Post-Exploitation
Post-exploitation covers privilege escalation, lateral movement, persistence mechanisms, and techniques to achieve domain dominance in Active Directory environments.
Warning
Post-Exploitation Topics
Windows Privilege Escalation
🪟Local privilege escalation on Windows systems including token manipulation, service abuse, and kernel exploits.
Linux Privilege Escalation
🐧SUID exploitation, sudo abuse, capabilities, cron jobs, and kernel exploits for gaining root access.
Persistence Techniques
🔄Maintaining access through registry, services, scheduled tasks, WMI events, and Active Directory mechanisms.
Domain Dominance
👑DCSync, Golden Tickets, Silver Tickets, and Kerberos attacks for complete Active Directory compromise.
Data Exfiltration
📤Data discovery, covert channels, DNS/ICMP exfiltration, and demonstrating business impact of compromise.
Cleanup & Covering Tracks
🧹Removing artifacts, restoring systems, and ensuring clean handoff to the client after engagement completion.
DLL Hijacking
🔗DLL search order hijacking, sideloading, proxying, and phantom DLL loading for privilege escalation and persistence.
Credential Harvesting
🎣DPAPI abuse, browser credential extraction, Credential Manager, KeePass exploitation, and application-specific secrets.
Lateral Movement Overview
Once you have credentials or elevated privileges, lateral movement allows you to pivot through the network toward high-value targets.
| Technique | Requirements | Tool | Detection |
|---|---|---|---|
| Pass-the-Hash | NTLM Hash | Mimikatz, nxc | Medium |
| Pass-the-Ticket | Kerberos Ticket | Rubeus, Mimikatz | Low |
| Overpass-the-Hash | NTLM Hash | Rubeus, Mimikatz | Low |
| PsExec | Admin Creds + SMB | Impacket, Sysinternals | High |
| WMI/WinRM | Admin Creds | nxc, Evil-WinRM | Medium |
| RDP | Valid Creds + RDP Access | xfreerdp, rdesktop | Medium |
Recommended Reading
Operator Handbook
Joshua Picolet
Command reference for post-exploitation — persistence, lateral movement, credential harvesting, and data exfiltration.
Adversarial Tradecraft in Cybersecurity
Dan Borges (2021)
Offense and defense tradecraft — persistence, lateral movement, C2 comms, and how defenders detect each technique.
Related Topics
As an Amazon Associate I earn from qualifying purchases.