Windows Postexploit

Windows Post-Exploitation Methodology

Windows post-exploitation uses userland APIs (no kernel driver signing needed) for Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, and defense evasion. After gaining access on a Windows target, these 153 programs provide comprehensive offensive capabilities — from basic credential extraction to advanced techniques like Diamond/Sapphire tickets, ADCS ESC9-15, KrbRelayUp, gMSA password extraction, cross-forest attacks, 16 dedicated privilege escalation methods, NTLM relay chains, LLMNR/NBT-NS poisoning, Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO), ADIDNS poisoning, machine account abuse, BitLocker key extraction, Windows Hello credential dumping, Exchange Server exploitation, password spraying, WDigest credential caching, PPL bypass for modern LSASS protection, BITS job persistence, WSUS exploitation, GoldenGMSA offline password computation, Silver SAML token forgery, RDP session shadowing, print monitor persistence, CLM bypass, SSP credential interception, password filter persistence, DSRM local admin abuse on DCs, NTLMv1 downgrade attacks, accessibility binary backdoors, IFEO debugger persistence, RID hijacking for hidden admin access, Winlogon helper DLL persistence, AppInit_DLLs mass injection, netsh helper DLL persistence, W32Time provider persistence, screensaver idle-trigger persistence, named pipe enumeration and ACL auditing, LSA secret extraction and in-memory decryption, KeePass credential dumping (CVE-2023-32784 master password extraction), SSH-based lateral movement and key harvesting, scheduled task remote execution, PowerShell profile persistence, Active Setup registry persistence, Boot Execute native image persistence, NTDLL unhooking for EDR bypass, PPID spoofing for process lineage evasion, IPv6 MITM via DHCPv6 DNS poisoning (mitm6), WPAD abuse for NTLM hash capture, and Microsoft Teams token extraction.

Prerequisites

Before deploying winhook tools, verify:

1. Stealth capability — run winhook stealth_check FIRST to determine which encoding modes work on the target. This tells you whether base64, amsi, and obfuscate modes are available before committing to a stealth strategy
2. Administrator access — most operations require elevated privileges
3. OS version — Windows 10/11 or Server 2016+ for ETW features
4. PowerShell — available natively on all modern Windows; check if pwsh.exe (PS7) is also installed
5. Domain context — AD operations require domain-joined machine with valid credentials
6. AV/EDR status — run amsi_bypass and etw_blind first if Defender/EDR is active

# Step 0 — stealth capability check (ALWAYS run first)
winhook stealth_check

# Then proceed with environment checks

# Quick prerequisite check
whoami /priv                              # verify SeDebugPrivilege
whoami /groups                            # verify domain membership
Get-MpComputerStatus | Select RealTimeProtectionEnabled  # Defender status
Get-Process lsass                         # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL  # PPL status
nltest /dclist:                           # list domain controllers
Get-Command pwsh -ErrorAction SilentlyContinue  # check if PS7 available for --pwsh

Kill Chain Phases

Phase 1 — AV/EDR Evasion (First priority)

Neutralize monitoring before performing credential operations.

Global Stealth Flags

All 153 programs support --stealth and --pwsh flags for AV/EDR evasion. These flags modify how PowerShell commands are executed — no per-program changes needed.

--stealth <mode>

# Examples — any program with any stealth mode
winhook lsass_dump --stealth base64
winhook ad_enum --stealth amsi
winhook kerberoast --stealth obfuscate
winhook dcsync --target krbtgt --stealth amsi

--pwsh

Use PowerShell 7 (pwsh.exe) instead of Windows PowerShell 5.1 (powershell.exe). Benefits:

• Different AMSI hooks (some EDRs only hook powershell.exe)
• Bypasses Constrained Language Mode (CLM) policies targeting powershell.exe
• Separate script block logging configuration

# Combine with stealth
winhook lsass_dump --stealth amsi --pwsh
winhook ad_enum --pwsh

Verify stealth modes

winhook stealth_check

Tests all 3 stealth modes + plain execution with a benign command, reports which modes succeed on the target.

Multi-Exec Engine (--exec)

When PowerShell is blocked, restricted (CLM), or unavailable, use --exec to switch the execution engine. All 153 programs support cmd.exe native commands, .bat files, WMI CLI, VBScript, and HTA as fallback methods.

--exec <method>

# Force cmd.exe native commands
winhook lsass_dump --exec cmd
winhook ad_enum --exec cmd
winhook kerberoast --exec cmd

# Force .bat file execution
winhook registry_persist --exec bat

# Auto-detect best method
winhook sam_dump --exec auto

Environment Detection

ALWAYS run detect_env first when landing on a new target to determine the optimal execution method:

winhook detect_env

Returns: PowerShell version, CLM/AMSI status, execution policy, admin context, OS build, and availability of cmd.exe/wmic/cscript/mshta. Outputs recommended execution method and fallback chain.

Decision flow:

1. Run winhook detect_env
2. If PS is available and unrestricted → use default (no --exec flag)
3. If CLM is active → try winhook clm_bypass first, then fall back to --exec cmd
4. If PS is completely blocked → use --exec cmd for all subsequent commands
5. If cmd.exe is also restricted → try --exec bat, --exec vbs, or --exec mshta

cmd.exe Native Equivalents

Key tools available without PowerShell:

• reg query/add/save — registry operations, credential extraction
• netsh advfirewall — firewall enumeration and manipulation
• certutil — certificate operations, Base64 encoding
• schtasks — scheduled task management
• sc — service management
• wmic — WMI queries (process, service, OS info)
• nltest — domain controller and trust enumeration
• dsquery — AD object queries
• icacls — file permission analysis
• manage-bde — BitLocker operations
• cmdkey — stored credential management
• wevtutil — event log operations
• sqlcmd/osql — MSSQL operations
• klist — Kerberos ticket management
• setspn — SPN enumeration

Phase 2 — AD Enumeration

Comprehensive Active Directory reconnaissance using multiple protocols.

Phase 3 — Credential Harvesting

Extract credentials from multiple sources.

Phase 4 — Kerberos Attacks

Active Directory Kerberos-based attacks including advanced ticket forgery.

Phase 5 — AD Exploitation

Advanced Active Directory exploitation techniques.

Phase 6 — CVE-Based Attacks

Exploit specific CVEs for domain escalation.

Phase 7 — Lateral Movement

Move laterally across the network using multiple execution and coercion methods.

Phase 8 — Persistence

Establish persistent access mechanisms.

Phase 9 — Privilege Escalation

Escalate from standard user to SYSTEM/Administrator. 22 dedicated privesc techniques covering service exploitation, DLL abuse, token manipulation, driver attacks, SAM manipulation, and policy bypass.

Phase 10 — Local Reconnaissance

Understand the target environment before choosing attack and evasion strategies.

Phase 11 — Monitoring

Understand the target environment and detect defensive measures.

Phase 12 — Process Injection

Inject payloads into legitimate processes for AV/EDR evasion.

Phase 13 — Firewall Manipulation

Modify Windows Firewall to enable lateral movement and C2.

Phase 14 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

Phase 15 — Anti-Forensics

Remove forensic evidence before cleanup.

…(truncated)