the post exploitation loop after landing a shell

landing a shell is just the opening move

if you've ever read a pentest report and seen "initial access achieved" followed by three pages of scary stuff, this is what that three pages is about. attackers don't stop once they get a shell. they run a loop: recon, escalate, persist, pivot, loot. understanding this loop is how you, as the person defending a box, know exactly where to put your tripwires. every step an attacker takes leaves footprints if you're looking in the right spot.

situational awareness: they're mapping your house

the first thing an attacker does after landing on a system is figure out where they are. who am i, what machine is this, what's the network look like. commands like id, hostname, ip a, and checking /etc/passwd are basically them turning on the lights in a room they just broke into.

for defenders, this is your first detection opportunity. a shell that immediately starts running identity and network enumeration commands, especially from a process that shouldn't be doing that, like a web server user account, is a huge red flag. this is exactly what edr and host based logging exist for. if you're not logging process execution on your servers, you're flying blind for this entire phase.

escalation: they want more than they were given

once they know where they are, they want more privilege than the account they landed on. this usually means checking sudo -l to see what they can run as root, hunting for suid binaries with something like find / -perm -4000, or digging through config files and scripts for hardcoded credentials.

the defensive fix here is boring but it works: audit your sudoers file regularly, and actually understand every line in it. don't leave suid bits on binaries that don't need them. run find / -perm -4000 -type f yourself on your own systems periodically and ask "why does this have that bit set." and please, stop putting passwords in plaintext config files or shell scripts. use a secrets manager or at minimum environment variables with locked down permissions.

persistence: they're trying to move in

a smart attacker doesn't want to re-exploit the same vulnerability every time they want back in. so they set up persistence: a new cron job, a modified systemd service, an added ssh key, a new user account. it's the digital equivalent of copying your house key.

this is where file integrity monitoring earns its keep. you want alerts on new cron entries, new services, and changes to ~/.ssh/authorized_keys. tools like auditd on linux or sysmon on windows can catch this in real time if configured to watch the right paths. check your crontabs and systemd unit files right now, seriously, go look. you might find something that's been sitting there a while.

pivot and loot: they're not done with just your box

the final two steps in the loop go together. pivoting is the attacker asking "what else can i reach from here" by checking arp tables, ssh known_hosts, saved credentials, and internal network ranges. looting is grabbing anything valuable, ssh private keys, database dumps, api keys, config files with connection strings.

this is why network segmentation matters so much. a compromised web server shouldn't be able to freely talk to your database server, your internal admin panels, and your backup server all at once. if it can, one shell turns into your entire environment. same goes for credential reuse. if the same ssh key or service account works everywhere, an attacker who loots one key owns everything downstream.

the takeaway

the post exploitation loop isn't magic, it's just a checklist attackers run through, and every item on that checklist maps to something you can monitor, restrict, or remove. tighten your sudoers file, audit your suid binaries, watch your cron jobs and startup services, segment your network so one compromised box isn't a golden ticket, and stop reusing credentials across systems. the loop only works because most environments give attackers an easy path at every single step. take away the easy paths and a landed shell becomes a dead end instead of a foothold.