Post-Exploitation, Pivoting, and Web Shell/Command-and-Control Tradecraft
Post-exploitation and pivoting
After RCE, stabilize the shell (PTY upgrade), enumerate the host, and collect credentials, keys, configs, database access, and cloud metadata. Linux: sudo -l, SUID, cron, capabilities. Windows: service permissions, tokens, saved credentials. Pivot with SSH local/remote/dynamic forwarding, socat, chisel, or ligolo-ng; use proxychains for tools that lack proxy support. Web shells should be minimal and removed after use. C2 tradecraft: sleep/jitter, redirectors, domain fronting where lawful, and avoid noisy outbound beacons.
Worked example
Command injection gives a reverse shell as www-data. Upgrade with python3 -c 'import pty;pty.spawn("/bin/bash")', then run sudo -l and find vim allowed. Escalate to root, read /home/dev/.ssh/id_rsa, and use SSH dynamic forwarding ssh -D 1080 [email protected] to reach an internal 10.0.0.0/24 subnet through proxychains. The reasoning is to convert web access into a pivot, using discovered credentials rather than blind scanning.
Traps
Leaving shells and uploaded files; running loud scans; not upgrading a shell before using interactive tools; ignoring internal DNS; failing to document every pivot and credential; using a web shell where a proper tunnel is needed.