After getting a shell, route by where you landed:
- Shell on Linux → Linux PrivEsc Methodology
- Shell on Windows → Windows PrivEsc & Post-Exploitation
- Shell on domain-joined Windows → Active Directory Methodology first
Quick triage
Linux: first 5 commands after getting shell
id && whoami
sudo -l
find / -perm -4000 2>/dev/null | sort # SUID
cat /etc/crontab && ls /etc/cron*
uname -a && cat /etc/os-release
Windows: first 5 commands after getting shell
whoami /priv
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
wmic service get name,startname,pathname | findstr /i /v "C:\\Windows"
schtasks /query /fo LIST /v | findstr "Task To Run"
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated