Take a version to a proven finding, and keep the cleanup list

applied · 90 min · Objective 4.1

Task

Walk a service all the way from a detected version to a proven, reproducible finding on a lab VM you built — knowing which step of the chain you are on at each point — and keep a cleanup list written as you go, so nothing is left behind. Objective 4.1 is network attacks, and the discipline is what separates a finding from a claim.

Steps

  1. On the lab you own, build a target with a known-vulnerable service on a disposable VM, snapshotted first.
  2. Walk the chain in /tmp/chain.md: the version detected, the candidate vulnerability, whether it actually applies to this build and configuration, and the proof. Label which step each note is on.
  3. Keep /tmp/cleanup.md open in a second window and add to it at the moment you cause each change — files dropped, processes started, accounts created, configuration altered, connections opened.
  4. Prove the finding: exploit it against your lab replica, capturing evidence and the exact invocation.
  5. Now do the cleanup from your list: reverse every change, then confirm the host matches the snapshot.
  6. Write the finding as it would appear in a report: evidence, impact, reproduction, remediation.

Verify

grep -cE "^step [1-4]:" /tmp/chain.md
grep -cE "^(dropped|started|created|altered|opened):" /tmp/cleanup.md
grep -cE "^##\s+(Evidence|Impact|Reproduction|Remediation)" /tmp/finding.md

The first count must be 4 — you tracked which step of version-to-proof you were on, so the finding does not overstate a candidate as confirmed. The second must be non-zero: you kept a real cleanup list as you went, not reconstructed at the end. The third must be 4: the finding has all four parts a client's engineer needs.

Notes

"Version 1.2.3 is affected by CVE-XXXX" is a candidate, not a finding; "confirmed the vulnerable configuration is present and demonstrated it against an identical build in our lab" is a finding. The cleanup list is written at the moment of change because reconstructing it from memory is how testers leave an access mechanism behind — the worst outcome in this course. Everything ran on a disposable VM you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.