Phase 08: Post-Exploitation, Flag Vault & Artifact Collection

Retrieve user and root flags, dump master password databases for credential reuse, clean all temporary files, and compile final writeup documentation. This phase has 4 checklist items. Placeholders such as {TARGET_IP} are values for your target.

Flag Looting & Evidence Archival

Extract User Flag & Root/SYSTEM Flag

Safely retrieve flags and copy directly into ZeroBox Flags Vault.

cat /home/*/user.txt /root/root.txt or type C:\Users\*\Desktop\*flag.txt

Credential & Hashdump Extraction (NTDS.dit / shadow)

Extract password hashes for offline password recovery or credential stuffing in lab network.

impacket-secretsdump {DOMAIN}/{ADMIN}@{TARGET_IP} or cat /etc/shadow

Cleanup Temporary Payloads & Tools

Remove uploaded exploitation binaries and restore original system state.

rm -f /tmp/linpeas.sh /tmp/shell.elf C:\Temp\winpeas.exe

Document Full Kill-Chain in Writeup Studio

Ensure all vulnerabilities, PoCs, and remediation suggestions are thoroughly preserved.

Export checklist to Markdown and sync with Obsidian vault

All phases

1. Host Discovery & Surface Mapping
2. Protocol & Service Enumeration
3. Vulnerability Identification & Threat Modeling
4. Foothold Execution & Initial Access
5. Shell Stabilization & Context Triage
6. Internal System & Network Reconnaissance
7. Privilege Escalation & Lateral Movement
8. Post-Exploitation, Flag Vault & Artifact Collection