post-exploitation

name

post-exploitation

description

Post-exploitation technique list once shell access is achieved -- reverse/bind shell one-liners across languages, interactive TTY upgrade, privilege escalation vectors (SUID/cron/capabilities/kernel CVEs/Docker), lateral movement, and egress/data-exfiltration channels. Converted from master-pentest-prompt.md Phase 29. Use only after RCE is confirmed and shell access is the explicit, in-scope next step of the engagement.

Post-exploitation / reverse shell / egress -- all methods

When to use

Only after RCE is confirmed and shell-level access is an explicit, in-scope objective of the engagement -- post-exploitation activity has a much bigger blast radius than the testing that got you there, so treat scope boundaries here even more strictly than usual.

Reverse shell one-liners

Cover the full range depending on what's available on the target: bash /dev/tcp, nc, ncat, python, perl, php, ruby, socat, openssl (for a TLS-wrapped shell), PowerShell, JSP, WAR-packaged.

Bind shells

socat, nc -lvp, plus firewalk-style alternatives when a straightforward bind isn't reachable.

Web shell options

<?=system($_GET[0])?> as the minimal PHP form, the "seven ways" PHP variants, Weevely, pwnshell-style tooling, JSP method overrides, LD_PRELOAD injection for a shared-library-based shell.

Fully interactive TTY

Python pty module upgrade, script -c, socat file:\tty`,raw,echo=0, and setting stty rows/cols` afterward to get a properly sized terminal.

Privilege escalation (once you have a shell)

Chain through: sudo -l, SUID/SGID binaries, cron jobs, Linux capabilities (cap_setuid specifically), known kernel CVEs, Docker group membership, a mounted docker.sock, a writable PATH entry, NFS exports with no_root_squash, and MySQL user-defined-function RCE. (See TryHackMe's linprivesc/windowsprivescarena rooms for the exhaustive reference version of this checklist.)

Lateral movement

SSH private keys found on disk, VNC, RDP, SSH agent forwarding, pass-the-hash, pass-the-ticket, Kerberoasting, and Group Policy Preferences (GPP) passwords in an Active Directory environment.

Egress / data exfiltration channels

DNS TXT/CNAME-record exfiltration, ICMP tunneling, HTTP POST to a gopher/websocket endpoint, base64-encoded data hidden in JPEG comment fields.

Persistence (AD/cloud)

Backdoored SAML configuration, Azure token theft -- both are high-impact, high-scrutiny actions; confirm explicitly that persistence techniques are in scope before using them, separate from confirming RCE itself is in scope.