Rogue Devices & Post-Exploitation
Entry is not the end state. Once you are inside, you need a disciplined answer to a simple question: what proof of access will satisfy the client objective with the least exposure and the least unnecessary blast radius? This chapter keeps the offensive tradecraft, but forces it into objective-driven choices.
Do The Minimum Needed To Prove Risk
Post-Entry Objective Matrix
| Objective | Example Action | Evidence | Control Lesson |
|---|---|---|---|
| Prove sensitive-area access | Photo evidence inside server or telecom room | Timestamped room photo, route notes | Segmentation and challenge controls failed before technology mattered |
| Validate network exposure | Temporary implant or laptop on accessible drop | Minimal network proof, switch port details, room context | Physical entry turned directly into internal access |
| Demonstrate workstation risk | Unlocked screen, unattended privileged session, or safe keystroke injection test | Photos, session context, limited proof command | Screen lock discipline and local monitoring did not interrupt abuse |
Tooling and Tactics
# USB and inline hardware tradecraft
# - O.MG Cable: covert keystroke / payload delivery
# - Hardware keylogger: inline keyboard logging where scope allows
# - Bash Bunny / Rubber Ducky: scripted workstation validation
# Network implant options
# - LAN Turtle: quiet foothold on network drop
# - Shark Jack: fast port / VLAN / segmentation checks
# - Raspberry Pi Zero / P4wnP1: multi-role gadget for USB + network tasks
# Physical concealment ideas
# - Behind monitors and docking stations
# - Under desks and conference tables
# - Inside cable trays, ceiling voids, or AV cabinets
# - Near underused jacks in meeting rooms and collaboration spaces
# High-risk advanced actions
# - Evil Maid style boot-path modification
# - DMA attack paths against live encrypted devices
# - Inline tampering with badge printers or access-control workstations
# Only perform the advanced actions above when the engagement language explicitly allows them.Placement and Exposure Considerations
Good Implant Conditions
- • Unused network drops near legitimate equipment
- • Conference rooms with cluttered cable management
- • Shared desks or hot-desking areas with many similar adapters
- • Spaces cleaners or contractors access routinely without scrutiny
Poor Implant Conditions
- • Cameras clearly watching the device handling area
- • Asset labeling and daily room checks by local staff
- • 802.1X or NAC likely to quarantine anything unknown
- • High-value zones where a photo proves the same point with less risk
Defender Questions To Answer
- • Could an unauthorized person reach a live network port without crossing a staffed control point?
- • Would NAC, switch controls, or endpoint policy block or isolate a rogue device quickly enough to matter?
- • Are conference rooms and shared spaces treated as part of the internal trust boundary or as public interiors?
- • Do local teams notice and challenge unfamiliar cables, adapters, and “temporary” maintenance devices?
Observation Record
For any device placed or touched on site, the record has to prove both reach and custody:
Device identity: Make, model, serial, and firmware or OS version of everything planted or used, so the client can reconcile it against their own inventory.
Interface used: USB port, network drop, console header, or keyboard injection, with the room, desk, and switch port it was attached to.
Minimum proof of reach: The smallest artefact that shows access: a DHCP lease, an ARP entry, a single authenticated request. Not a full packet dump and never a credential store.
Placement record: A photo of the location before and after, with the concealment point described in words as well as pictured.
Removal and state: Time the device was pulled, by whom, and the condition the desk, port, or cable was left in.
Authorisation line: The scope clause that covered the action, quoted, next to the action. Advanced actions without that quote do not belong in the report.
False Positives
- Dead port: A link light and a DHCP lease separate a live drop from a decorative one. A connector on the wall proves nothing on its own.
- NAC quarantined the device: Isolation is the control working. Report it as a pass, with the time from connection to quarantine.
- Device was found: A cleaner or a member of staff noticing the implant is detection. Score it as a detection win, not a failed placement.
- Lab-only configuration: A device that only works against your own DHCP or DNS server proves nothing about the client network.
- Pre-existing asset: Confirm the device is not the client monitoring or AV hardware before claiming you placed it.
Testing Checklist
Before placement
- ☐ Confirm the objective the device serves, and the smallest device that serves it.
- ☐ Record serial and firmware; wipe any data from previous engagements.
- ☐ Agree the removal window and who is allowed to remove it if you cannot return.
At the device
- ☐ Photo of the position before power, and after concealment.
- ☐ Confirm link, address, and one reachable service before leaving the room.
- ☐ Note who else was in the space and whether anything was moved.
After removal
- ☐ Capture the lease, log, or request that proves reach, then stop collecting.
- ☐ Return the port, cable, and desk to the photographed starting state.
- ☐ Hand over or destroy the collected data on the agreed date.
Remediation
Network
- • Apply 802.1X or NAC profiles to every access port, and disable unused ports in meeting rooms and print areas.
- • Alert on new MAC addresses in sensitive VLANs rather than reviewing them weekly.
Endpoint
- • Enforce USB device control on shared and conference-room machines, and a screen-lock timeout that survives a walk-away.
- • Treat workstation boot paths as protected: firmware passwords and measured boot where the fleet supports it.
Physical layer
- • Run scheduled room checks that include behind monitors and under desks, and label assets so an unknown device is obvious.
- • Use tamper-evident seals on network cabinets, and keep cable management tidy enough that an added device stands out.
Verification schedule
- • Re-test one room per floor at 90 days and after any desk move, refurbishment, or switch replacement.