Lion Cipher Lab

After the shell: Metasploit post-exploitation in your lab — and the traces it leaves for a defender (Part 2)

• Penetration Testing / Red Team
• Advanced
• ~90 min
• Free · no account required

Why it matters

In Part 1 the story ended the instant a shell opened — 'got root', roll credits. Every real engagement is the opposite: getting the shell is the START of the report, not the end. What you do AFTER access — who am I, what can I reach, what can I steal, how do I get deeper, how do I move to the next machine — is called post-exploitation, and it is where a penetration test either proves real business impact or fizzles into 'we got a shell, so what'. This lab teaches that second half through Metasploit's Meterpreter, the advanced payload testers actually live in. But it does something most…

What you'll learn

• understanding what post-exploitation is — everything a tester does AFTER landing a session — and why it is where an engagement's real value and real risk both live
• explaining what Meterpreter is as a payload: an in-memory, DLL-injection agent that resides in RAM and writes nothing to disk, and exactly why that matters for detection
• running the core Meterpreter post modules on a target you own — sysinfo, getuid, getprivs, ps, migrate — and reading what each returns
• understanding hashdump: what credential dumping is, why it is done only on a box you own, and how it maps to ATT&CK OS Credential Dumping
• using process migration (migrate) and understanding it as process injection into another running process
• running post/multi/recon/local_exploit_suggester to enumerate local privilege-escalation options
• understanding a routed pivot (autoroute) conceptually — using one compromised host as a router to reach a network you otherwise could not
• pivoting constantly to the blue-team view: mapping each attacker action to a MITRE ATT&CK technique id and to the Sysmon event id that would catch it
• building an 'attacker action -> defender signal' table and understanding the forensic footprint a Meterpreter session leaves (new process, network beacon, odd parent/child from migrate, event-log gaps)
• the judgment: WHEN Metasploit is the right tool and when it is loud and wrong, WHY in-memory payloads evade file-based AV but light up behavioural/EDR telemetry, and HOW to do post-exploitation better as both tester and defender

Steps in this lab

1. Authorization and scope first: this is an assumed-breach study on a box you own
2. The words you need: post-exploitation, Meterpreter, in-memory, post module, ATT&CK, Sysmon
3. Build the lab: a vulnerable Windows target with Sysmon, plus Kali, on a host-only net
4. Prove the isolation, and take the defender's seat FIRST
5. Assumed breach: generate your own payload, catch it, and read the first two signals
6. Meterpreter recon: sysinfo, getuid, getprivs — and the event-log GAP
7. ps and migrate: process injection you can SEE in the log
8. hashdump: credential dumping — only ever on your own box
9. local_exploit_suggester: what post modules look like, and privilege-escalation recon
10. The routed pivot (autoroute), conceptually: one host as a doorway to a network
11. The forensic footprint: fill in the table, and hand off to memory forensics
12. The judgment: when Metasploit is right, when it's wrong, and how to do it better

Open the full interactive lab →