---
name: postexploit-workflow
description: "Post-exploit agent workflow — credential access, privilege escalation, lateral movement, C2. Loop until objectives met or no path forward."
metadata:
  when_to_use: "post-exploit, postexploit, post exploitation, credential access, privilege escalation, lateral movement, C2, sliver, persistence"
  subdomain: workflow
---

# Post-Exploit Workflow

## Role

Take the initial foothold from exploit, expand access (creds → privesc → lateral), and operate the C2 channel until the engagement's objectives are met. Post-exploit is a **loop** — every new host re-enters credential-access.

## The Loop

### Phase 1 — Intake

1. Read the `task()` handoff from orchestrator: foothold context (host, user, shell type, network position), target environment (OS, AD/non-AD, network segments), engagement objectives the foothold should advance.
2. Read prior findings (`findings/FIND-*.md`) and the C2 status (`shells.json`, sliver session list).
3. Choose the immediate sub-skill. Available:
   - `load_skill("/skills/standard/post-exploit/c2/SKILL.md")` — framework-agnostic C2 orchestration
   - `load_skill("/skills/standard/post-exploit/c2-sliver/SKILL.md")` — Sliver-specific operations
   - `load_skill("/skills/standard/post-exploit/credential-access/SKILL.md")` — LSASS, SAM, DPAPI, NTLM relay, password spray
   - `load_skill("/skills/standard/post-exploit/privilege-escalation/SKILL.md")` — UAC bypass, token impersonation, Linux privesc
   - `load_skill("/skills/standard/post-exploit/lateral-movement/SKILL.md")` — PTH, PTT, WMI/WinRM/PsExec, SMB, tunneling

### Phase 2 — Execute

Standard order (adapt as findings dictate):

1. **C2 channel setup** — establish or verify a Sliver implant on the foothold host.
2. **Credential access** — dump LSASS/SAM/DPAPI/keytabs; capture tickets; spray known creds.
3. **Privilege escalation** — abuse misconfig, services, tokens, UAC; escalate to SYSTEM/root.
4. **Lateral movement** — pivot via PTH/PTT, WMI, WinRM, PsExec, RDP, SOCKS tunnel.
5. **Loop** — when a new host is reached, re-enter credential-access on it.

### Phase 3 — Verify

Proof-of-access is required for every claimed foothold:

- **New shell**: capture `whoami`, `hostname`, network position (`ip a` / `ipconfig`), and a process listing.
- **Credentials**: capture the hash/ticket file path, the cracking attempt result, and where the credential is valid (host:share, service ticket SPN).
- **Exfiltrated artifact**: SHA-256 of the file, source path, destination path, byte count.
- **C2 channel**: implant ID, callback time, jitter, last-checkin.

Without verification, the objective stays `in-progress`. NEVER mark `passed` based on intent.

### Phase 4 — Handoff

Each objective produces a `findings/FIND-{NNN}.md` with:

- What was done (commands, tools, sub-skill loaded).
- Evidence (proof-of-access artifacts above).
- Adjacent leads (newly reachable hosts, captured creds, hinted privileges) — these become new objectives if in scope.
- OPSEC notes (what was logged, what was cleaned up, what evidence was left).

Loop exit: all OPPLAN objectives achieved, or remaining permanently BLOCKED (documented).

## Discipline / Anti-patterns

- **Sliver only** as C2. NEVER install or reference Metasploit. Config: `/workspace/.sliver-configs/<agent>.cfg`.
- **OPSEC matters**. Dumps that touch LSASS/SAM are HIGH noise — record them in OPSEC notes. Credential dumps go to `creds_<host>.json`, not stdout. Privesc that modifies system services should be reverted before disengaging.
- **No persistence beyond engagement scope.** Backdoors and scheduled tasks must be removed at the end of post-exploit unless RoE explicitly permits them.
- **No credential reuse outside RoE scope.** Hashes/tickets captured on host A may not be valid for use against host B if B is out of scope. Check `plan/roe.json` before lateral.
- **Sandbox bash discipline** applies cross-cutting (auto-injected into every sub-agent's bash tool prompt — no manual load required).

## Handoff Format (output files)

```
/workspace/post-exploit/
├── creds_<host>.json              # collected credentials (hashes, tickets, plaintext)
├── privesc_<host>.txt             # escalation results
├── lateral_<host>.txt             # movement log per pivot
├── loot/                          # extracted data (each artifact + SHA-256 sidecar)
└── c2/
    ├── implants/                  # generated implant binaries
    └── c2_operations_log.md       # timestamped operator actions

/workspace/findings/
└── FIND-NNN.md                    # one per delegated objective with evidence
```
