--- title: "Operator Toolkits — Catalog & Reference · VORNAC Research" description: "Meterpreter, PowerShell, and the broader pentest toolkit catalog — recommended defaults per slot, with the Linux and Python operator notes that round out the kit." url: https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/operator-toolkits --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Operator Toolkits — Catalog & Reference Reference · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Operator Toolkits — Catalog & Reference. Meterpreter, PowerShell, and the broader pentest toolkit catalog — recommended defaults per slot, with the Linux and Python operator notes that round out the kit. ## Toolkit by slot — default + fallback - **C2.** Default Sliver (open source, modern, robust). Fallback Cobalt Strike (still the polished baseline, IOC-loud). Mythic for engagements where modular agents are needed. - **Initial access — Windows.** Default `InveighZero` for LLMNR/NBT-NS responder + `ntlmrelayx` chain. Fallback `responder` + `impacket-ntlmrelayx`. - **Credential dump — Windows.** Default `nanodump` (PROCEXP152-style, bypasses many EDR LSASS hooks). Fallback `secretsdump.py -ntds` via VSS shadow copy on DC. - **Lateral movement.** Default WinRM via `evil-winrm` (least loud), then SMB-Exec via `impacket-psexec`, last resort DCOM via `impacket-dcomexec`. - **Privilege escalation enum.** Default `winPEAS` / `linPEAS`. Fallback `PowerUp.ps1` for Windows token paths. - **Exfiltration.** Default DNS over Cloudflare DoH (`iodine`, custom). Fallback HTTPS to attacker domain with valid Let's Encrypt cert. ## Meterpreter — commands to know cold - **Session management.** `background`, `sessions -i N`, `sessions -u N` upgrade shell→meterpreter, `sessions -K` kill all. - **Pivoting.** `route add 10.10.10.0/24 N`, then `auxiliary/server/socks_proxy` on operator side. - **Post-modules.** `post/windows/gather/hashdump`, `post/windows/manage/migrate`, `post/multi/recon/local_exploit_suggester`. - **Don't.** `getsystem` on EDR-hardened hosts — every technique it tries is flagged. Use credential-based pathways instead. ## PowerShell that survives modern EDR - **AMSI bypass.** Patch `amsi.dll!AmsiScanBuffer` in-memory before loading payload. Signatures rotate; use a current loader. - **Constrained Language Mode escape.** Find a signed binary that loads attacker-controlled DLL (DLL hijack via signed COM/RunDLL surface). - **Avoid `Invoke-Expression`, `DownloadString`.** Both ETW-logged and signature-matched. Prefer `[Reflection.Assembly]::Load([Convert]::FromBase64String(...))` with rotated obfuscation. - **Disable PowerShell logging at the script-block level.** Patch ETW via `ntdll!EtwEventWrite` hook before any logged command. ## Linux post-foothold - **Capability enum.** `getcap -r / 2>/dev/null`. `cap_setuid`, `cap_dac_read_search`, `cap_sys_admin` are immediate paths to root. - **SUID chains.** `find / -perm -4000 -type f 2>/dev/null`. Cross-check each result against GTFOBins. - **Kernel exploit selection.** `uname -a` + `linux-exploit-suggester.sh`. Last resort only — kernel exploits crash hosts, document scope explicitly. - **Cron + systemd.** `cat /etc/crontab /etc/cron.*/* 2>/dev/null`; `systemctl list-timers`. Writable cron scripts run as root often enough to check first. - **Mount + path injection.** `mount | grep -v nosuid` for missing nosuid mount option; `echo $PATH` for writable PATH entries before root commands. **Rule of thumb**Match the tool to the host's defensive posture. Cobalt Strike on a vanilla Defender host is fine. Cobalt Strike on a Crowdstrike-managed host is a fast way to get caught. Know what they run before you load. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Reference Engagement phases Methodology Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) From reference to evidence ## Run this against your own environment.