# Post-Exploitation

> Windows post-exploitation enum, creds, loot, and file transfer guides

- **URL:** https://hackindex.io/platforms/windows/post-exploitation
- **Platform:** [Windows](https://hackindex.io/platforms/windows.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

Windows post-exploitation focuses on credential dumping and situational awareness after gaining elevated access. The SAM database holds local account hashes, LSA secrets store service account credentials and auto-logon passwords, and LSASS process memory contains plaintext passwords, NTLM hashes, and Kerberos tickets for currently logged-in users.

Mimikatz is the standard tool for LSASS dumping (sekurlsa::logonpasswords), but alternatives like nanodump, pypykatz, and comsvcs.dll MiniDump work when Mimikatz is blocked. DPAPI decryption recovers saved browser passwords, RDP credentials, and Wi-Fi keys. Token enumeration reveals impersonation opportunities across the system.

Beyond credentials, this phase covers network inspection (internal routes, DNS, ARP), domain trust enumeration, and gathering the intelligence you need to plan lateral movement and identify high-value targets in the environment.

## Guides

- [Transferring Files to and from Windows](https://hackindex.io/platforms/windows/post-exploitation/transferring-files-to-and-from-windows.md): Covers techniques for moving files between attacker and Windows targets post-compromise, including common transfer methods like SMB, HTTP, and PowerShell.
- [Windows File and Data Loot Collection](https://hackindex.io/platforms/windows/post-exploitation/windows-file-and-data-loot-collection.md): Techniques for locating and extracting sensitive files, credentials, and user data from compromised Windows systems during post-exploitation reconnaissance.
- [Windows Local Situational Awareness](https://hackindex.io/platforms/windows/post-exploitation/windows-local-situational-awareness.md): Enumerate local Windows system info, users, groups, privileges, network config, and running processes to build situational awareness post-compromise.
- [Windows Network Reconnaissance Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation/windows-network-reconnaissance-post-exploitation.md): Covers post-exploitation network reconnaissance on Windows systems, including enumeration of hosts, shares, active sessions, and domain topology using native tools.
- [Windows Post-Exploitation Enumeration Tools](https://hackindex.io/platforms/windows/post-exploitation/windows-post-exploitation-enumeration-tools.md): Covers key Windows post-exploitation enumeration techniques using tools like WinPEAS, PowerView, and BloodHound to identify privilege escalation paths and lateral movement opportunities.
- [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting.md): Covers techniques for extracting Windows access tokens and credentials post-compromise, including token impersonation, LSASS dumping, and privilege escalation.