Post Exploitation
What happens after initial access: harvesting credentials, moving laterally through a network, and maintaining a foothold via a command-and-control channel.
| Tool | Source | Notes |
|---|---|---|
| impacket | official | AD attack toolkit (secretsdump, psexec, wmiexec, etc.) |
| sliver | aur | Modern cross-platform C2 framework |
| powershell-empire-git | aur | PowerShell/Python post-exploitation C2 framework, AD/lateral-movement focused — complements Sliver rather than replacing it |
Two C2 frameworks are included deliberately, not redundantly: Sliver leans general-purpose cross-platform, while PowerShell Empire specializes in Active Directory and Windows lateral movement. GTFOBins and LOLBAS are the standard living-off-the-land references for privilege escalation once you’re in.