Post exploitation refers to the phase of a penetration test where a machine has already been exploited and code execution is available. The primary task is generally to maintain persistence so that you can keep a connection alive or leave a way to reconnect later. This chapter covers some common techniques for persistence; namely, bind shells, reverse bind shells, and web shells. We will also look at cross compiling, which is incredibly helpful when compiling shells for different operating systems from a single host.
Other objectives during the post exploit phase include finding sensitive data, making changes to files, and hiding your tracks so that forensic investigators will not be able to find evidence. You can cover your tracks by changing timestamps on files, modifying permissions, disabling shell history, and removing logs. This chapter covers some techniques...