Post-Exploitation

Learn to connect what a command returns with what happens inside the operating system. This collection covers Beacon architecture, situational awareness, session and file management, collection, and execution models.

The 19 sections are organized into five learning pages, with command explanations, comparison tables and execution diagrams.

Scope and provenance

Independently written explanations based on the supplied “7 - Post-Exploitation” chapter. Original course files and screenshots are not redistributed. Examples assume an authorized lab. This site does not execute the commands. Product behavior depends on version and configuration; official supplements were reviewed on 2026-10-27.

Learning path

Order	Page	Original sections
1	3.1 Architecture and command behavior	1–3
2	3.2 Sessions and file systems	4–6
3	3.3 Processes and collection	7–11
4	3.4 Execution and external tools	12–17
5	3.5 Modern defense and review	18–19

flowchart LR
    A["1. Architecture and behavior"] --> B["2. Sessions and files"]
    B --> C["3. Processes and collection"]
    C --> D["4. Execution and tooling"]
    D --> E["5. Modern defense and review"]

Four questions

Question	Inspect	Example
Where does it run?	Beacon, temporary process, existing process	BOF vs fork & run
Whose authority?	User, token, integrity, session	spawn vs spawnas
What changes?	Files, processes, clipboard, network	printscreen affects clipboard
Where do results go?	Console, result tab, server, Client	download vs Sync Files

Common confusions

Assumption	Correction
Memory-only means no evidence	Disk, memory, process and network visibility are separate
Administrator account always has elevated rights	Inspect the current token and UAC state
Another Beacon means more privilege	Session creation and elevation are different
PID and JID are interchangeable	Process identity and Beacon job identity differ
A download is immediately local	Team Server receives it before Client synchronization
PowerShell requires powershell.exe	Another process can host the engine

Start with Architecture and command behavior, or return to Red Team.