Post-exploitation and privesc

Scripts (linpeas, winpeas) help, but go over the basics by hand: that is what saves you when the script highlights nothing in red.

Target 0 of 22

Hide completed

Commands use the values you typed in the cheat sheets (your IP, the target's, the domain...).

Settle the shell 0/3

Upgrade to a full TTY (Ctrl+C, arrows, size)
```
script /dev/null -c bash
```
Cheat sheet →
Who you are, which groups and which host
```
id; hostname; ip a
```
Set up file transfer (HTTP server, SMB)
```
python3 -m http.server 443
```
Cheat sheet →

If you are on Windows, skip to the next phase.

sudo -l and the sudo version
```
sudo -l
```
Cheat sheet → Guide →
SUID binaries and capabilities (look them up in the binaries list)
```
find / -perm -4000 -type f 2>/dev/null; getcap -r / 2>/dev/null
```
Cheat sheet → Guide →
Cron jobs and root processes (pspy)
```
cat /etc/crontab; ls -la /etc/cron.*
```
Guide →
Writable files and folders used by root (PATH, libraries, scripts)
```
find / -writable -type f -not -path '/proc/*' 2>/dev/null
```
Dangerous groups: docker, lxd, disk, adm

Guide →
Services listening only on localhost
```
ss -tlnp
```
Guide →
Kernel version as a last resort
```
uname -a; cat /etc/os-release
```
Guide →

Token privileges (SeImpersonate, SeBackup, SeDebug...)
```
whoami /all
```
Cheat sheet → Guide →
Services with weak permissions or unquoted paths

Guide →
Scheduled tasks and installed programs

Guide →
AlwaysInstallElevated, autologon and passwords in the registry

Guide →

PowerShell history and unattend or web.config files

type $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Passwords in config files, databases and backups

grep -rniE 'pass(word)?\s*[=:]' /var/www /opt /home 2>/dev/null

Look for other interfaces and internal networks

Cheat sheet →
Set up a tunnel (chisel, ligolo-ng, SSH) into the internal network
```
chisel server -p 8000 --reverse
```
Cheat sheet → Guide →
Go back to the recon checklist for each new host