relaying-ntlm-for-adcs-esc8
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The orchestration script
scripts/agent.pyexecutes several local command-line tools to perform the attack. It uses thesubprocessmodule to callcertipy,ntlmrelayx, and coercion tools likePetitPotam.pyandcoercer. These commands are constructed using lists from user-provided arguments, which is a standard practice for CLI wrappers. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdandreferences/api-reference.mdfiles provide instructions for installing necessary security tools from well-known public repositories on GitHub (e.g., Impacket, Certipy, PetitPotam) and via official package managers likepipx. These are standard procedures for establishing the required environment for the documented security exercises.
Audit Metadata