Skill: Privileged Access Management (PAM) Privilege Attack

Supplementary Files:

• payloads.md -- Per-vendor payload catalogs for CyberArk, BeyondTrust, Delinea, One Identity, ManageEngine PMP, WALLIX, Devolutions, Xton Core; plus cross-cutting patterns (cred file theft, session hijack, API key abuse, JIT workflow bypass, PAM-aware pass-the-hash) (70+ code blocks, 2,200+ lines)
• test-cases.md -- Structured test case templates (15 cases TC-PM-001 through TC-PM-015 covering presence recon, vendor-specific abuse, and cross-cutting patterns)
• guides/pam-privilege-attack-playbook.md -- End-to-end playbook: PAM recon, vendor identification, exploitation, credential extraction, lateral movement to actual privileged targets, JIT persistence, lab setup, and detection guidance

Summary

PAM Privilege Attack skill domain covering vendor-specific compromise of Privileged Access Management platforms. PAM systems (CyberArk, BeyondTrust, Delinea, One Identity, ManageEngine, WALLIX, Devolutions, Xton) sit at the very top of the enterprise trust stack — they hold the credentials for root, Domain Admin, cloud root, database SA, and network device enable accounts. Compromising the PAM is equivalent to compromising every privileged asset the PAM manages. Recent ransomware operators (BlackCat/ALPHV, LockBit, Royal/BlackSuit) explicitly target PAM infrastructure as the first step in their affiliate playbooks because once the PAM falls, downstream extortion leverage is total.

Domain: privileged-access-management

MITRE ATT&CK: T1552-Unsecured Credentials, T1552.001-Credentials In Files, T1552.004-Private Keys, T1550-Use Alternate Authentication Material, T1550.002-Pass the Hash, T1550.004-Web Session Cookie, T1098-Account Manipulation

Differentiation from Adjacent Skills

This skill is deliberately scoped to vendor-specific PAM platforms. It does not duplicate general secret-management coverage.

Topic	secret-management-attack	ad-ldap-attack / ad-cs-abuse	pam-privilege-attack (this skill)
Scope	HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, CI/CD pipeline secrets, source-code secrets	Active Directory, AD CS PKI	CyberArk, BeyondTrust, Delinea, One Identity, ManageEngine PMP, WALLIX, Devolutions, Xton
Credential type	Cloud API keys, tokens, CI variables, source-code secrets	NTLM hashes, Kerberos tickets, X.509 certs	Vaulted privileged credentials, PSM session tokens, PAM API keys, JIT access workflows
Attack surface	Cloud provider APIs, Vault HTTP API, git history, image layers	LDAP, Kerberos, AD CS RPC/HTTP	Vendor-specific HTTP/WS/RPC APIs, credential file formats (.cue, DPAPI blobs), session brokers
Primary attacker	Cloud-aware red team, secret sprawl auditor	Internal AD red teamer	Ransomware operator, insider threat, third-party access abuser
Real-world anchor	Codecov, CircleCI, LastPass, Toyota	PetitPotam, Certifried, NotPetYa	BlackCat PAM targeting (Mandiant 2023), LockBit CyberArk playbook (CrowdStrike 2023), Royal/BlackSuit BeyondTrust abuse

When the engagement involves the strings CyberArk, PVWA, PSM, EPV, Password Vault, BeyondTrust, Password Safe, Privileged Remote Access, Secret Server, Thycotic, Delinea, One Identity, Safeguard, Password Manager Pro, PMP, WALLIX Access Manager, Bastion, Devolutions Server, Xton Core, or specific artifacts like .cue files, Vault.ini, btl\ (BeyondTrust session ID prefixes), route through this skill. If both PAM and AD are in scope, chain: PAM compromise → credential extraction → use the harvested privileged account with ad-ldap-attack or cloud-security techniques for downstream dominance.

Description

A PAM platform is fundamentally a credential broker: it accepts a request from an authenticated user ("I need to SSH to prod-db-01 as root"), authenticates and authorises the request against policy, retrieves the privileged credential from an encrypted vault, brokers the connection (often via a jump host / session manager), records the session, and rotates the credential on completion. Every step in this flow is an attack surface — the authentication layer (PVWA logon, PRA SAML, PMP API key), the authorization layer (safe ACLs, JIT workflow bypass), the retrieval layer (credential file decryption, AIM provider abuse), the brokering layer (PSM session hijack, PRA session recording tampering), and the rotation layer (forcing rotation failure to keep credentials usable).

This skill emphasises realistic Kali Linux tooling: native HTTP clients (curl, httpie, python-requests) for vendor APIs, WebSocket clients for CyberArk WebSocket endpoints, Impacket and psexec.py for using harvested credentials, mimikatz and SharpDPAPI for credential file and DPAPI blob decryption on Windows footholds, CyberArk-PSM-Decryptor and credential-file-parsers for .cue/.btl/DPAPI-protected format decoding, vendor CLIs (cyberark PowerShell module, Delinea API SDK, ManageEngine PMP REST client), CyberArk PACLI and parcli tooling, BloodHound for analysing PAM-aware group topology, and generic Kali tools (nmap, gobuster, nuclei) for the recon phase. Each pattern includes the relevant CVE (CVE-2025-32564 for CyberArk PVWA, CVE-2022-2451 for BeyondTrust SAML, CVE-2022-28226 for ManageEngine PMP) and vendor security advisory references where public CVEs do not exist.

The attack chain typically begins with PAM presence detection — identifying that the target runs CyberArk by finding /PasswordVault/, BeyondTrust via /login.aspx with B cookie prefix, Delinea Secret Server via /SecretServer/, ManageEngine PMP via the favicon hash and /api/ endpoints. From there, the attacker enumerates the authentication surface, attempts credential stuffing (low-rate to evade PAM lockout policies), exploits vendor-specific auth bypass where present, and once inside, harvests every credential the compromised identity can reach. The endgame is rarely "staying inside the PAM" — it is using the PAM as a privileged credential firehose to dominate the downstream estate.

Use Cases

1. CyberArk PVWA Compromise Assessment -- During an internal engagement, identify the CyberArk PVWA URL, attempt CVE-2025-32564-class authentication bypass, enumerate safes via the WebSocket interface, and demonstrate impact by extracting a Domain Admin credential from a low-privilege vault user.
2. PSM Session Hijacking -- From a foothold inside the PSM infrastructure, identify active PSM sessions, hijack the RDP/SSH session token, and pivot to the actual privileged target without re-authenticating.
3. CyberArk Credential File (.cue) Decryption -- Recover .cue credential files from the AIM/CCP provider cache or the EPV server, decrypt them with the master key or via operator key escrow weakness, and recover plaintext credentials.
4. BeyondTrust PRA SAML Account Injection -- Exploit CVE-2022-2451 to inject an unauthorised SAML identity into the PRA, granting remote privileged access without a local account.
5. Delinea Secret Server OAuth Token Theft -- From a foothold on a host running the Secret Server agent, extract the OAuth refresh token from the DPAPI-protected configuration, and use it to read secrets from the Secret Server API without the user's password.
6. ManageEngine PMP PostgreSQL Backend Extraction -- From a foothold on the PMP server, dump the embedded PostgreSQL backend, recover the encrypted credential table, and decrypt the AES-encrypted credentials using the PMP master key (typically stored in pmp_key.key).
7. One Identity Safeguard SSL Pinning Bypass -- Use Frida or Burp + a custom CA + pinning-bypass script to inspect the admin console's API surface, enabling the discovery of unauthenticated privileged session fabric endpoints.
8. Just-in-Time Access Workflow Bypass -- From a foothold that holds a stale JIT approval token, abuse the PAM's lack of session binding to extend the access window beyond the approved duration.
9. PAM-Aware Pass-the-Hash -- After compromising a credential that is currently checked out from the PAM and rotated on schedule, use the hash within the rotation window before the PAM forces the next change.
10. Ransomware Operator PAM Playbook Validation (Purple Team) -- In a defensive engagement, simulate the BlackCat PAM targeting playbook (initial access via VPN appliance → PAM enumeration → PAM compromise → mass credential retrieval → simultaneous ESXi/AD/cloud impact) and measure detection coverage.

Core Tools

Cross-Vendor Tools

Tool	Category	Purpose
curl / httpie / python-requests	HTTP/HTTPS Recon & API	Universal vendor HTTP API probing
websocat / python-websockets	WebSocket Recon	CyberArk WebSocket safe enumeration
nmap / nuclei	Service Discovery	Identify PAM product by TLS/HTTP fingerprint
gobuster / feroxbuster	Path Discovery	Locate /PasswordVault/, /SecretServer/, /api/
BloodHound (SharpHound collector)	Topology Analysis	Map PAM-managed account → host edges
Impacket (psexec.py, wmiexec.py, smbexec.py)	Credential Use	Convert PAM-recovered credentials into shells
mimikatz / SharpDPAPI / dpapi.py (Impacket)	DPAPI Decryption	Decrypt DPAPI-protected PAM agent configs
Frida / objection	SSL Pinning Bypass	One Identity Safeguard, mobile PAM apps
Burp Suite / mitmproxy	API Interception	PAM HTTP API fuzzing, SAML response editing
CyberChef	Format Decoding	Decode .cue, base64, vendor-specific blob formats

Vendor-Specific Tools

Tool	Vendor	Purpose
CyberArk PS CLI (CyberArk-PasswordVault)	CyberArk	Official PowerShell wrapper for PVWA REST API
PACLI	CyberArk	Legacy command-line Vault client (still deployed)
parcli / capam1	CyberArk	Community Vault utilities
cyberark-psm-decryptor (community)	CyberArk	Decrypt PSM-generated trace logs and cred files
BeyondTrust API SDK (b pysafe)	BeyondTrust	Python client for Password Safe / PRA API
Delinea Secret Server SDK	Delinea	.NET / PowerShell wrapper for SS REST API
thycotic-python (community)	Delinea	Python SDK for legacy Thycotic SS
ManageEngine PMP REST SDK	ManageEngine	Python wrapper for PMP API
pmp-pgsql-dump (community)	ManageEngine	PMP PostgreSQL backend dumper
Safeguard API client (safeguard-bash)	One Identity	Native shell client for Safeguard for Privileged Sessions (SPS) / Safeguard for Privileged Passwords (SPP)
WALLIX Access Manager CLI	WALLIX	wabadmin shell tooling
Devolutions Server CLI (DVLS)	Devolutions	PowerShell module for DVLS API

Methodology

Phase 1: PAM Presence Reconnaissance

Identify which PAM product(s) the target runs before attempting vendor-specific attacks.

1. Identify web-facing PAM consoles via URL patterns (/PasswordVault/ → CyberArk, /SecretServer/ → Delinea, /login.aspx + BeyondTrust cookies → PRA, /api/json/... → ManageEngine PMP, /sps/ → One Identity Safeguard, /wab/ → WALLIX)
2. Fingerprint via TLS certificate SANs, favicon hashes, and HTTP header signatures (Server: Microsoft-IIS + X-Powered-By: ASP.NET → likely Delinea Secret Server or PRA)
3. Identify the supporting infrastructure: CyberArk EPV (Vault) on TCP/1858, AIM/CCP on TCP/443 + a /AIMWebApi/ URL, PSM on RDP/3389, BeyondTrust PRA appliance, ManageEngine PMP on TCP/7272 (default), WALLIX Bastion on TCP/443 + SSH/22
4. Map DNS for naming patterns (vault., pam., cyberark., beyondtrust., pmp-, safeguard-, bastion.) to find management interfaces

Phase 2: Authentication Surface Enumeration

Once the product is identified, enumerate every authentication path.

1. Map the login endpoints (form-based, SAML, OAuth, RADIUS-backed, LDAP-backed)
2. Identify the MFA enforcement surface (CyberArk Risk-Based MFA, BeyondTrust 2FA, PMP TFA, Safeguard smart card)
3. Check for default/weak credentials (cyberark/Admin123, boftelement/beyond, ssadmin/Admin123User, admin/admin)
4. Identify CVE-specific authentication-bypass conditions (CVE-2025-32564 for PVWA SMB auth mode, CVE-2022-2451 for PRA SAML, CVE-2022-28226 for PMP path traversal pre-auth)

Phase 3: Authentication and Initial Foothold

Obtain an authenticated session inside the PAM.

1. Apply vendor-specific auth bypass where applicable, or use harvested credentials from secret-management-attack or phishing-attack skills
2. Convert the authenticated session into a stable API token (CyberArk <token> via /Auth/Roles/Logon, BeyondTrust Bearer via /oauth2/token, Delinea Bearer via /oauth2/token, PMP via /api/json/admin/getkey API key flow)
3. Validate the token's scope (read-only vault user vs. safe owner vs. auditor vs. Enterprise admin)
4. Persist access via a long-lived refresh token or by creating a backdoor account where privilege allows

Phase 4: Credential Enumeration and Extraction

Walk every safe/account the authenticated identity can reach and harvest credentials.

1. Enumerate safes (CyberArk /PasswordVault/api/Safes, BeyondTrust /UserRoles/..., Delinea /v1/secrets, PMP /api/json/resources/list, Safeguard /v3/Assets)
2. For each safe, enumerate accounts and pull the current credential value (password, SSH key, AWS key)
3. Where the API exposes a "show password" endpoint (CyberArk /api/Accounts/<id>/Password/Retrieve, Delinea /v1/secrets/<id>/fields/password), retrieve and immediately verify against the target
4. For credentials not exposed via API (CyberArk EPV-restricted, BeyondTrust checked-out), pivot to agent-side extraction (.cue file, DPAPI blob, agent config)

Phase 5: PAM Lateral Movement and Downstream Exploitation

Use harvested credentials to dominate the actual privileged estate.

1. Identify each credential's target host from the safe metadata (CyberArk address field, BeyondTrust AssetName, Delinea Secret.ServerName)
2. Convert each credential into a foothold via the appropriate skill (ad-ldap-attack for AD accounts, cloud-security for cloud keys, database-attack for DB credentials, network-pentest for network device enable accounts)
3. Where the PAM is brokering sessions (PSM, PRA, Safeguard Sessions2), consider hijacking active sessions instead of re-authenticating
4. Cross-reference with BloodHound topology to identify which harvested credentials unlock the highest-value paths

Phase 6: Persistence and Anti-Forensics

Establish durable access and reduce the forensic footprint.

1. Persist via the PAM itself — create a backdoor safe owner, register a rogue AIM application, or install a long-lived API key
2. JIT workflow abuse — issue standing access requests in cycles to maintain continuous access without an audit-time mass credential retrieval event
3. Session recording tampering — where session recording is in scope, identify the recording storage and the chain-of-custody controls; coordinated attackers (BlackCat) have been observed deleting session recordings as a step in the playbook
4. Audit log hygiene — understand what the PAM logs (Vault Audit, ITAudit, ProcessLog) and structure the access pattern to blend with normal operator traffic

Practical Steps

Step 1: Identify PAM Presence via URL Patterns

# CyberArk PVWA discovery
curl -sk -I https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/ | head -5

# Delinea Secret Server discovery
curl -sk -I https://REPLACE_WITH_YOUR_SS_HOST/SecretServer/ | head -5

# BeyondTrust PRA discovery (look for the auth/identity cookie prefixes)
curl -sk -I https://REPLACE_WITH_YOUR_PRA_HOST/login.aspx | grep -i 'set-cookie'

# ManageEngine PMP discovery (default port 7272)
curl -sk -I http://REPLACE_WITH_YOUR_PMP_HOST:7272/ | head -5

# One Identity Safeguard discovery
curl -sk -I https://REPLACE_WITH_YOUR_SG_HOST/sps/ | head -5

# WALLIX Bastion discovery
curl -sk -I https://REPLACE_WITH_YOUR_WAB_HOST:443/wab/ | head -5

Step 2: CyberArk PVWA Authentication

# Standard logon (LDAP, CyberArk, RADIUS, SAML)
curl -sk -X POST -H 'Content-Type: application/json' \
  -d '{"username":"REPLACE_WITH_YOUR_VAULT_USER","password":"REPLACE_WITH_YOUR_VAULT_PASS"}' \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/auth/Cyberark/Logon | jq -r .token

# Persist the token
TOKEN=$(curl -sk -X POST -H 'Content-Type: application/json' \
  -d '{"username":"REPLACE_WITH_YOUR_VAULT_USER","password":"REPLACE_WITH_YOUR_VAULT_PASS"}' \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/auth/Cyberark/Logon | jq -r .token)

# Validate the session
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/Session/Verify

Step 3: Enumerate CyberArk Safes

# List every safe the token can see
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/Safes \
  | jq '.Safes[] | {SafeName, NumberOfAccounts, ManageMembers}'

# Enumerate accounts in a target safe
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/Accounts?filter=safename eq REPLACE_WITH_YOUR_SAFE_NAME" \
  | jq '.value[] | {name, address, userName}'

Step 4: CyberArk Credential Retrieval

# Retrieve the current password value of an account
curl -sk -X POST -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/Accounts/REPLACE_WITH_YOUR_ACCT_ID/Password/Retrieve \
  -d '{"reason":"incident-response","TicketingSystemName":"jira"}' | jq -r .password

# Retrieve SSH keys (returns PEM)
curl -sk -X POST -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  https://REPLACE_WITH_YOUR_PVWA_HOST/PasswordVault/api/Accounts/REPLACE_WITH_YOUR_ACCT_ID/Secret/Retrieve \
  -d '{"reason":"incident-response"}'

Step 5: BeyondTrust PRA API Authentication

# Acquire OAuth bearer token (alternative: API key via System Settings > API Configuration)
BT_TOKEN=$(curl -sk -X POST \
  -u 'REPLACE_WITH_YOUR_API_KEY:' \
  -d 'grant_type=client_credentials' \
  https://REPLACE_WITH_YOUR_PRA_HOST/api/oauth2/token | jq -r .access_token)

# Validate
curl -sk -H "Authorization: Bearer $BT_TOKEN" \
  https://REPLACE_WITH_YOUR_PRA_HOST/api/v1/auth/whoami

Step 6: ManageEngine PMP API Key Enumeration

# Acquire the API token via the admin API key flow
PMP_TOKEN=$(curl -sk -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=REPLACE_WITH_YOUR_PMP_USER&password=REPLACE_WITH_YOUR_PMP_PASS' \
  https://REPLACE_WITH_YOUR_PMP_HOST:7272/api/json/admin/getkey \
  | jq -r .api_key)

# Enumerate resources (the password stores / accounts PMP manages)
curl -sk -H "AUTHTOKEN=$PMP_TOKEN" \
  'https://REPLACE_WITH_YOUR_PMP_HOST:7272/api/json/resources/list' | jq .

# Pull the password for a specific resource
curl -sk -H "AUTHTOKEN=$PMP_TOKEN" \
  'https://REPLACE_WITH_YOUR_PMP_HOST:7272/api/json/resource/REPLACE_WITH_YOUR_RES_ID/getPasswordAccountDetails' | jq .

Step 7: Delinea Secret Server OAuth Flow

# OAuth token via password grant (deprecated but still common)
SS_TOKEN=$(curl -sk -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=password&username=REPLACE_WITH_YOUR_SS_USER&password=REPLACE_WITH_YOUR_SS_PASS' \
  https://REPLACE_WITH_YOUR_SS_HOST/SecretServer/oauth2/token | jq -r .access_token)

# Enumerate folders and secrets
curl -sk -H "Authorization: Bearer $SS_TOKEN" \
  https://REPLACE_WITH_YOUR_SS_HOST/api/v1/folders | jq .

curl -sk -H "Authorization: Bearer $SS_TOKEN" \
  https://REPLACE_WITH_YOUR_SS_HOST/api/v1/secrets | jq '.records[] | {id, name, secretTemplateName}'

Step 8: Convert a Harvested Credential to a Foothold

# Given a Domain Admin credential recovered from CyberArk
DOMAIN='REPLACE_WITH_YOUR_DOMAIN'
USER='REPLACE_WITH_YOUR_DA_NAME'
PASS='REPLACE_WITH_YOUR_DA_PASS'
DC_IP='REPLACE_WITH_YOUR_DC_IP'

# Verify against LDAP
ldapsearch -x -H "ldap://$DC_IP" -D "$DOMAIN\\$USER" -w "$PASS" -s sub -b "" namingcontexts | head -5

# Use the credential to dump domain hashes (no prior foothold needed)
impacket-secretsdump "$DOMAIN/$USER:$PASS@$DC_IP" | head -20

# Use Impacket's psexec to obtain a shell as the DA
impacket-psexec "$DOMAIN/$USER:$PASS@$DC_IP"

Defense Perspective

Detecting PAM Attacks

• Authentication anomalies -- CyberArk PVWA logs every Logon event to the Vault Audit. A burst of failed logons followed by a success from a new IP is high-signal. BeyondTrust PRA logs to the appliance audit + optionally to SIEM. Delinea SS Event Framework exposes LoginEvent, SecretViewEvent, SecretAccessEvent. ManageEngine PMP logs to its own audit table (pmpaudits).
• API enumeration patterns -- CyberArk List Safes calls beyond an operator's normal cadence appear in ITAudit as Action=Get Safes List. Delinea SS reports repeated GET /api/v1/secrets from a single session as a Mass Secret Access event (configurable in Event Policies).
• Credential retrieval volume -- Any user retrieving more than N credentials in a short window is suspect. Define and alert on a baseline per role.
• PSM / PRA session anomalies -- Concurrent sessions, session starts from new IPs, or session recording interruptions (recording failed) are all red flags.
• Post-compromise tampering -- Bulk deletion of audit log entries, mass safe deletion, or disabling of session recording are immediate indicators of post-breach cleanup.
• Credential file discovery -- Finding .cue, .btl, Vault.ini, agent_config.xml, pmp_key.key, safeguard-settings.json outside of the expected runtime path indicates either agent misconfiguration or an attacker staging for extraction.

Mitigations per Vendor

• CyberArk -- Enforce Risk-Based MFA on PVWA, restrict List Safes to authenticated EPV users, harden the EPV server (AllowDirectLogon=No on paragent), patch PVWA to current release (CVE-2025-32564-class fixes), enable RequireDualControl on Tier-0 safes, monitor ITAudit for GetPassword events
• BeyondTrust -- Patch PRA (CVE-2022-2451 fix), enforce endpoint certificates, restrict SAML IdP to known IdPs only, enable session recording tamper-evidence, monitor Password Safe API for anomalous bulk read
• Delinea -- Migrate off password grant in OAuth (use authorization code + PKCE), enforce DPAPI-protected configuration, restrict distributed engine outbound to known SS only, enable the EventPipeline for SIEM streaming
• One Identity -- Keep SSL pinning enabled, monitor Safeguard for Privileged Passwords (SPP) session fabric events, enforce smart card MFA on admin console
• ManageEngine -- Patch PMP (CVE-2022-28226-class fixes), restrict API key scope, encrypt the PMP PostgreSQL backend at rest, rotate the PMP master key annually
• Cross-cutting -- Enforce JIT access over standing access, implement transaction-based access (per-request approval), integrate PAM events into the SIEM with the high-fidelity event list above

Hardening Recommendations