| name | post-exploitation |
| description | Post-exploitation technique list once shell access is achieved -- reverse/bind shell one-liners across languages, interactive TTY upgrade, privilege escalation vectors (SUID/cron/capabilities/kernel CVEs/Docker), lateral movement, and egress/data-exfiltration channels. Converted from master-pentest-prompt.md Phase 29. Use only after RCE is confirmed and shell access is the explicit, in-scope next step of the engagement. |
Post-exploitation / reverse shell / egress -- all methods
When to use
Only after RCE is confirmed and shell-level access is an explicit,
in-scope objective of the engagement -- post-exploitation activity has a
much bigger blast radius than the testing that got you there, so treat
scope boundaries here even more strictly than usual.
Reverse shell one-liners
Cover the full range depending on what's available on the target: bash
/dev/tcp, nc, ncat, python, perl, php, ruby, socat, openssl
(for a TLS-wrapped shell), PowerShell, JSP, WAR-packaged.
Bind shells
socat, nc -lvp, plus firewalk-style alternatives when a straightforward
bind isn't reachable.
Web shell options
<?=system($_GET[0])?> as the minimal PHP form, the "seven ways" PHP
variants, Weevely, pwnshell-style tooling, JSP method overrides,
LD_PRELOAD injection for a shared-library-based shell.
Fully interactive TTY
Python pty module upgrade, script -c, socat file:\tty`,raw,echo=0, and setting stty rows/cols` afterward to get a properly sized terminal.
Privilege escalation (once you have a shell)
Chain through: sudo -l, SUID/SGID binaries, cron jobs, Linux
capabilities (cap_setuid specifically), known kernel CVEs, Docker
group membership, a mounted docker.sock, a writable PATH entry, NFS
exports with no_root_squash, and MySQL user-defined-function RCE. (See
TryHackMe's linprivesc/windowsprivescarena rooms for the exhaustive
reference version of this checklist.)
Lateral movement
SSH private keys found on disk, VNC, RDP, SSH agent forwarding,
pass-the-hash, pass-the-ticket, Kerberoasting, and Group Policy
Preferences (GPP) passwords in an Active Directory environment.
Egress / data exfiltration channels
DNS TXT/CNAME-record exfiltration, ICMP tunneling, HTTP POST to a
gopher/websocket endpoint, base64-encoded data hidden in JPEG comment
fields.
Persistence (AD/cloud)
Backdoored SAML configuration, Azure token theft -- both are
high-impact, high-scrutiny actions; confirm explicitly that persistence
techniques are in scope before using them, separate from confirming RCE
itself is in scope.
