Understands and can demonstrate common post-exploitation activities, including: • Obtaining locally stored clear-text passwords • Password recovery (exfiltration and cracking) • Lateral movement • Checking OS and third party software application patch levels • Deriving a list of missing security patches • Reversion of OS and software components to previous state