The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses sudo commands to install system packages (apache2, libapache2-mod-proxy-html), modify system-level configuration files in /etc/apache2/, and manage system services. This represents high-privilege execution on the host machine.
[EXTERNAL_DOWNLOADS]: It instructs the agent to download and install third-party packages ajpShooter and ajpy via pip, as well as apache2 via apt. These dependencies are not version-pinned and are fetched from public registries during execution.
[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions and payloads for achieving remote code execution (RCE) on target servers. This includes providing a JSP webshell payload and instructions for generating and deploying malicious WAR files via Tomcat Manager.
[DATA_EXFILTRATION]: The methodology focuses on reading sensitive configuration files from the target's internal directories, such as /WEB-INF/web.xml, /WEB-INF/classes/application.properties, and /META-INF/context.xml, which are known to contain database credentials, API keys, and application secrets.
[CREDENTIALS_UNSAFE]: The skill contains a hardcoded list of common default credentials for Tomcat Manager (e.g., admin:admin, tomcat:s3cret) to be used in automated or manual login attempts.

ajp-ghostcat