The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill contains extensive documentation and specific commands designed to gain root or administrator access. This includes exploiting misconfigured sudo permissions (GTFOBins), abusing Linux capabilities, leveraging Windows token impersonation (SweetPotato), and exploiting high-privilege service configurations.
[PERSISTENCE]: Instructions are provided for maintaining long-term access to a compromised system. This includes creating malicious scheduled tasks in Windows to execute remote shells and modifying cron scripts in Linux to grant SUID permissions to the bash binary.
[REMOTE_CODE_EXECUTION]: The skill includes patterns for downloading and executing code from external, untrusted sources. Specifically, it provides commands to download PowerShell scripts from a remote server and execute them immediately using the 'Invoke-Expression' (iex) command.
[DATA_EXFILTRATION]: The skill outlines methods for harvesting sensitive data and credentials. It includes techniques for dumping the NTDS.dit database (Active Directory credentials) using Volume Shadow Copy services and stealing credentials via LLMNR poisoning and NTLM relaying.
[COMMAND_EXECUTION]: The core functionality of the skill relies on the agent executing powerful shell and PowerShell commands to interact with the underlying operating system and manipulate system security settings.

Privilege Escalation Methods