Post-Exploitation and Privilege Escalation

What Post-Exploitation Is

Post-exploitation is the phase that follows gaining initial access, and its goal is to answer a critical question: how far could an attacker go from here? An initial low-privilege access may seem minor, but if from it you can escalate to administrator, pivot to other systems, or access sensitive data, the real impact is much greater. Post-exploitation measures that impact.

This phase is always carried out within scope and responsibly. The goal is to demonstrate the potential reach of the compromise, not to cause harm or maintain indefinite access. Each action is documented and, when appropriate, reverted. In this course we treat post-exploitation conceptually: understanding the principles is more valuable in the long run than memorizing specific commands.

Understanding post-exploitation also helps with defense. Knowing how an attacker would escalate privileges or move laterally lets the client design defense in depth that stops the adversary even after an initial compromise.

Ethical framing: persistence and lateral movement are demonstrated in a controlled and reversible way, always within scope. Every mechanism installed is removed at the end.

Local Reconnaissance

After gaining access to a system, the first step is to understand where you are. Local reconnaissance consists of identifying the current user and their privileges, the operating system and its version, the running processes, the network connections, the system users, and the scheduled tasks. This internal map reveals both escalation opportunities and routes toward other systems.

On Linux, this involves reviewing who you are, which groups you belong to, which binaries with special permissions exist, and how the system is configured. Enumeration tools like LinPEAS and WinPEAS automate much of this reconnaissance, pointing out potential escalation vectors in a structured way. Every command that follows is non-destructive enumeration: it reads the state of the system without modifying it.

# Linux — basic local reconnaissance (read-only)
whoami                                 # current user
id                                     # UID, GID, and the groups you belong to
sudo -l                                # which commands you can run via sudo
uname -a                               # kernel and system version (any missing patches?)
find / -perm -4000 -type f 2>/dev/null # binaries with the SUID bit (possible vectors)
crontab -l                             # scheduled tasks for the current user
./linpeas.sh                           # automated enumeration that highlights likely vectors

Each line answers a question: whoami and id define who you are and your privilege level; sudo -l reveals poorly scoped delegated permissions; uname -a exposes the kernel to check against known vulnerabilities; the SUID find lists binaries that run with the owner's privileges; crontab -l shows automations that could be abusable; and linpeas.sh correlates all of that in a structured way.

On Windows the approach is equivalent, but with its own vocabulary of privileges, services, and policies:

# Windows — basic local reconnaissance (read-only)
whoami /priv          # privileges of the current token (SeImpersonate, SeBackup, etc.)
systeminfo            # version, patches (hotfixes), and system architecture
.\winpeas.exe         # automated enumeration equivalent to LinPEAS

In Active Directory domain environments you add BloodHound (with its collector SharpHound), which maps relationships between users, groups, and computers to visualize attack paths toward high privileges. Local reconnaissance is the foundation of everything that follows: without understanding the context of the compromised system, any escalation or movement attempt is blind. Take the time to map the environment before acting.

Privilege Escalation on Linux

Privilege escalation seeks to move from a user with limited permissions to one with full control, typically root. The common vectors on Linux, with their recommended mitigation, are:

• Misconfigured sudo: rules that allow running privileged commands without proper restriction. Mitigation: scope sudo to specific commands, avoid wildcards and unnecessary NOPASSWD, and audit /etc/sudoers periodically.
• Misconfigured SUID binaries: executables that run with their owner's privileges (root) and can be abused. Mitigation: audit and remove the SUID bit from binaries that don't need it; check GTFOBins to identify which ones are abusable.
• Modifiable cron: scheduled tasks that run as root but whose scripts or paths are writable by unprivileged users. Mitigation: restrict write permissions on scripts and directories referenced by cron.
• Unpatched kernel: versions with public local-escalation vulnerabilities. Mitigation: keep the kernel and packages up to date with a defined patching cycle.

The GTFOBins project is a key resource: it catalogs how legitimate system binaries can be abused to escalate privileges when misconfigured. For example, certain editors or interpreters, if they can be run via sudo, allow obtaining a privileged shell. Understanding these patterns helps both to demonstrate the risk in a test and to recommend the configurations to fix. The underlying defense is always the principle of least privilege: as a pentester, you document the vector found and recommend the specific mitigation.

Privilege Escalation on Windows

On Windows, escalation vectors include services with weak permissions, unquoted service paths, misassigned token privileges, plaintext credentials, and misconfigured group policies. The Windows ecosystem has its own set of common misconfigurations, each with its countermeasure:

• Services with weak permissions: if an unprivileged user can replace the executable of a service that runs as SYSTEM, they gain that level. Mitigation: review and harden the ACLs of services and their binaries.
• Unquoted service paths: paths with spaces left unquoted that allow hijacking execution. Mitigation: correctly quote the paths of all services.
• Plaintext credentials: passwords in configuration files, scripts, or the registry. Mitigation: remove embedded credentials, use a secret manager, and adopt managed service accounts (gMSA).
• Misassigned token privileges: tokens with SeImpersonate or others that enable known escalations. Mitigation: apply least privilege to service accounts.

Tools like WinPEAS and manual enumeration identify these vectors, and LOLBAS (Living Off the Land Binaries and Scripts) is the catalog equivalent to GTFOBins for signed Windows binaries that can be abused. In Active Directory domain environments, escalation is often combined with lateral movement: compromising a service account or abusing delegations can open a path toward the domain controller, and BloodHound helps visualize those paths. As on Linux, the knowledge is bidirectional: it lets you demonstrate the risk and, above all, recommend hardening configurations, rotating credentials, and applying least privilege across the entire domain.

Persistence and Lateral Movement

Persistence is the ability to maintain access to a system over time, even after reboots. In a real engagement, an attacker would seek it; an ethical pentester demonstrates it in a controlled and reversible way, removing any mechanism at the end. The value of demonstrating persistence is showing the client how difficult it would be to evict a real intruder. For the sake of responsibility, in this course we treat it only at a conceptual level: no functional mechanisms or evasion techniques are provided.

Lateral movement is the displacement from a compromised system toward others within the network, expanding the reach of the compromise. It usually relies on reused credentials, trust relationships between systems, or internally accessible services that were not accessible from outside. Conceptually, it demonstrates how a single entry point can compromise an entire poorly segmented network.

Both persistence and lateral movement are treated here at a conceptual level and always within the authorized scope. The educational goal is to understand the risk in order to defend against it: network segmentation, monitoring of anomalous behavior, credential rotation, and detection of known techniques are the countermeasures you would recommend.

Pivoting and Segmentation

Pivoting is the concept of using a compromised system as a bridge to reach networks or segments that were not directly accessible from the starting point. Conceptually, the compromised host becomes a foothold from which traffic is routed toward internal segments. Demonstrating pivoting shows why network segmentation is a critical defense: if every segment is reachable from any compromised host, a single entry point exposes the entire organization.

In this course we treat pivoting at a conceptual level, without providing operational chains. What matters for the student is understanding the defensive logic: segment the network into zones with controls between them, apply least access between segments, monitor lateral (east-west) traffic and not just ingress/egress (north-south), and detect credential-reuse patterns across machines. Each of these measures breaks a link in the chain an attacker would try to traverse.

As a pentester, your value lies in translating the conceptual demonstration of pivoting into concrete segmentation and monitoring recommendations the client can implement right away.

Mapping to MITRE ATT&CK

MITRE ATT&CK is a framework that catalogs real adversary tactics and techniques. Mapping each post-exploitation action to a technique helps communicate risk with a common vocabulary and design concrete detections for each step. The most relevant tactics for this phase are:

• Discovery (TA0007): local reconnaissance — enumerating users, privileges, services, and network of the compromised host.
• Privilege Escalation (TA0004): moving from low privilege to administrator or root through the vectors described.
• Persistence (TA0003): maintaining access over time, even after reboots.
• Lateral Movement (TA0008): moving toward other systems on the network.

Documenting the engagement with ATT&CK techniques lets the client translate each finding into a detection rule or a specific control, closing the loop between offense and defense.

Mini-Scenario: Impact Chain

Consider this conceptual narrative, with no weaponized commands: a vulnerable web form grants a shell with a low-privilege user (Discovery). While enumerating the host, that user discovers they can run a system binary via sudo without proper restriction, which lets them obtain a shell as root (Privilege Escalation). With full control of the server, they find service credentials stored in a configuration file. Those credentials are also valid on other machines on the network through reuse (Lateral Movement), and from there they reach a server with sensitive data. The lesson: a "minor" vulnerability in a form, combined with weak configurations, can escalate all the way to the compromise of critical data. Each link in the chain is a point where a proper mitigation would have stopped the advance.

Cleanup and Documentation

An inescapable responsibility of the ethical pentester is to leave systems as they were found. Before closing the engagement, walk through this checklist:

• Cleanup: remove every tool uploaded (LinPEAS, WinPEAS, collectors), account created, and any persistence mechanism installed. Revert modified configurations to their original state.
• Change log: keep a precise, timestamped record of every action performed during post-exploitation, so that cleanup is complete and verifiable.
• Compromise chain documentation: document the full route, from initial access to final impact, mapping each step to its ATT&CK technique.

The documentation of this phase is especially valuable for the report: it shows the client the complete compromise chain, from initial access to full control or access to critical data. That impact narrative — "with this minor vulnerability, an attacker could reach here" — is often what motivates the organization to invest in security. Document rigorously, remove every trace, and communicate clearly.