Lab — Post-Ex
Post-ex goals + in-RoE pivot on YOUR lab network — document path, no cover-tracks.
Visual · t19_postex_lab
Lab: post-ex + pivot inside $LAB RoE. Original Cyberlium.
Prove the brief goal on lab hosts you listed — then revert and write what defenders would see.
On YOUR lab engagement ($LAB_VM + optional $LAB_AD hosts in RoE): (1) achieve one post-ex goal from brief (e.g., reach second lab host or capture lab flag); (2) document pivot method at summary level if brief requires hop — only between in-scope lab IPs; (3) write defender detection paragraph (what log/alert would fire); (4) explicit note: no log clearing, no EDR disable, no out-of-scope pivot; (5) snapshot revert all lab VMs. chmod 600 timeline with UTC stamps. No dorm LAN bridging, no anti-forensics, no stranger targets.
1. Goal execution
Verify each hop IP in RoE before connection.
Timeline: initial access → post-ex action → pivot (if any) → goal proof redacted.
Command guide
Try these commands — Goal execution
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Post-ex notes — after enum commands on YOUR lab PTES reporting — http://www.pentest-standard.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -sV --top-ports 10 "$LAB_HOST" | head -15 cat > "$HOME/cyberlium-lab/t19-postex.txt" <<'EOF' goals: prove impact on lab; collect evidence pivot: lab VLAN only never: exfil real PII; never wipe logs EOF
Command — copy this
grep never "$HOME/cyberlium-lab/t19-postex.txt"
Primary tools to practice this lesson: grep, nmap. Reference sites: Post-ex notes; PTES reporting (http://www.pentest-standard.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender paragraph
Name detection sources: auth logs, flow logs, EDR process chain — for YOUR lab path.
Honest documentation beats hiding actions from mentor or blue team.
3. Teardown
Revert snapshots. Secure notes. Confirm no persistence left on lab VLAN.
Refusal line in pack: cover-tracks techniques not used.
4. What you ship: post-ex lab pack
Goal proof + pivot summary (if used) + defender detection paragraph + refusal line — chmod 600.
5. What you record before the next lesson
Post-ex lab pack path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Pivot into home LAN and clear logs 'for stealth practice.'
- Right: Post-ex lab inside RoE with honest timeline. Next: quiz.
Mission: post-ex lab
1) Achieve one brief post-ex goal. 2) Document path with UTC timeline. 3) Defender paragraph + no cover-tracks line. 4) Revert lab VMs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum pivot proof for brief?”
APPLY: Post-ex lab pivot scope:
APPLY: True or False: Log clearing is part of post-ex lab.
APPLY: Post-ex lab pack includes: