Post-Exploitation — Hub

Everything after the first shell — escalate privileges, move laterally, pivot into internal networks.


📌 Sub-Sections

Privilege Escalation

NotePurpose
Privilege EscalationPrivEsc hub
LinuxLinux privesc — SUID, sudo, cron, caps
Windows PrivEscWindows privesc — services, tokens, misconfigs
Potato AttacksToken impersonation to SYSTEM (GodPotato, PrintSpoofer, SigmaPotato)
Process - EveryRunsQuick privesc checklist

Lateral Movement

NotePurpose
LatMovementPtH, PtT, cred dump, pivot overview
Firefox Credentials - firefox_decryptLoot Firefox saved passwords → reuse / spray
LSASSLSASS dump — live, offline, nxc modules, pypykatz

Tunneling & Pivoting

NotePurpose
TunnelingTunneling hub — concepts & tool picker
Port ForwardingLocal/remote/dynamic forwards
SSH TunnelingSSH -L, -R, -D
sshuttleVPN-like subnet routing over SSH
ChiselSOCKS pivot (tool)
Ligolo-ngTUN pivot
ProxychainsRoute any tool through SOCKS (SSH -D / Chisel)
SocatPort relay
PlinkWindows SSH tunnels
NetshWindows built-in portproxy
Windows TunnelingWindows pivot hub

Payloads

NotePurpose
ShellWebshells (/usr/share/webshells/php/), reverse shells, shell upgrade
powercatPowerShell Netcat — Windows reverse/bind shell, file transfer
Reverse Shell - Base64 bash-c echo and One-Linersbase64 | bash, bash -c, echo, sh, mkfifo, encode payloads
Restricted Shell Escaperbash / lshell — vi :shell, PATH, GTFOBins breakouts

📌 Post-Exploit Flow

Got shell
  ├─ Restricted shell? → [[Restricted Shell Escape]] → [[Shell]] upgrade
  ├─ Loot creds?  →  [[Credential Discovery]] → [[Credential Graph]]
  ├─ Linux?       →  [[Linux]] privesc checklist
  ├─ Windows?     →  [[Windows PrivEsc]]
  ├─ Domain?      →  [[LatMovement]] + [[Impacket]] + [[Credential Graph]]
  └─ Dual-homed?  →  [[Tunneling]] + [[Chisel]]

Attack / credential trees: Attack Path Graph · Credential Graph