Post-Exploitation Assessment

Skill for assessing post-exploitation risk once initial access is confirmed. Covers lateral movement, persistence, privilege escalation, and data exfiltration vectors — all within authorized scope.

Prerequisites

• At least one finding with status exploited or confirmed that grants code execution or authenticated access
• Explicit operator approval via seven-question gate
• Scope must explicitly authorize post-exploitation activities

Phase 1: Situational Awareness

After gaining access, gather context before acting:

1. Identify current user/role and privileges
2. Enumerate local system info (OS, hostname, network interfaces)
3. List running services and listening ports
4. Check for credential stores (env vars, config files, keyrings)
5. Map network topology visible from this position

Evidence Requirements

Every command output captured in custody log. No destructive actions without separate operator gate.

Phase 2: Lateral Movement Assessment

Assess — do NOT execute without gate — potential lateral paths:

Chain Anchors

• rce → enables pivot-internal
• ssrf + cloud-metadata → credential-theft
• credential-file-read → lateral-movement

Phase 3: Persistence Assessment

Document — do NOT install — persistence mechanisms available:

Reporting

For each mechanism found available:

1. Document the path (how an attacker would install it)
2. Assess detection difficulty for the target's monitoring
3. Recommend specific detection rules (feeds into detection-pairing skill)
4. Classify as Demonstrated (if tested read-only) or Inferred

Phase 4: Privilege Escalation

Check for escalation vectors from current access level:

1. SUID/SGID binaries: find / -perm -4000 -type f 2>/dev/null
2. Sudo misconfigurations: sudo -l
3. Kernel version vs known local privesc CVEs
4. Writable paths in cron jobs or services
5. Docker group membership (docker run --privileged)
6. Cloud IAM role permissions (overly permissive)
7. Database GRANT privileges

Cross-reference with ENABLES_MAP: auth-bypass → privilege-escalation.

Phase 5: Data Exfiltration Assessment

Map sensitive data accessible from current position:

Volume Assessment

Estimate extractable data volume and rate:

• Network egress bandwidth from compromised host
• Available exfil channels (DNS, HTTP, ICMP)
• Detection likelihood per channel

Gotchas

• NEVER actually exfiltrate data. Demonstrate access, measure volume, document the path. The PoC is "I can read row 1 of table X", not "here are 10k rows".
• Container breakouts: verify scope covers the host, not just the container.
• Cloud metadata: some providers have IMDSv2 requiring token — check both.
• Persistence assessment is documentation only — installing persistence mechanisms is out of scope unless explicitly authorized.
• Network pivoting from a compromised host changes the attack surface — re-confirm scope before scanning internal networks.

Output

For each post-exploitation vector assessed:

1. Finding with evidence_tag (Demonstrated if verified read-only, Inferred if theoretical)
2. Chain reference linking initial access to post-exploitation capability
3. Detection recommendation for blue team
4. Remediation priority based on combined chain severity