Post-Exploitation

Establish initial access and upgrade your shell

Using the Metasploit skills from the previous lesson, exploit the vsftpd backdoor on Metasploitable to get an initial shell. Once you have a basic command shell, upgrade it to a more functional shell using Python — this gives you job control, tab completion, and the ability to run interactive programs. A raw shell from an exploit is often limited: it has no terminal emulation, so programs like sudo, passwd, and vim behave strangely or not at all. The Python pty trick spawns a proper pseudo-terminal that behaves like a normal login shell — confirm your shell upgrade worked by running echo $TERM which should now show xterm or similar.

python -c "import pty; pty.spawn('/bin/bash')"

Perform systematic local enumeration

Enumeration is the most important post-exploitation skill — you need to understand the system before you can move forward effectively. Run each command and carefully read the output: uname -a shows the kernel version (important for kernel exploits), id shows your current user and group memberships, ps aux shows all running processes (look for database servers and web servers), netstat -tulpn shows listening services (some may only be accessible locally), and cat /etc/passwd shows all user accounts. Document everything in your notes — a service running only on localhost that you found via netstat might be your path to a database with sensitive credentials.

uname -a && id && ps aux && netstat -tulpn && cat /etc/passwd

Search for sensitive files and credentials

Systematically search for files that commonly contain credentials or sensitive information: configuration files often contain database passwords and API keys in plaintext, SSH private keys allow authentication to other systems without a password, and SUID binaries run with elevated privileges and may be exploitable for privilege escalation. The find commands below search for these categories — the 2>/dev/null suppresses permission denied errors so you only see results you can actually access. When you find a configuration file, read it fully — a single database password in a config file can unlock an entire application data store and potentially provide access to additional systems.

find / -name "*.conf" 2>/dev/null | head -20
find / -name "id_rsa" 2>/dev/null
find / -perm -4000 -type f 2>/dev/null

Attempt privilege escalation to root

If you have a low-privilege shell, work through the privilege escalation checklist: check sudo permissions first with sudo -l which shows what commands you can run as root without a password. On Metasploitable, many privilege escalation paths exist including SUID binaries like nmap (older versions have an interactive mode that spawns a root shell), writable cron jobs that run as root, and kernel exploits for the outdated 2.6.x kernel. Use the Metasploit post module post/multi/recon/local_exploit_suggester to automatically identify potential escalation paths. A common mistake is trying kernel exploits first — they are risky and can crash the system, so always try sudo and SUID misconfigurations first.

sudo -l
find / -perm -4000 -type f 2>/dev/null
uname -r

Demonstrate persistence (lab environment only)

In a real penetration test, you would demonstrate persistence to show the client that an attacker could maintain long-term access even after the initial vulnerability is patched. In your lab, practice two methods: adding an SSH authorized key (allows passwordless SSH login) and creating a backdoor user account. These techniques are for educational purposes only — never implement persistence on systems you do not own or have explicit written permission to test. After practicing, immediately remove everything you added: delete the backdoor user, remove the SSH key, and verify the cleanup was successful. Leaving persistence mechanisms in place after an engagement is a serious professional violation.

useradd -m -s /bin/bash labuser && echo "labuser:labpass123" | chpasswd
userdel -r labuser

Clean up artifacts and write the exploitation narrative

Before ending the session, remove all artifacts you created: backdoor users, SSH keys, uploaded files, and modified configurations. Run history -c to clear the bash history on the target — note that in a real engagement, you would document this action in your report so the client knows what was cleaned up. Then write a complete exploitation narrative in your notes covering: the initial Nmap scan finding, the vulnerability identified, the exploit used, the access level obtained, the post-exploitation findings (sensitive files, credentials, other systems discovered), and the privilege escalation path. This narrative is the core of your penetration test report.

history -c && exit