https://solvere.app/tags/post-exploitation/ Recent content in Post-Exploitation on Solvere Labs en-us contact@solvere.app (Solvere Labs) contact@solvere.app (Solvere Labs) © 2026 Solvere Labs Fri, 19 Jun 2026 00:00:00 +0000 https://solvere.app/icon-512.png https://solvere.app/tags/post-exploitation/ https://solvere.app/tutorials/guides/windows-download-methods/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transferwindowspowershellpost-exploitation https://solvere.app/tutorials/guides/windows-download-methods/ The Windows-native ways to pull a file when you have a shell on a Windows host: certutil, bitsadmin, PowerShell Invoke-WebRequest, WebClient, and the in-memory IEX cradle, with an honest look at how defenders see each one. https://solvere.app/tutorials/guides/smb-file-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transfersmbwindowsimpacketpost-exploitation https://solvere.app/tutorials/guides/smb-file-transfer/ Move files to and from a Windows target over SMB: stand up a share with impacket-smbserver, then pull, run, and push back with native copy / net use or smbclient. Quick reference with a modular cheat sheet and per-command breakdowns. https://solvere.app/tutorials/guides/scp-ssh-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transfersshlinuxpost-exploitation https://solvere.app/tutorials/guides/scp-ssh-transfer/ The scp and sftp quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real transfer. Upload and download, copy a directory with -r, authenticate with a recovered key, hop through a jump host, pipe over ssh when scp is missing, and verify with a checksum. https://solvere.app/tutorials/guides/netcat-file-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transfernetcatnetworkinglinuxpost-exploitation https://solvere.app/tutorials/guides/netcat-file-transfer/ The netcat file-transfer quick reference: flags, a modular cheat sheet, and worked breakdowns. Listen and save, connect and send, close cleanly with -N or -q0, stream a directory with tar, encrypt with socat OPENSSL, fall back to bash /dev/tcp when nc is missing, and checksum to catch truncation. https://solvere.app/tutorials/guides/http-file-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transfernetworkinglinuxwindowspost-exploitation https://solvere.app/tutorials/guides/http-file-transfer/ The HTTP file-transfer quick reference: serve a folder from your attacker box in one line, then pull files onto the target with wget, curl, certutil, PowerShell, or curl.exe. Flags, a modular cheat sheet, in-memory execution, upload-back with updog, checksum verification, and beating egress filters by serving on 80 or 443. https://solvere.app/tutorials/guides/file-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transferpost-exploitationnetworkingwindowslinux https://solvere.app/tutorials/guides/file-transfer/ The file-transfer quick reference: the serve-and-pull vs push-and-receive decision, a modular copy-paste cheat sheet, and a worked breakdown of every method. Serve a folder over HTTP, pull with wget or certutil, host an SMB share, move a file with netcat or socat, copy over scp, paste a base64 blob, and checksum both ends. https://solvere.app/tutorials/guides/base64-transfer/ Fri, 19 Jun 2026 00:00:00 +0000 Solvere Labs file-transferlinuxwindowspost-exploitation https://solvere.app/tutorials/guides/base64-transfer/ The base64 file-transfer quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Encode a file to one pasteable line, decode it with a heredoc, move files with certutil or PowerShell on Windows, chunk a blob too long to paste, and checksum both ends to prove it arrived intact. https://solvere.app/tutorials/guides/winpeas/ Sat, 28 Mar 2026 00:00:00 +0000 Solvere Labs windowsprivilege-escalationenumerationpost-exploitation https://solvere.app/tutorials/guides/winpeas/ A practical WinPEAS guide: get the Windows privilege-escalation enumerator onto a target, read its color-coded output, focus on the high-signal findings, and avoid drowning in noise. https://solvere.app/tutorials/guides/pspy/ Sat, 28 Mar 2026 00:00:00 +0000 Solvere Labs linuxprivilege-escalationenumerationcronpost-exploitation https://solvere.app/tutorials/guides/pspy/ The pspy quick reference: flags, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Transfer the static binary, watch processes and cron fire in real time without root, catch a UID=0 root timer, save and grep the feed for root commands, and turn a writable cron script into a privilege-escalation lead. https://solvere.app/tutorials/guides/powerup/ Sat, 28 Mar 2026 00:00:00 +0000 Solvere Labs windowsprivilege-escalationenumerationpowershellpost-exploitationunquoted-service-path https://solvere.app/tutorials/guides/powerup/ A practical PowerUp guide: run the PowerSploit Windows privesc auditor, read its check output honestly, focus on the high-signal service and path findings, and keep it lab-safe. https://solvere.app/tutorials/guides/linpeas/ Sat, 28 Mar 2026 00:00:00 +0000 Solvere Labs linuxprivilege-escalationenumerationlinpeaspost-exploitationsudosuid https://solvere.app/tutorials/guides/linpeas/ The LinPEAS quick reference: the flags that matter, a modular copy-paste cheat sheet, and a worked breakdown of every real situation. Deliver the script to a target, run and save a clean no-color report, tune the depth (stealth, all-checks, extra, regex), scope checks by group or MITRE technique, grep the high-signal findings, and read the color legend honestly. https://solvere.app/tutorials/guides/mimikatz/ Tue, 24 Mar 2026 00:00:00 +0000 Solvere Labs windowsactive-directorymimikatzpass-the-hashdcsyncpost-exploitation https://solvere.app/tutorials/guides/mimikatz/ A practical Mimikatz guide for authorized AD labs: what it extracts, the core modules, how to read the output, and the defenses that stop it. https://solvere.app/tutorials/guides/evil-winrm/ Fri, 20 Mar 2026 00:00:00 +0000 Solvere Labs windowsactive-directorywinrmevil-winrmpost-exploitationlateral-movement https://solvere.app/tutorials/guides/evil-winrm/ A practical Evil-WinRM guide: get an interactive WinRM shell on Windows with a password, hash, or certificate, move files, load scripts, and stay inside scope.