kerberos-roasting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill prompt explicitly shows and expects insertion of real credentials, NTLM hashes, and TGTs into command lines and handed-off commands (e.g., GetUserSPNs.py DOMAIN/user:'Password123', -hashes :NTHASH, nxc ldap -u 'user' -p 'Password123'), which requires the LLM to handle and output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document provides explicit, actionable instructions and commands to extract Kerberos TGS and AS-REP hashes (including unauthenticated/targeted methods), persist/save/exfiltrate those hashes, modify AD objects to make accounts roastable (ACL abuse), perform timeroast NTP extraction, and then crack/use recovered credentials for lateral movement/credential dumping—clear, intentional guidance for credential theft and offensive abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running privileged local commands with sudo (timeroast.py, ntpdate/rdate) and to modify state (temporary SPNs / domain objects), which require elevated privileges or change system/AD state, so it pushes actions that can compromise the host or environment.