Skip to main content
Critical Legal Notice: Post-exploitation tools are designed for authorized security testing only. Using these tools on systems without explicit written permission is illegal and constitutes a serious criminal offense. These tools should only be used in controlled lab environments or with proper authorization.

​
Overview

Post-exploitation tools are used by security professionals after gaining initial access to a system. These tools help:
  • Maintain persistent access to compromised systems
  • Gather additional information and intelligence
  • Test detection and response capabilities
  • Assess lateral movement possibilities
  • Evaluate security monitoring effectiveness
Post-exploitation activities should be conducted carefully to avoid system damage and maintain operational security during authorized testing.

​
Available Post-Exploitation Tools

Vegile

Ghost in the shell - Hide backdoors and rootkits from detection

Hera Keylogger

Chrome-based keylogger for credential harvesting

​
Tool Descriptions

​
Persistence & Stealth

Description: Advanced post-exploitation tool that hides your backdoor/rootkit processes, provides unlimited Metasploit sessions, and maintains transparencyInstallation:
git clone https://github.com/Screetsec/Vegile.git
cd Vegile
sudo chmod +x Vegile
Usage:
cd Vegile
sudo bash Vegile
Commands:
# Inject backdoor/rootkit
Vegile -i [backdoor/rootkit]
Vegile --inject [backdoor/rootkit]

# Create unlimited sessions
Vegile -u [backdoor/rootkit]
Vegile --unlimited [backdoor/rootkit]

# Show help
Vegile -h
Vegile --help
Features:
  • Process hiding capabilities
  • Unlimited Metasploit session support
  • Backdoor/rootkit concealment
  • Transparent operation
  • Evasion techniques
Use Cases:
  • Red team persistence testing
  • EDR/AV evasion testing
  • Detection capability assessment
  • Rootkit detection testing
GitHub: Screetsec/Vegile

​
Credential Harvesting

Description: Keylogger specifically designed for Chrome browser to capture credentials and sensitive informationInstallation:
git clone https://github.com/UndeadSec/HeraKeylogger.git
cd HeraKeylogger
sudo apt-get install python3-pip -y
sudo pip3 install -r requirements.txt
Usage:
cd HeraKeylogger
sudo python3 hera.py
Features:
  • Chrome browser-specific keylogging
  • Credential capture
  • Form data harvesting
  • Session monitoring
  • Stealth operation
Captured Data:
  • Usernames and passwords
  • Form submissions
  • Search queries
  • URL history
  • Clipboard content
Detection Considerations:
  • Tests security monitoring capabilities
  • Evaluates endpoint protection
  • Assesses browser security controls
GitHub: UndeadSec/HeraKeylogger

​
Post-Exploitation Phases

​
1. Initial Access Maintenance

1

Establish Persistence

Deploy backdoors and ensure continued access to the compromised system
2

Hide Presence

Use tools like Vegile to hide processes and maintain stealth
3

Escalate Privileges

Attempt to gain higher-level access if initial compromise is limited
4

Secure Communication

Establish encrypted command and control channels

​
2. Information Gathering

1

Credential Harvesting

Deploy keyloggers and credential stealers to capture authentication data
2

System Enumeration

Gather information about system configuration and installed software
3

Network Mapping

Discover other systems and network architecture
4

Data Exfiltration

Carefully extract valuable information without detection

​
Testing Scenarios

​
Red Team Assessment

# Deploy persistence mechanism
cd Vegile
sudo bash Vegile
# Use Vegile interface to inject backdoor

# Deploy credential harvester
cd HeraKeylogger
sudo python3 hera.py

​
Purple Team Exercise

Purple Team Objectives:
  • Red Team: Deploy post-exploitation tools to maintain access
  • Blue Team: Detect and respond to persistence mechanisms
  • Joint Goal: Improve detection capabilities and response procedures

​
Detection Testing

Process Monitoring

Can security tools detect hidden processes?

File Integrity

Are rootkit installations detected?

Network Analysis

Is C2 communication identified?

Behavior Analysis

Are anomalous behaviors flagged?

​
Defensive Considerations

​
Detection Methods

Techniques:
  • Process enumeration from kernel space
  • Cross-validation of process lists
  • Memory analysis for hidden processes
  • System call monitoring
Tools:
  • GMER
  • Volatility Framework
  • Process Hacker
  • System Internals Suite
Indicators:
  • Unusual network connections
  • Unexpected process spawning
  • Suspicious registry modifications
  • Unauthorized file system changes
Solutions:
  • EDR (Endpoint Detection and Response)
  • SIEM correlation rules
  • File Integrity Monitoring
  • Application whitelisting
Best Practices:
  • Implement credential guard
  • Use hardware security keys
  • Enable multi-factor authentication
  • Regular credential rotation
  • Privileged access management
Technologies:
  • Windows Credential Guard
  • Virtual TPM
  • Smart cards
  • Biometric authentication

​
Operational Security

OPSEC Considerations for Authorized Testing:
  1. Documentation: Record all activities with timestamps
  2. Communication: Maintain secure communication with test stakeholders
  3. Scope Adherence: Stay within authorized testing boundaries
  4. System Stability: Avoid actions that could crash or damage systems
  5. Data Handling: Properly secure and dispose of captured data
  6. Cleanup: Remove all tools and persistence mechanisms after testing

​
Cleanup Procedures

​
Post-Assessment Cleanup

# Stop running tools
# Kill keylogger processes
pkill -f hera.py

# Remove installed files
rm -rf ~/HeraKeylogger
rm -rf ~/Vegile

# Check for persistence mechanisms
crontab -l  # Check for scheduled tasks
systemctl list-units  # Check for services

# Verify cleanup
ps aux | grep -i vegile
ps aux | grep -i hera
Always verify complete removal of all testing artifacts and restore systems to their original state.

​
Required Authorization

1

Written Permission

Obtain explicit written authorization from system owners
2

Scope Definition

Clearly define what systems and activities are authorized
3

Rules of Engagement

Establish clear boundaries and prohibited actions
4

Emergency Contacts

Define communication protocols for issues

​
Ethical Considerations

Professional Ethics:
  • Never exceed authorized scope
  • Protect confidentiality of discovered information
  • Minimize system and business impact
  • Report vulnerabilities responsibly
  • Maintain professional standards
  • Follow industry frameworks (PTES, OSSTMM)

​
Use Cases

​
Penetration Testing

Assess the effectiveness of security controls after initial compromise during authorized penetration tests.

​
Red Team Operations

Simulate advanced persistent threats (APT) to test detection and response capabilities.

​
Security Research

Study malware behavior and persistence techniques in isolated lab environments.

​
Security Training

Educate security professionals on attacker techniques and defensive measures.

​
Additional Resources

​
Frameworks and Methodologies

  • MITRE ATT&CK Framework - Post-compromise tactics
  • PTES (Penetration Testing Execution Standard)
  • OWASP Testing Guide

​
Training and Certification

  • OSCP (Offensive Security Certified Professional)
  • GPEN (GIAC Penetration Tester)
  • CRTP (Certified Red Team Professional)

Build docs developers (and LLMs) love

Get started for freeTalk to us