This repository documents, hands-on roadmap for Post-Exploitation in offensive security operations.
It covers techniques, custom tooling, and practical development in Bash, Python, C, and Go.

1. Environment Setup
2. Host-Based Post-Exploitation
3. Credential Access & Abuse
4. Persistence Techniques
5. Lateral Movement
6. Active Directory & Kerberos Abuse
7. Defense Evasion
8. Data Exfiltration
9. Custom Tool Development
10. OPSEC & Cleanup

• AD Lab with multiple domains & forests (e.g., via pfsense, ESXi, or Terraform)
• C2 Setup: Sliver, Mythic, or custom C2
• Redirector + CDN infrastructure
• Python virtual environment & Go workspace

• Host Enumeration (users, groups, scheduled tasks)
• File/Process/Service inspection
• AV/EDR detection & response analysis
• PowerShell, Bash & Python one-liners
• Bash and Python post-exploitation scripts

• LSASS dumping (with & without Mimikatz)
• SAM & SYSTEM hive parsing
• DPAPI secrets extraction
• Credential Manager abuse
• Credential theft in Python and Go
• Token impersonation (Python + Windows API)

• Registry run keys / WMI / Scheduled tasks
• DLL Hijacking & Service abuse
• Go-based persistence agent
• Python script for autoload persistence
• C loader with shellcode & beacon callbacks

• Pass-the-Hash / Pass-the-Ticket
• PSExec, WinRM, RDP hijacking
• SMB & Named Pipe relays (Impacket)
• Lateral tools in Python
• Go-based PsExec-like binary

• BloodHound & SharpHound path analysis
• DCSync / DCShadow
• Kerberoasting with Python & Go
• AD ACL abuse automation
• Abusing AdminSDHolder & GPOs
• Ticket forging with Rubeus / Go

• AMSI Bypass (C & PowerShell)
• ETW patching
• Inline syscall injection (C)
• LOLBins (Living Off the Land Binaries)
• Obfuscation: Python/Go payload splitters
• Shellcode encryption loaders

• DNS Tunneling (Python)
• Steganography (Python-based encoder)
• Exfil to Dropbox, Google Drive via API
• Archive + AES encryption
• Custom Go client for stealth exfil

• Host recon & enumeration scripts
• Credential dumpers
• Covert channels

• Shellcode loaders (PE injection, DLL injection)
• Custom stagers with inline syscalls
• AV/EDR evasion payloads

• Cross-platform agents
• Custom HTTP/DNS C2 beacons
• Process injection with Go syscall wrappers

• Unix-based enumeration & persistence
• SSH agent hijacking

• Cleaning artifacts (prefetch, logs, registry)
• Disabling Defender logs temporarily
• Secure deletion of payloads
• OPSEC-safe beaconing
• Python & Go cleanup scripts

• MITRE ATT&CK - Post-Exploitation
• Youtube
• Sliver Framework Docs
• Impacket

Pull requests are welcome for additional scripts, techniques, or tool enhancements.