# Post-Exploitation

> Linux post-exploitation guides for exfil, persistence, and creds

- **URL:** https://hackindex.io/platforms/linux/post-exploitation
- **Platform:** [Linux](https://hackindex.io/platforms/linux.md)
- **Tags:** creds, persistence
- **Published:** 2026-02-13
- **Updated:** 2026-03-29

After gaining an initial shell, your goal is to extract credentials, identify privilege escalation paths, establish persistence, and prepare for lateral movement. Avoid noisy actions unless authorized, focus on live system inspection and high-signal data.

## Guides

- [Credentials](https://hackindex.io/platforms/linux/post-exploitation/credentials.md): Techniques for harvesting Linux credentials post-exploitation, covering password files, hashes, SSH keys, memory dumps, and credential reuse strategies.
  - [Browser saved passwords](https://hackindex.io/platforms/linux/post-exploitation/credentials/browser-saved-passwords.md): Extracting credentials stored in browser password managers on Linux systems using filesystem access and decryption techniques during post-exploitation.
  - [Credential hunting in files](https://hackindex.io/platforms/linux/post-exploitation/credentials/credential-hunting-in-files.md): Techniques for locating stored credentials in Linux files, configs, logs, and history files during post-exploitation to escalate privileges or move laterally.
  - [Process secret hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/pprocess-secret-hunting.md): Enumerate running process memory and cmdline args to extract plaintext secrets, credentials, and sensitive data from live Linux processes.
  - [Shell history credential hunting](https://hackindex.io/platforms/linux/post-exploitation/credentials/shell-history-credential-hunting.md): Extracts credentials and sensitive data from shell history files (.bash_history, .zsh_history) across user accounts during post-exploitation.
  - [SSH keys and agent harvesting](https://hackindex.io/platforms/linux/post-exploitation/credentials/ssh-keys-and-agent-harvesting.md): Techniques for harvesting SSH keys and abusing agent forwarding on compromised Linux hosts to enable lateral movement across infrastructure.