Post-Exploitation Modules

Gaining a session is only the beginning. Post-exploitation is everything you do afterward to demonstrate impact: gathering evidence, escalating, and reaching deeper into the network.

Metasploit's post modules automate these tasks against an existing session, all within the authorized scope of the engagement.

Post modules act on a session you already have. You load one, point it at the session, and run it. The path structure tells you the platform and purpose.

First, learn the host thoroughly. Gather modules collect:

• Logged-on users and local accounts.
• Installed software and patch level.
• Network configuration and routes.
• Antivirus and security products present.

This intelligence shapes your next moves and the client report.

Loot is valuable data: password hashes, cached credentials, browser-stored passwords, SSH keys, and config files.

Recovered credentials are gold because they often unlock other systems. Metasploit stores them in its database for reuse and reporting.

Persistence means maintaining access across reboots. In red-team engagements this proves real-world risk, but it must be explicitly authorized and carefully cleaned up afterward.

Always document any persistence mechanism you install so the client can verify removal. Unauthorized persistence is both unethical and illegal.

Pivoting uses a compromised host as a stepping stone to reach networks you cannot touch directly. The first host often has access to an internal subnet hidden from you.

By routing traffic through that host, you extend your reach deeper into the environment, mirroring how real attackers move laterally.

The autoroute post module (or the route command) tells Metasploit to send traffic for an internal subnet through your existing session.

After adding a route, other Metasploit modules can scan and attack hosts on that hidden network as if you were local.

To use tools outside Metasploit through the pivot, set up forwarding:

• portfwd: forwards a single remote port to your local machine.
• socks_proxy auxiliary module: exposes the whole pivot as a SOCKS proxy you can run with proxychains.

With looted credentials and a pivot route, you move laterally to other internal hosts. Techniques include reusing password hashes (pass-the-hash) and authenticating to additional services.

Each new host can yield more credentials, creating a chain that demonstrates how far an attacker could reach. Document the full path for the report.

Professional engagements end with cleanup: remove uploaded files, persistence, and added routes, then restore the environment.

Your final deliverable is a clear report mapping each foothold, escalation, pivot, and looted credential to a business risk and a remediation recommendation. The goal is to help the client improve, not just to break in.

Large engagements produce many sessions. Stay organized:

• sessions -l lists all active sessions.
• sessions -i N interacts with one.
• sessions -u N upgrades a basic shell to Meterpreter.
• sessions -K kills all sessions during cleanup.

Naming and tracking sessions keeps a complex pivot from descending into chaos.

Identify the technique being described.

You completed post-exploitation:

• Post modules run against an existing session to enumerate, loot, and act.
• Loot (hashes, keys, configs) often unlocks more systems.
• Persistence only with explicit authorization and documented cleanup.
• Pivoting via autoroute, plus portfwd/SOCKS, enables lateral movement into hidden networks.
• End with thorough cleanup and reporting.

This completes Metasploit Framework Mastery. Next module: Nmap Deep Dive.