Operator Toolkits — Catalog & Reference.

Toolkit by slot — default + fallback

• C2. Default Sliver (open source, modern, robust). Fallback Cobalt Strike (still the polished baseline, IOC-loud). Mythic for engagements where modular agents are needed.
• Initial access — Windows. Default InveighZero for LLMNR/NBT-NS responder + ntlmrelayx chain. Fallback responder + impacket-ntlmrelayx.
• Credential dump — Windows. Default nanodump (PROCEXP152-style, bypasses many EDR LSASS hooks). Fallback secretsdump.py -ntds via VSS shadow copy on DC.
• Lateral movement. Default WinRM via evil-winrm (least loud), then SMB-Exec via impacket-psexec, last resort DCOM via impacket-dcomexec.
• Privilege escalation enum. Default winPEAS / linPEAS. Fallback PowerUp.ps1 for Windows token paths.
• Exfiltration. Default DNS over Cloudflare DoH (iodine, custom). Fallback HTTPS to attacker domain with valid Let's Encrypt cert.

Meterpreter — commands to know cold

• Session management. background, sessions -i N, sessions -u N upgrade shell→meterpreter, sessions -K kill all.
• Pivoting. route add 10.10.10.0/24 N, then auxiliary/server/socks_proxy on operator side.
• Post-modules. post/windows/gather/hashdump, post/windows/manage/migrate, post/multi/recon/local_exploit_suggester.
• Don't. getsystem on EDR-hardened hosts — every technique it tries is flagged. Use credential-based pathways instead.

PowerShell that survives modern EDR

• AMSI bypass. Patch amsi.dll!AmsiScanBuffer in-memory before loading payload. Signatures rotate; use a current loader.
• Constrained Language Mode escape. Find a signed binary that loads attacker-controlled DLL (DLL hijack via signed COM/RunDLL surface).
• Avoid Invoke-Expression, DownloadString. Both ETW-logged and signature-matched. Prefer [Reflection.Assembly]::Load([Convert]::FromBase64String(...)) with rotated obfuscation.
• Disable PowerShell logging at the script-block level. Patch ETW via ntdll!EtwEventWrite hook before any logged command.

Linux post-foothold

• Capability enum. getcap -r / 2>/dev/null. cap_setuid, cap_dac_read_search, cap_sys_admin are immediate paths to root.
• SUID chains. find / -perm -4000 -type f 2>/dev/null. Cross-check each result against GTFOBins.
• Kernel exploit selection. uname -a + linux-exploit-suggester.sh. Last resort only — kernel exploits crash hosts, document scope explicitly.
• Cron + systemd. cat /etc/crontab /etc/cron.*/* 2>/dev/null; systemctl list-timers. Writable cron scripts run as root often enough to check first.
• Mount + path injection. mount | grep -v nosuid for missing nosuid mount option; echo $PATH for writable PATH entries before root commands.