00
About this phase
A foothold as an unprivileged user demonstrates little on its own. Privilege escalation turns it into administrator or root; persistence keeps the access; pivoting uses the compromised host as a stepping stone deeper into the network; and looting gathers the evidence that proves business impact. Meterpreter ties many of these together. Critically, post-engagement cleanup — removing tools, payloads, and accounts — is part of professional practice, not an afterthought.
This phase shares ground with the defensive side of the site — the Kill Chain and Host Forensics describe the very artifacts a tester leaves behind and a defender hunts for.
Lessons
6 live
Phase
05 of 08
Status
Complete
01
Lessons in this phase
05.01Live →
05.02Live →
05.03Live →
05.04Live →
05.05Live →
05.06Live →
Meterpreter & Session Management
Working inside a Meterpreter session: the post modules, file system, and pivoting commands.
Windows Privilege Escalation
Misconfigurations, token abuse, unquoted service paths, and the classic Windows escalation routes.
Linux Privilege Escalation
SUID binaries, sudo abuse, cron jobs, and weak permissions. Cross-links to Linux Administration.
Persistence & Lateral Movement
Maintaining access and pivoting to higher-value hosts across the network.
Looting: Evidence of Impact
Collecting the proof that makes a finding undeniable — without exfiltrating real sensitive data.
Post-Engagement Cleanup
Removing artifacts and restoring the environment — the professional obligation that closes the technical work.