Academy Node

Post-Exploitation Triage

Post-exploitation triage is the immediate checklist after landing a shell: identity, host info, network, privileges, files, credentials, and pivot potential.

Intermediate100 XPPost Exploitation

Why it matters

PEN-200's assembling-the-pieces and internal enumeration sections emphasize moving from one compromised system into broader environment understanding.

How to identify it

You have shell access

Linux commands

whoami && hostname && ipconfig /all 2>nul

whoami /all

net user

net localgroup administrators

ip addr; ip route

id; hostname; uname -a; sudo -l

Expected output

Current user
Privileges
Hostname
Network interfaces
Routes

Success looks like

You know who you are, where you are, what network you can reach, and what to attack next

Failure looks like

Blindly running exploits without host context

Troubleshooting

Run minimal built-ins first
Stabilize shell if needed

Common mistakes

Not saving command output
Not checking routes
Not searching for creds

Alternative attacks

Local privesc
Pivoting
Credential hunting

What to try next

Proof collection
Local privesc
Pivoting
Credential validation

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.