# Pt Post Exploitation

> Performs authorized post-exploitation activities to assess impact, lateral movement paths, credential exposure, and detection gaps after initial compromise. Use when a foothold has been validated and the test requires controlled impact expansion analysis.

- Skill: `santosomar/pt-post-exploitation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add santosomar/pt-post-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/santosomar/pt-post-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: santosomar (https://skillmd.com/u/santosomar)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/santosomar/pt-post-exploitation

---


# Post-Exploitation

## Authorized Use Only

Run post-exploitation tasks only after explicit approval for this phase. Keep actions controlled, reversible, and auditable. Avoid destructive changes and unnecessary access to sensitive data.

## Objectives

1. Measure realistic impact after initial access.
2. Evaluate privilege escalation and lateral movement opportunities.
3. Identify credential and data exposure paths.
4. Assess logging, detection, and response effectiveness.

## Workflow

1. Confirm phase boundaries:
   - Allowed techniques, prohibited actions, and stop conditions
   - Approved systems, accounts, and time windows
2. Stabilize foothold context:
   - Document current privileges and reachable assets
   - Capture baseline telemetry and controls in place
3. Conduct controlled post-exploitation checks:
   - Privilege escalation feasibility
   - Credential access and reuse opportunities
   - Lateral movement paths through trust relationships
   - Data access paths tied to business impact
4. Evaluate defense visibility:
   - Which actions generated alerts
   - How quickly detection and containment occurred
5. Cleanup and rollback:
   - Remove all artifacts created during testing
   - Verify environment returns to expected state

## Output Template

```markdown
# Post-Exploitation Output

## Initial Context
- Entry point:
- Starting privilege:
- Scope constraints:

## Escalation and Movement Findings
- Finding:
  - Preconditions:
  - Evidence:
  - Result:
  - Impact:

## Credential and Data Exposure
- Exposure path:
  - Affected assets/data:
  - Business risk:

## Detection and Response
- Alerts observed:
- Time to detect:
- Time to contain:
- Gaps:

## Cleanup Verification
- Artifacts removed:
- Validation notes:
```

## Quality Checks

- Every action is within approved boundaries.
- Evidence supports reproducibility without sensitive data leakage.
- Findings map clearly from technical path to business consequence.