I was requested to perform a proof of concept hack into a large organization a few weeks ago. The aim was to get an interactive session, preferably GUI, on one of the internal machines which was guarded by 2 (External and DMZ) firewalls, and an Intrusion detection system. I was allowed to use any means necessary to achieve this goal. This is extremely unusual for a penetrations test, where the rules, guidelines and penetration methods are very strict and defined. I was supposed to impersonate a hacker that would stop at nothing to gain interactive access to the internal network.