When doing a PT, are we allowed to root servers to escalate privileges? I am planning for post exploitation and it necessary to root server for that. So it is better to stop there or go further.
In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case.
The Rules of Engagement specify whether or not you can root a server. A few things are considered for this:
- Is the server a Production one? If yes, then certainly you should restrain from rooting it.
- If its a Test server, you have to be consider whether rooting this server can be directly be used to compromise/sniff/etc any Production servers on same network. If so, then probably you should not root it.
- Businesses/Financial Impact that you may cause by rooting the server and post exploitation steps.
- Also, you have to consider the terms/agreements you have agreed to. Sometimes, there can be backlashes from management even if your intentions are good.
If you are not sure, better check with some person responsible for the servers (management).
Ultimately, post-exploitation does not require rooting a server, but is one option for performing the task.
In addition to the things said by Sravan, you should put in some effort to avoid doing anything to the server that's hard to reverse. Even though attackers are unlikely to stick to easily reversible actions, a company does not benefit from a prolonged downtime that stems from a poorly executed audit or test. There are already a number of horror stories out there that mention an auditor breaking the core business machines so hard that the company needs a week to recover because the auditor took out the backups at the same time.
So even if your RoE state that you can root a server, if the way you found to root a server would break it in a way that's not simply "restore from backup", like reflashing firmware or breaking hardware, you should not attempt doing so unless you have permission, either through the RoE or through an additional clarification request.