Getting a shell is the moment most beginners think the job is done. In reality, that’s usually where the real work starts. Post-exploitation is the phase where you turn initial access into a meaningful understanding of business risk — proving what an attacker could actually do once they’re inside, not just that they could get in. I want to walk through the methodology I use on every engagement, from the moment I land a shell to the moment I hand over a report that actually means something to the client.
What Post-Exploitation Actually Is
Post-exploitation covers everything that happens after you’ve gained initial access to a system: situational awareness, privilege escalation, credential harvesting, persistence, lateral movement, and data identification. It’s the phase that turns a single compromised host into a demonstrated path toward the client’s most sensitive data or systems.
Why Post-Exploitation Matters
A pentest report that says “we got a shell on a web server” tells a client almost nothing about actual risk. A report that says “from that web server, we harvested a service account credential, escalated to domain admin, and could access the finance file share” tells them exactly what’s at stake and why the underlying vulnerability needs to be fixed urgently. Post-exploitation is where technical findings turn into business impact.
Authorized Environments Only
Every technique in this article assumes you’re working within a signed scope of work, a personal lab, or a legal training platform such as HackTheBox, TryHackMe, or a self-hosted Active Directory range like GOAD. Post-exploitation activity against systems you don’t have written authorization to test is illegal.
Phase 1: Situational Awareness
The moment I get a shell, before doing anything noisy, I orient myself.
On Linux:
id
hostname
ip a
cat /etc/os-release
On Windows:
whoami /all
hostname
ipconfig /all
systeminfo
I want to know: who am I, what machine is this, what network am I on, and what’s the OS/patch level. This context shapes every decision that follows.
Phase 2: Local Privilege Escalation
If you’re not already at the highest privilege available on the host, this is usually the next step. On Linux, that means checking sudo -l, SUID binaries, and cron jobs. On Windows, it means checking token privileges, service permissions, and stored credentials. I’ve written detailed checklists on both — the core idea is the same: enumerate systematically, don’t rely on a single tool, and confirm any exploit path manually before using it.
Phase 3: Credential Harvesting
Credentials are the currency of post-exploitation. Once you have local admin or SYSTEM on Windows, dumping credentials from memory is often the single most valuable action you can take.
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords
This dumps plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory for every logged-in user. On engagements where EDR is aggressive, I often use alternatives like dumping the LSASS process with a legitimate tool (procdump) and parsing it offline to avoid signature-based detection of Mimikatz itself.
On Linux, credential harvesting looks different — checking .bash_history, SSH private keys, saved database credentials in application config files, and browser-saved passwords if a GUI session is present.
find / -name "id_rsa*" 2>/dev/null
grep -ri "password" /var/www/ 2>/dev/null
Phase 4: Persistence
On a real engagement, persistence is usually established briefly to demonstrate risk, then documented and removed at the end — always following the rules of engagement. Common persistence mechanisms include:
Windows:
schtasks /create /tn "Updater" /tr "C:\payload.exe" /sc onlogon /ru SYSTEM
Linux:
(crontab -l ; echo "* * * * * /tmp/payload.sh") | crontab -
I always document exactly what persistence mechanism was used, where, and confirm removal steps with the client before the engagement closes.
Phase 5: Internal Reconnaissance
Once you understand what you have access to, the next question is: what else is on this network? This means:
arp -a
ip route
nmap -sn 10.10.10.0/24
On a domain-joined Windows host, tools like BloodHound become invaluable for mapping Active Directory relationships and identifying paths to Domain Admin.
SharpHound.exe -c All
The resulting data, imported into BloodHound, visually shows attack paths — which users have admin rights over which machines, which groups have dangerous delegation permissions, and where the shortest path to Domain Admin actually lies.
Phase 6: Lateral Movement
With harvested credentials and a map of the network, lateral movement becomes the process of moving from your initial foothold to systems that hold more valuable data or higher privileges. Tools like CrackMapExec, Evil-WinRM, and PsExec are staples here. I cover lateral movement in more depth in a dedicated article, but the short version is: use captured credentials methodically, target high-value systems identified by BloodHound, and always log what you access.
Phase 7: Data Identification and Impact Demonstration
This is the step beginners skip, and it’s often the most important for the client. Once you’ve reached a high-value target — a file server, a database, a domain controller — the goal isn’t to exfiltrate real sensitive data (never do this without explicit authorization and a defined process), but to demonstrate access. Screenshot directory listings, note file counts, and identify categories of sensitive data (PII, financial records, source code) without copying the actual content unless the engagement rules specifically call for controlled data exfiltration testing.
Phase 8: Cleanup
Before the engagement ends, remove any persistence mechanisms, uploaded tools, created accounts, or scheduled tasks. Keep a clean log of everything you created so nothing is left behind. This step is often contractually required and is a mark of a professional tester.
A Practical Walkthrough Example
Say you’ve compromised a low-privilege web server through a file upload vulnerability. Post-exploitation methodology looks like:
- Establish situational awareness (
whoami,hostname,ipconfig). - Escalate locally to SYSTEM using a service misconfiguration.
- Dump LSASS memory and recover a domain service account’s credentials.
- Use those credentials with CrackMapExec to check access across the subnet.
- Discover the service account has admin rights over a file server.
- Access the file server, demonstrate access to a sensitive share, and document the finding.
- Remove all persistence mechanisms and tools before closing out.
This is a realistic chain that turns a single web vulnerability into a demonstrated path toward significant business risk — exactly what a client needs to understand and prioritize.
Common Mistakes and Troubleshooting
- Skipping situational awareness and rushing to escalate. You risk missing context that changes your entire approach — like realizing you’re on a honeypot or an out-of-scope host.
- Being too noisy. Running every enumeration tool at full volume can trigger EDR and burn your foothold before you’ve gathered anything useful.
- Forgetting to document as you go. Waiting until the end of the engagement to write notes means you’ll forget details that matter for the report.
- Not cleaning up. Leaving scheduled tasks, uploaded binaries, or created accounts behind is unprofessional and can be a serious liability.
- Over-focusing on one host. Post-exploitation should always ask “what else can this access lead to,” not just “what can I do on this one machine.”
Security Risks and Defensive Recommendations
- Deploy credential protection like Windows Credential Guard to limit LSASS-based credential theft.
- Monitor for anomalous authentication patterns (a service account logging into unusual hosts).
- Segment networks so a single compromised host doesn’t have broad reachability.
- Apply least privilege rigorously — service accounts should never have unnecessary admin rights.
- Deploy EDR with behavioral detection tuned for common post-exploitation tooling.
- Regularly run internal Active Directory audits using tools like BloodHound defensively to find and close dangerous privilege paths before attackers do.
Frequently Asked Questions
1. What’s the difference between post-exploitation and privilege escalation? Privilege escalation is one phase within post-exploitation, focused specifically on gaining higher access on a single host; post-exploitation is the broader process covering everything from credential harvesting to lateral movement.
2. Do I always need to establish persistence during a pentest? No — persistence is only established when it’s within the agreed rules of engagement and is always documented and removed afterward.
3. Is dumping LSASS memory always necessary? Not always, but it’s frequently the fastest way to obtain credentials that unlock further access, especially on Windows domain environments.
4. What is BloodHound and why is it so widely used? BloodHound visualizes Active Directory relationships and attack paths, making it far easier to identify the shortest route to Domain Admin than manual enumeration alone.
5. How do I avoid triggering EDR during post-exploitation? Use built-in, legitimate tools where possible, avoid well-signatured tools like unmodified Mimikatz, and pace your actions rather than running everything at once.
6. What should be in a good post-exploitation report? A clear narrative of the attack chain, screenshots demonstrating impact, a list of affected systems, and prioritized remediation recommendations.
7. Should exfiltrated data ever be copied off the client’s network? Only if explicitly defined in the rules of engagement; otherwise, demonstrate access without extracting actual sensitive data.
Conclusion
Post-exploitation is where a pentest earns its value — it’s the difference between reporting a technical finding and demonstrating real business risk. By moving methodically through situational awareness, privilege escalation, credential harvesting, lateral movement, and impact demonstration, you build a narrative the client can actually act on. Practice this workflow in a lab, document every step, and always operate within your authorized scope.
