Penelope Walkthrough Demonstrates Cross-Platform Post-Exploitation Workflows
Summary
A controlled-lab walkthrough shows Penelope managing Windows and Linux shells, post-exploitation tools, and pivoting with Ligolo-ng, then outlines defensive controls for disrupting the demonstrated activity.
Key points
- The walkthrough uses Penelope to manage reverse shells, interactive sessions, payloads, file transfers, and port forwarding.
- In the lab, the operator demonstrates privilege escalation, credential collection, Active Directory reconnaissance, and Kerberoasting on a Windows Server 2019 domain controller.
- Ligolo-ng is used to pivot through the domain controller into a hidden subnet and reach an Ubuntu host.
- The article demonstrates Linux privilege-escalation enumeration and collection of forensic artifacts.
- Defensive recommendations include network segmentation, egress filtering, credential protections, and monitoring for tunnels, shell activity, and unexpected listeners.
Article Details
- Topic
- Penelope post-exploitation framework walkthrough covering Windows and Linux shell handling, privilege escalation, credential and Active Directory operations, pivoting, and file transfer in an authorized lab.
MITRE ATT&CK
T1003.004 · LSA SecretsLaZagne was used to extract LSA secrets from the Windows host.T1021.004 · SSHThe operator used SSH credentials to access the Ubuntu host as pentest.T1059.001 · PowerShellA PowerShell reverse-shell payload was generated and executed on the Windows target.T1059.004 · Unix ShellA Linux shell payload used a named pipe and netcat to establish a reverse shell; shell commands were also run on the Linux host.T1090.001 · Internal ProxyLigolo-ng routed traffic through the compromised domain controller to reach a hidden internal subnet.T1105 · Ingress Tool TransferPenelope downloaded and staged post-exploitation tools on the target.T1134.001 · Token Impersonation/TheftGodPotato impersonated a SYSTEM token to run a command with elevated privileges.T1558.003 · KerberoastingRubeus Kerberoasted the domain service account raj and saved the ticket hash for offline cracking.
CVE
CVE-2021-22555Broadcom · Fabric operating system; Linux · Linux kernel; +19 moreknown CVEs, surfacing candidates such as CVE-2021-3156 (the Sudo “Baron Samedit” heap overflow) and CVE-2021-22555 (a Netfilter heap out-of-bounds write), complete with exposure ratings and exploit links.CVE-2021-3156Beyondtrust · Privilege management for mac; Beyondtrust · Privilege management for unix/linux; +22 morelinux-exploit-suggester and matches the kernel against known CVEs, surfacing candidates such as CVE-2021-3156 (the Sudo “Baron Samedit” heap overflow) and CVE-2021-22555 (a Netfilter heap out-of-bounds write),
Products
Ubuntu 22.04.5 LTSArmed with valid credentials, we open an SSH session as the “pentest” user and land on an Ubuntu 22.04.5 LTS host named ignite—a machine that simply did not exist from Kali’s perspective minutes earlier.Windows Server 2019that managed a complete Windows and Linux engagement, from initial reverse shell access on a Windows Server 2019 Domain Controller to credential dumping, Active Directory abuse, Kerberoasting, and cleanup.
Tools
GodPotato#PenelopeLaZagne(winPEAS, LinPEAS, PowerUp, PrivescCheck, potato exploits, and more), Credential Dumping (Mimikatz, LaZagne, Snaffler, SharpWeb), Active Directory (PowerView, SharpHound, GhostPack), Forensics, PivotingLigolo-ngThe walkthrough also showed pivoting with Ligolo-ng into a hidden subnet, compromising a Linux host, and using Penelope’s built-in listeners, port forwarding, file transfer, and HTTP serving features to control theLinPEAS#PenelopeMetasploit FrameworkPenelope integrates cleanly with the Metasploit Framework.Meterpreter#PenelopeMimikatz#PenelopePenelopePenelope is presented as a full post-exploitation framework that managed a complete Windows and Linux engagement, from initial reverse shell access on a Windows Server 2019 Domain Controller to credential dumping,Rubeus#PenelopewinPEAS#Penelope