pt-workflow

Files (1)

• SKILL.md

SKILL.md (first lines)

# pt-workflow

The driver is the plan. Run one command, do exactly what it prints, record the result, repeat. The
gates are enforced by `scripts/campaign.py`; follow its output literally.

## The loop

```
python3 scripts/campaign.py next
python3 scripts/campaign.py note <row> --arsenal <slug>
python3 scripts/campaign.py done <row> --poc <img> --kind req   # | --dead R | --park Q | --find F
```

## Start / resume

1. `python3 scripts/campaign.py init --type pt` - validates `scope.md` + envelope, repairs
   type/schema. An empty `scope.md` must be filled from the client SoW first (CIDRs, domains, RoE,
   lockout policy). The lockout policy and any destructive-op limits live in `scope.md`, not here.
2. Passes 1-3 feed `state.md` - rustscan/nmap/nxc/LDAP/kerbrute/BloodHound per the recon defaults,
   which yield to `scope.md`'s allowed tooling. Read service output end to end.
3. `python3 scripts/campaign.py board` - writes the 4a rows (plus 4b lateral/privesc/DCSync for the
   pentest approach). Refuses on empty state.
4. Enter the loop, depth-first, one open row at a time.
5. **When a shell/session lands on a host** (reverse shell via `vm-scan.sh --win shell`, or
   meterpreter via `--win msf`), record it: `python3 scripts/campaign.py foothold <host> --win shell`
   (or ride it on the closing find with `done ... --win`). The driver flips that host's `state.md`
   row to `access=foothold`, routes its 4b lateral/privesc rows through `vm-rsh --win <win>`
   (persistent session + operator visibility), and prints `tmux attach -t <eng>` for takeover.

## Gates

Same as the shared driver: G1 arsenal-first, G2 skill-first, G3 typed evidence, G8 tool-first. AD
attacks route through `Skill(hunt-ad)`; local privesc through `Skill(hunt-windows)` /
`Skill(hunt-macos)`; the driver names which per row.

## Autonomy

No approvals. Out-of-envelope work parks to `decisions.md`; the loop never blocks. A spray is gated by
the lockout policy in `scope.md` (the envelope), never attempted blind. Destructive AD operations
(Zerologon and similar) park unless the envelope authorises them.

## Model routing

Explicit per-role model assignment (the driver enforces the verifier gate; the rest is operating policy):

- **Main brain - Opus 5 1M:** the `campaign.py` loop, board/state, strategy, Burp/chrome-devtools, finding write-ups. This session.
- **Verifier - Opus (fresh context), MANDATORY:** before any CONFIRMED, `campaign.py verify <F>` prints an Opus refuter prompt; dispatch ONE fresh Opus agent that reads the raw PoC, tries to REFUTE, and writes `verdicts/<F>.json`. `done --find` refuses unless that verdict exists, is `refuted:false`, and cites the finding's PoC (anti-rubber-stamp). Fails CLOSED.
- **RTL - Opus (fresh context):** `Skill(redteamlead)` for direction at a fork or when a vector stalls.
- **Short tasks - Haiku:** `Skill(wiki-arsenal)` deep, `Skill(delegate)` (mechanical exploit-run), `Skill(ingest)` recon-parse. Bounded, fully-specified, single-shot ONLY.

The line that keeps quota safety: Haiku is allowed for a **bounded single job**, never for open-ended parallel hunting.

**Manual login / MFA the agent cannot do headlessly** (Smart-ID, an SSO/MFA prompt, a CAPTCHA) -> `Skill(chrome-devtools-browser)`: a VISIBLE chromium on the VM desktop (`scripts/browser-visible.sh`) the operator logs into, driven + observed live via the chrome-devtools MCP to capture the authenticated session + real API calls.

## Discipline

- Do NOT invoke `superpowers:brainstorming`/`writing-plans` mid-run; keep no parallel task list.
- Model routing (see `## Model routing`): Opus-1M drives; Haiku for bounded short tasks; the mandatory
  Opus **verifier** gates every finding via `verdicts/<F>.json`. No open-ended hunter fan-out.
- Load-bearing requests through Burp when reachable; degrade to `capture.sh req` otherwise.
- Scope, lockout policy and destructive-op limits come from `scope.md`.
- **RCE-first:** when >1 vector is open, take the one that yields code-exec first - it is the attack
  vector that carries impact; chase lower-impact classes only after code-exec is ruled out or the
  objective needs them (the driver ranks code-exec rows first).
- **Read whole, not grep:** when a sudoer has no findable password and cron/writable/SUID/group
  vectors dead-end, READ `/etc/pam.d/{sudo,su}` + `/etc/sudoers.d/*` whole - a `pam_ssh_agent_auth`
  (hijack a forwarded agent socket -> passwordless sudo), `pam_exec`, or bare `NOPASSWD` line IS the
  vector; read linpeas output WHOLE, a keyword grep skips the tell. See [[linux-privesc]].
- **Long tools:** run pspy/linpeas/tcpdump via `bash scripts/vm-bg.sh <eng> <win> '<tool>'`
  (stages to `/dev/shm`, runs in the stabilized shell, `--read`/`--wait 120` the logfile); never
  hand-roll a backgrounded watcher, and never retry a broken tool pattern >2x - switch method or
  call `Skill(redteamlead)`.

## Close-out

Run the printed chain: `Skill(triage)` -> `Skill(evidence)` -> `Skill(report)` -> `Skill(learn)`.
**The pentest deliverable is a client report**, not a CTF walkthrough. The report generator must run
with `PATH=/opt/prep_report/.venv/bin:$PATH` or every finding loses its severity callout box.

## If the driver is unavailable

Manual fallback: read `Approach.md`, take the top open row for the current host, run its wiki lookup
then its hunt skill, capture `req` evidence, mark `[x]`; on exhaustion one `Deadends.md` line + `[!]`.

From Encod3d-Sec/TORCH, MIT.

More from Encod3d-Sec/TORCH