Penetration › Module 9 › Lesson 3
Remediation Recs
Prioritized remediation from YOUR lab findings — owners, timelines, retest literacy.
Visual · t19_remediation_recs
Remediation rec = fix path + priority + owner placeholder. Original Cyberlium.
Opening
Recommendations turn proof into patch tickets — not a shopping list for attacking more hosts.
For each lab finding, recommend remediation: immediate (patch/config), short-term (monitoring rule), long-term (architecture — tiered admin on $LAB_AD). Assign priority P1/P2/P3, owner placeholder (lab-admin/you), and retest method (rescan lab VM, verify sudo removed). Link to VA-style retest literacy — safe confirmation on owned lab. Never recommend fixes on assets outside engagement or imply client should 'accept risk' on stranger Criticals you should never have tested. Remediation section closes the loop for capstone handoff.
1. Recommendation tiers
P1: direct path to brief goal (domain admin, root) — fix within 7 days in lab tracker scenario.
P2/P3: hygiene and hardening — segmented timelines.
Command guide
Try these commands — Recommendation tiers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Impact statement — lab context only CVSS literacy — https://www.first.org/cvss/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.first.org/cvss/ | head -5 grep impact "$HOME/cyberlium-lab/t19-finding.txt" 2>/dev/null || echo 'impact: (lab only)'
Primary tools to practice this lesson: grep, curl. Reference sites: Impact statement; CVSS literacy (https://www.first.org/cvss/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender actions
Specific: 'Remove NOPASSWD for www-data,' 'Rotate svc_web password 25+ chars,' 'Enable Credential Guard on jump hosts.'
Detection: SIEM rule for anomalous TGS requests after Kerberoast literacy finding.
3. Retest note
Describe safe retest on $LAB_VM/$LAB_AD — no exploit PoC required for closure documentation.
Failed retest reopens finding with new due date — lab tracker habit.
4. What you ship: remediation table
Remediation rows for ≥3 findings with priority owner retest — chmod 600.
5. What you record before the next lesson
Remediation table path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Recommend 'accept risk' on Critical for hosts you scanned without authorization.
Right
Prioritized remediation for lab findings. Next: Report Lab.
Mission: remediation table
1) Write remediation for three lab findings. 2) Assign P1/P2 and owner placeholder. 3) Add retest method per row.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Detection recommendation vs config fix?”
Knowledge Check
APPLY: Remediation should be:
Multiple choice
Knowledge Check
APPLY: True or False: Remediate stranger hosts from lab report.
True or False
Knowledge Check
APPLY: Retest on lab uses:
Multiple choice