Once RCE is confirmed, any further access from there would break ToS. It&#x27;s bullshit, and kind of a cop-out - but it&#x27;s a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.