{
  "phase": "L6-lateral-cred-harvest",
  "date": "2026-08-17",
  "operator_go": "3 (2026-08-17, cred harvest for lateral movement)",
  "host": "14.225.11.57 (CTE-SRW-057)",
  "access_used": "PG superuser superuser_user/postgres -> COPY FROM PROGRAM -> NETWORK SERVICE",
  "findings": {
    "local_admins": ["Administrator", "adminx", "geoserver", "iop"],
    "os_users": ["Administrator", "adminx", "geoserver", "iop", "caobang-api.cgis.asia", "hueplan-api.cgis.asia", "longkhanh-api.cgis.asia", "ninhthuan-api.cgis.asia", "quyhoachquocgia-api.cgis.asia", "sontay-api.cgis.asia", "uongbi-api.cgis.asia", "vsipsmartcity-api.cgis.asia", "ksnproxy", "MSSQL$SQLEXPRESS*", "Public"],
    "iis_app_pool_identities": "per-site Windows users (caobang-api, hueplan-api, etc.)",
    "pg_service": "postgresql-x64-9.6 STOPPED (we use a different PG instance/port)"
  },
  "os_auth_test": {
    "method": "PrincipalContext.ValidateCredentials (Machine context, local SAM)",
    "tested": ["geoserver:Ctech@123!", "geoserver:geoserver", "geoserver:Ctech2022!@#", "adminx:Ctech@123!", "adminx:Ctech2022!@#", "adminx:admin", "iop:Ctech@123!", "iop:Ctech2022!@#", "Administrator:Ctech@123!", "Administrator:Ctech2022!@#", "Administrator:123@123a"],
    "result": "ALL FALSE - no web-to-OS password reuse on .57"
  },
  "unattend": "none found",
  "rdp_saved": "none",
  "conclusion": {
    "lateral_via_password": "CLOSED on .57 - no OS password reuse",
    "lateral_note": "L5 already documented: SMB/WMI/PSRemoting between Windows hosts DENIED. So even with creds, remote exec to neighbors is blocked.",
    "system_without_potato": "ONLY documented path is Nexus on 14.225.11.28 (LocalSystem, unquoted path, writable C:\\TamDT) - from L5_windows_host_enum.json. Requires DLL/binary plant + service restart.",
    "recommendation": "Reassess: either (a) custom potato on .57 (SeImpersonate via PG/MSSQL ctx, unsigned binary, KES14+KSC risk), or (b) Nexus unquoted-path privesc on .28 (LocalSystem, but needs restart trigger), or (c) accept NETWORK SERVICE ceiling on PG hosts and focus on data/objectives"
  },
  "confidence": "CONFIRMED (ValidateCredentials direct output)",
  "sysmod": "none - read-only auth validation + registry/user enumeration",
  "artifacts": "L6_lateral_creds_raw.txt, L6_os_auth_raw.txt, this file"
}