The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents the use and download of various offensive security tools from unverified third-party GitHub repositories. These include exploits and utilities from individual users such as worawit, antonioCoco, BeichenDream, Jnnshschl, hfiref0x, and itm4n, which are not categorized as trusted vendors or well-known services.\n- [REMOTE_CODE_EXECUTION]: Automated scans identified confirmed exploit payloads and shellcode generation patterns within the documentation. Specifically, the structured exception handling (SEH) overflow scenario (seh-overflow-static-binary.md) contains functional shellcode, and the potatoes-sanity-check documentation (potatoes-sanity-check.md) includes a PowerShell AMSI bypass technique. Numerous files also contain classic reverse shell patterns used as examples for offensive testing.\n- [COMMAND_EXECUTION]: The documentation describes high-risk command execution sequences, including the use of netcat for reverse shells, the exploitation of SUID binaries via system() calls, and the abuse of service ImagePath registry keys to run arbitrary commands as SYSTEM.\n- [PRIVILEGE_ESCALATION]: The skill provides detailed procedures for escalating privileges, including abusing SeImpersonatePrivilege, SeBackupPrivilege, and various Linux capabilities. It also covers kernel exploits (e.g., CVE-2023-28252) and UAC bypass techniques.\n- [PERSISTENCE]: Instructions are provided for establishing persistent access by modifying authorized_keys for SSH and injecting malicious commands into startup files like ~/.bashrc.\n- [DATA_EXFILTRATION]: The scenarios cover methods for exfiltrating sensitive domain data, such as dumping the NTDS.dit database via DCSync or using DiskShadow to extract registry hives.\n- [NO_CODE]: This skill consists entirely of markdown-based documentation and reference materials. It does not contain any executable logic or scripts that would be run directly by the agent's host environment.

system