The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides numerous templates for executing arbitrary code on a remote server through deployed PHP webshells using system() and eval() functions.
[DATA_EXFILTRATION]: Explicit instructions are provided to read and exfiltrate sensitive files, such as /etc/passwd and database configuration files, using curl and base64 encoding to bypass binary transmission issues.
[COMMAND_EXECUTION]: Includes specific payloads to establish interactive reverse shells using Bash and Python, allowing an attacker to gain full terminal access to the target system.
[OBFUSCATION]: Detailed implementations of XOR and AES-128-CBC encryption for both the PHP server-side shell and Python client-side tools are included, specifically designed to bypass IDS and WAF detection by hiding command traffic.
[PERSISTENCE]: The skill outlines several methods for maintaining long-term access, including the creation of cron jobs to redownload shells, the use of .htaccess files to hide shells in image directories, and the use of the touch -r command to spoof file timestamps (timestomping).
[CREDENTIALS_UNSAFE]: Automated commands are provided to search the file system for sensitive metadata and credentials, specifically targeting .env files and PHP files containing database connection strings (PDO, mysqli).
[PRIVILEGE_ESCALATION]: Contains instructions for detecting and bypassing common PHP security hardening measures such as disable_functions and open_basedir to gain higher levels of execution freedom.

webshell-management