Chapter 12 — Operating systems
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Configuration is usually enough"]
N2["12.2 Least privilege for the tester"]
N3["12.3 Local vs domain"]
N4["12.3b Image and offline analysis"]
N5["12.4b Recording host changes"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Configuration is usually enough"]
N2["12.2 Least privilege for the tester"]
N3["12.3 Local vs domain"]
N4["12.3b Image and offline analysis"]
N5["12.4b Recording host changes"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Configuration is usually enough]
|
v
[12.2 Least privilege for the tester]
|
v
[12.3 Local vs domain]
|
v
[12.3b Image and offline analysis]
|
v
[12.4b Recording host changes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) separate configuration review from runtime abuse; (2) collect OS evidence under least privilege; (3) record account use so revocation is possible.
12.1 Configuration is usually enough
Password policy, patch level, listening services and local admin group membership answer most OS questions in an authorized assessment. Reading those under an admin account granted for the engagement is different from exploiting a service to obtain that account. Prefer the former; PTES-style discovery stays inside the agreed methods.
Admin-granted reads answer patch level and local group membership without turning the engagement into a hunt for a foothold. That distinction matters for ethics and for clarity of remediation: a finding from a granted account is about exposure and policy, not about a break-in path. Sam records that the account was issued for the test so readers do not infer stealth access.
12.2 Least privilege for the tester
Issue a named assessment account with a time-boxed role. Log every elevation. At the end of the engagement, disable the account and rotate any shared secrets it touched. FindingsDesk should store the account id used for each finding so revocation can be checked.
A named, time-boxed account can be disabled without hunting shared passwords. Logging elevation makes unusual rights visible during the engagement, not only afterwards. Storing the account id on each finding makes the revocation checklist mechanical. Sam's close-out fails if any finding still points at an enabled test account.
12.3 Local vs domain
A local administrator on one host is not domain administrator. Findings must name the identity store (local SAM, LDAP, cloud IdP). Conflating them inflates severity and misdirects remediation.
Synthetic case — Riverstone Transit. SYN-005 was a lab service account with domain-admin rights — a directory finding, not a "Windows is broken" finding. Remediating meant removing the group membership and rotating the password, then verifying with a read of the group.
Remediation for a local admin is host hardening; remediation for domain admin is identity-store work. Mixing the labels sends the wrong team and the wrong urgency. Cloud identity providers add a third store that must be named explicitly. Sam's finding template requires the identity-store field before a ticket can leave draft.
12.4 Errors and limits
OS vendors change defaults; cite the version you observed. Do not disable security tools to "make the test work"; if a tool blocks you, that is a result under the ROE.
Defaults from last year's hardening guide may not match the build you saw. Citing the observed version keeps the finding checkable. A security tool that blocks a probe has done its job under the ROE; turning it off would invent a different system than the client runs. Sam reports the block and moves on to the next planned check.
12.3b Image and offline analysis
Full-disk images are high impact: they take systems offline, contain personal data, and tempt out-of-scope browsing. Prefer live, least-privilege reads. If an image is truly required, the ROE must name chain-of-custody, encryption at rest, who may mount it, and a destroy-by date — and the course labs still do not practice imaging real hosts.
Images are a last resort because of downtime and privacy. Live reads under least privilege answer most questions without copying whole disks. When an image is unavoidable, chain-of-custody and a destroy-by date are ROE requirements, not niceties. Course labs never image real hosts, so students practice the decision to avoid imaging rather than the imaging itself.
12.4b Recording host changes
Any setting a tester changes on a host, even a temporary log level, is written to the engagement log with time, reason and the command used to revert it. At close-out Sam walks that list with the system owner, so no Riverstone Transit host is left in a state nobody remembers creating.
A revert command written at the time survives staff turnover and weekend shifts. Walking the list with the owner turns close-out into a shared checklist rather than a memory test. Sam refuses to mark an engagement complete while any unreverted change remains on the list.
Exercises
- EX034 — Account design. Specify a least-privilege assessment account for reading local admin group membership on three Windows hosts. Rubric: 3 = named account, group/role, time box, logging, revocation; 2 = three of five; 1 = "admin"; 0 = none.
- EX035 — Severity wording. Rewrite "we got SYSTEM everywhere" as a scoped finding sentence. Rubric: 3 = identity, hosts, method (config/authz), no exploit; 2 = missing scope; 1 = still vague; 0 = exploit language.
- EX036 — Revocation check. List three post-engagement checks that the assessment account is gone. Rubric: 3 = directory disabled, local leftover, ticket/log review; 2 = two; 1 = one; 0 = none.
Synthesis
Read configuration with a temporary account; name the identity store; revoke when done.
Continue studying — chapter 12 of 50
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →