Chain a foothold into lateral reach, then break the chain

applied · 90 min · Objective 4.2

Task

Turn one compromised lab machine into reach across several, using credential replay, then apply each control in turn and measure which actually breaks the chain — because the obvious answers (longer passwords, rotation) do not work and the exam tests that. Objective 4.2 is authentication attacks.

Steps

  1. On the lab you own, build three VMs — one an administrator logs into interactively, all sharing a local admin password — and snapshot them.
  2. Compromise the weakest, obtain credential material, and use it to reach the others, recording each hop in /tmp/chain.md.
  3. Now test controls one at a time, reverting between each, and record in /tmp/controls.md whether the chain still works: (a) make the password longer — does it stop? (no); (b) rotate it — does it stop? (rarely fast enough); (c) give each machine a unique local password — (yes); (d) apply tiering so the admin never logs into the weak machine — (yes).
  4. For each control, record why it does or does not break the chain.

Verify

grep -cE "^hop [0-9]:" /tmp/chain.md
grep -cE "^(a|b|c|d):" /tmp/controls.md
grep -ciE "unique|tiering|stops|breaks the chain" /tmp/controls.md

The first count must be at least 2 — you moved between machines using replayed credentials. The second must be 4 — you tested each control. The third must be non-zero: you identified which controls actually break the chain (unique per-machine passwords and tiering), as opposed to the ones that feel like security and do nothing.

Notes

A replayed logon looks like a normal successful authentication, so the remediation is structural rather than alert-based — which is why monitoring alone does not save you. Protecting credential material in memory, restricted admin logon modes and multi-factor for interactive admin access all help; longer passwords and rotation do not. Everything ran on disposable machines you built, and the whole point is that "the passwords are hashed, so we're fine" is wrong for the protocol that accepts the hash.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.