon (backup foothold).
echo Foothold evidence -> exploit/foothold/ (with what defenders could see)

Step 2 — Escalate Privileges

From your foothold, test the escalation link using the enumerate-verify-report loop from Module 2: enumerate for misconfigurations, verify the most promising lead by hand, and escalate via the least disruptive confirmed path. Capture evidence of the elevated access achieved. Prefer safe misconfiguration routes over crash-prone techniques, exactly as the earlier modules stressed. Each successful step both validates your chain and adds a documented link to the connected story your report will tell.

Analogy🏏Cricket

🏏 Think of it like cricket: Having taken the first wicket, a smart bowler does not simply bowl faster and hope, they study the new batsman, identify a genuine, confirmed weakness, and attack it with the most controlled delivery rather than a wild bouncer that risks runs. Just as they target the verified flaw with the safest effective ball, you escalate through the enumerated, hand-verified misconfiguration by the least disruptive path. Just as a reckless delivery can gift the game away, a crash-prone technique can topple the host and end the test. This reveals why escalation is patient, verified pressure, not a violent gamble.

bash

# Test link 2: escalate (enumerate-verify-report loop, least-disruptive).
#   enumerate misconfigs -> verify the best lead by hand -> escalate safely
#   -> capture proof of ELEVATED access

# Prefer safe misconfiguration paths over crash-prone techniques.
echo Escalation evidence -> exploit/escalate/ (validated chain link)

Step 3 — Move Laterally

Finally, test the movement link using the lateral-movement thinking from Module 3: use the access or credentials gained to reach further systems, mapping the blast radius as you go. Note how far the compromise could realistically spread and, importantly, where segmentation or credential hygiene contains it, each containment point is a control that works. Capture evidence at every hop. Prefer demonstrating potential spread over reckless execution, and record where the chain reaches its authorized limit.

Analogy🏏Cricket

💪 Think of it like fitness: Testing how far a movement pattern travels, a coach traces which muscles a single exercise recruits down the chain, and notes exactly where good stabilizer strength stops the strain from spreading further. Just as that map shows both the reach and the point where the body's own discipline contains it, mapping lateral movement shows both how far a compromise spreads and where segmentation halts it. Just as each linked muscle is recorded, each hop and each containment point is captured. This reveals why lateral movement documents both the blast radius and the controls that actually work.

bash

# Test link 3: move laterally (Module 3 blast-radius thinking).
#   use gained access/creds to reach further systems (in scope)
#   -> MAP how far it spreads; note where segmentation/creds CONTAIN it
#   -> capture proof at each hop

# Prefer demonstrating potential spread over reckless execution.
echo Lateral evidence -> exploit/lateral/ (reach + working containment)

Step 4 — Validate the Chain and Note Detection

Close the phase by consolidating what you proved. Record which links of the chain held and which failed, since a failed link is a control that worked and is worth reporting. For each validated link, note what a defender's logs or monitoring would have shown, seeding the detection awareness your report can include. Finally, identify the single change, a patch, permission, or segmentation, that would most efficiently break the whole chain, previewing your remediation priorities for the phases ahead.

Analogy🏏Cricket

♟️ Think of it like chess: After a game, a strong player reviews the whole sequence, marking which combinations worked, which the opponent defended well, and pinpointing the single move that, if answered, would have refuted the entire attack. Just as that review turns a played game into precise lessons, consolidating the chain turns your execution into precise findings. Just as a defended line is worth noting as the opponent's strength, a failed link is worth reporting as a control that worked. This reveals why closing the phase means naming the one fix that would break the whole path.

bash

# Validate the chain and capture detection awareness.
cat > exploit/chain_result.md <<'EOF'
# Validated Attack Chain

- Links that HELD: <foothold/escalation/movement proven>
- Links that FAILED: <control that worked -> report as a strength>
- Detection notes: what defenders' logs/monitoring would have shown
- Chain-breaker: the single fix that neutralizes the most of the path
EOF
cat exploit/chain_result.md

Warning: This phase must stay entirely within the authorized capstone lab and scope, and any techniques carry real risk. Prefer non-destructive demonstrations, avoid crash-prone actions on fragile hosts, and never let a tempting chain lead you beyond the authorized targets. Handle any recovered credentials as sensitive, scope-bound data, and remember that all of this is only lawful because of the signed authorization, exactly the boundary that has governed every module of this course.

Extension Challenge: Deepen the phase three ways. First, for each validated link, record what a defender's logs or monitoring would have shown, feeding the detection awareness your report can include. Second, where a link failed, document why, a failed link is a control that worked and worth reporting. Third, identify the single change, patch, permission, or segmentation, that would most efficiently break the entire chain, previewing your remediation priorities.

This phase tests the proposed chain by gaining a foothold, escalating privileges, and moving laterally within the authorized lab, capturing evidence at each step.
The foothold is gained through Module 2's disciplined read-verify-execute workflow, yielding limited access, with the chain revised if the link fails.
Escalation applies the enumerate-verify-report loop, preferring the least disruptive confirmed misconfiguration path over crash-prone techniques.
Lateral movement maps the blast radius and, importantly, notes where segmentation or credential hygiene contains it, each containment being a working control.
Every link is documented with reproducible evidence and what defenders could observe, building the connected story for the report.
The whole phase stays within authorized targets and scope, prefers non-destructive demonstrations, and treats recovered credentials as sensitive data.