kerberos-pentesting

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill repeatedly shows and requires embedding plaintext credentials, NTLM hashes, krbtgt/service hashes, and base64 tickets directly into commands (e.g., -p '', DOMAIN.LOCAL/user:password, -nthash <...>, /rc4:, /ticket:<base64_ticket>), which forces an LLM to handle/output secret values verbatim and creates a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit, actionable offensive playbook for Kerberos attacks (user enumeration, AS-REP/Kerberoast, ticket forging, delegation/RBCD, Pass-the-Ticket) including concrete commands and tools to steal credentials, forge persistent tickets, and achieve lateral movement — clearly enabling malicious abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs use of sudo to run ntpdate/chronyd and to copy or overwrite /etc/krb5.conf (and shows a heredoc writing /etc/krb5.conf), which are system-file modifications requiring elevated privileges and thus modify the local machine state.