Capture state-transition, proof and exploit-adaptation evidence

Needs: Known destination/identity, observable effect and a private evidence destination; actual exam proof requirements must be read from current official guidance

Linux

# Linux
date -Is
hostname
id
ip addr
ip route

Windows

REM Windows
echo %DATE% %TIME%
hostname
whoami /all
ipconfig /all
route print

Use a compact transition packet

the observation that selected the path;

the exact command/request with secrets redacted in the reusable copy;

relevant output or response;

host and identity verification;

the effect/new capability;

cleanup/restoration; and

the next re-enumeration result.

# Use a compact transition packet
time/timezone | source host/interface | target host/service | starting identity
observation | prerequisite | exact action | decisive output
new identity/access/route | evidence files | cleanup | next re-enumeration

Shell commands

Capture the transition when it happens. Reconstructing it later risks losing a required token, request, route, working directory, listener or source identity.

# Baseline
mkdir -p evidence/nmap evidence/web evidence/loot evidence/screenshots
nmap -Pn -sV -sC -p PORTS TARGET -oA evidence/nmap/TARGET-services
script -q -f evidence/session.txt

PowerShell commands

# Baseline
Start-Transcript -Path .\evidence\powershell-session.txt
# commands
Stop-Transcript

Hash important transferred or generated artifacts

# Hash important transferred or generated artifacts
sha256sum FILE | tee FILE.sha256

Linux example layout

Current official exam guidance requires proof-file content to be displayed from its original location in an interactive target shell and included in a screenshot with the target IP. The control-panel submission is separate and must occur before the exam ends. Recheck the guide immediately before an exam because these rules can change.

# Linux example layout
hostname; id; ip addr
cat /root/proof.txt

Windows example layout

REM Windows example layout
hostname & whoami & ipconfig
type C:\Users\Administrator\Desktop\proof.txt

Shell commands

Use the actual objective-provided path and required identity. Do not use AI on actual exam targets, proofs or reports; the current guide prohibits AI chatbots during the exam.

# Baseline
git diff --no-index original.py modified.py > exploit-changes.diff
sha256sum original.py modified.py

Commands

<!-- Baseline -->
### Objective / result

**Starting state:** source host, network position and identity.

1. Observation and evidence.
2. Enumeration command/request and decisive output.
3. Vulnerability/prerequisite validation.
4. Exploitation command/request, including required listener/route.
5. Session verification: host, identity and privilege.
6. Escalation evidence and final verification.
7. Cleanup/restoration.

**Artifacts:** screenshots, saved output, hashes and exploit source/diff.

Verify → Tie evidence to the correct target and transition, with no invented success or missing reproduction step.

If it fails → A screenshot without identity/target context or an exploit success string without effect is incomplete. Keep real targets, credentials and proofs private. More detail ↓

If → then

Verified findings and private transition evidence are ready for reporting → Build and validate the report and submission artifacts
Needs: Complete reproduction path, required screenshots/proofs, suitable document tooling and the current submission naming/archive rules
Several hosts, identities, routes or competing hypotheses need coordination → Maintain state and select the next evidence-producing test
Needs: Explicit scope/objective and a record of observations, unknowns and available capabilities
A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
Needs: A working command channel and accurate effective identity, group, mount and process context
A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Capture state-transition, proof and exploit-adaptation evidence

USE WHEN: Access, privilege, identity or route changes, or a report will need reproduction
STARTING ACCESS: An assigned objective, scope and accumulated host/identity/route evidence
RESULT: A private reproducible transition record with commands, output, identity and effect

Recognize the clue

At every observed access/identity/privilege change inspect whether saved output ties the effect to the correct host, token and command/request.

hostname
id
ip addr

SYNTHETIC EXAMPLE OUTPUT

Saved record: command and output present
Host/identity: recorded
Route and reproduction parameters: missing

Means: A success screenshot or identity line can be real while the reproduction path is incomplete.

Confirm: Capture the exact source/destination, method, material context, transition, relevant proof and adaptation steps privately.

After validation: The transition can be independently reconstructed from retained evidence: promote that verified result to the report.
Ruled out in this context: The record comes from the wrong host/context: reject it as proof for this objective.
Still inconclusive: A tool success string without observed effect leaves the access claim unproved.

Troubleshooting: A screenshot without identity/target context or an exploit success string without effect is incomplete. Keep real targets, credentials and proofs private.

Linux:

Windows:

For each access or escalation, retain:

the observation that selected the path;
the exact command/request with secrets redacted in the reusable copy;
relevant output or response;
host and identity verification;
the effect/new capability;
cleanup/restoration; and
the next re-enumeration result.

Use a compact transition packet:

Capture the transition when it happens. Reconstructing it later risks losing a required token, request, route, working directory, listener or source identity.

Run exit when finished so the transcript closes and flushes. Do not record unrelated secrets in a broad transcript.

Hash important transferred or generated artifacts:

Never publish credentials, flags, target IPs, full private transcripts or copyrighted course text to this repository.

Current official exam guidance requires proof-file content to be displayed from its original location in an interactive target shell and included in a screenshot with the target IP. The control-panel submission is separate and must occur before the exam ends. Recheck the guide immediately before an exam because these rules can change.

Linux example layout:

Windows example layout:

Use the actual objective-provided path and required identity. Do not use AI on actual exam targets, proofs or reports; the current guide prohibits AI chatbots during the exam.

For an unmodified exploit, retain its source URL rather than pasting pages of code. For a modified exploit, retain:

original URL and version/commit;
local modified copy;
a focused diff/highlight of changes;
why each change was necessary;
build/interpreter command and dependencies;
payload-generation command, if any; and
exact execution and result verification.

Write steps in execution order. Explain why a command was needed and what the output established; a transcript alone is not a report.

Why it works

A proof screenshot establishes a narrow state; reproduction also needs the preceding request/command, parameters, exploit changes and route. Evidence captured during the transition is more reliable than later reconstruction.

Worked example · hypothetical

Observation: a higher-privilege session appears. Test: capture host, identity, relevant interface and the objective evidence immediately. Illustrative output: the transition can be replayed from retained commands and saved output. Interpretation: report it as the verified effect only.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗