Michael Gianarakis ,Keith Lee - Portia

### Automating the Internal Penetration Testing Lifecycle At 00:00, Michael Gianarakis and Keith Lee of Trustwave SpiderLabs introduce Portia, an open-source automation tool designed to streamline internal penetration testing. They explain that during enterprise engagements, testers frequently capture valid credentials early in the assessment (via responder attacks or password spraying). However, manually testing those credentials across hundreds of internal subnets, validating local administrator access, and extracting secrets is tedious and prone to human oversight. Portia was developed to automate post-exploitation workflows and accelerate paths to domain compromise.

### Modular Architecture and Initial Discovery At 06:15 and 11:30, the speakers walk through Portia's architecture. Built in Python, the tool coordinates diverse post-exploitation modules against targets identified via network scans or Active Directory LDAP queries. Testers supply compromised user credentials, NTLM hashes, or Kerberos tickets. Portia automatically interrogates remote hosts via SMB and WMI, establishing non-interactive command execution sessions without dropping noisy binaries onto target filesystems.

### Credential Harvesting and Memory Extraction At 16:44, the presentation details Portia's automated credential extraction capabilities. Once local administrative privileges are identified on a target endpoint, Portia can trigger in-memory execution of Mimikatz, dump the Security Account Manager (SAM) database, and extract Local Security Authority Subsystem Service (LSASS) secrets. The tool automatically ingests newly harvested credentials back into its central credential store, instantly queueing them for lateral movement across previously inaccessible subnets.

### Sensitive Data Hunting and File System Enumeration At 22:10 and 27:35, Gianarakis and Lee showcase Portia's automated file-hunting capabilities. Beyond searching for passwords, the framework crawls remote file shares, desktop directories, and network drives for high-value artifacts—including unencrypted configuration files, private SSH keys, KeePass databases, and connection strings containing database passwords. This allows penetration testers to quickly demonstrate business risk by surfacing confidential assets without manual directory searching.

### Privilege Graph Traversal and Mitigation Concluding between 29:40 and 32:08, the speakers demonstrate an automated privilege escalation path from an unprivileged workstation user to Domain Admin in minutes. They emphasize that organizations must counter automated lateral movement tools by enforcing the principle of least privilege, disabling legacy SMBv1 protocols, implementing Local Administrator Password Solution (LAPS) to eliminate shared local administrator credentials, and deploying endpoint detection and response (EDR) solutions to monitor suspicious LSASS access.

(AI summary — Gemini 3.8 Flash)