system

Files (116)

• SKILL.md
• INDEX.md · reference/
• foothold-patterns.md · reference/
• format-string-exploitation.md · reference/
• heap-exploitation.md · reference/
• acl-abuse-chains.md · reference/scenarios/ad/
• adcs-esc1.md · reference/scenarios/ad/
• adcs-esc15.md · reference/scenarios/ad/
• adcs-esc16.md · reference/scenarios/ad/
• adcs-esc3.md · reference/scenarios/ad/
• adcs-esc4.md · reference/scenarios/ad/
• adcs-esc6.md · reference/scenarios/ad/
• adcs-esc7.md · reference/scenarios/ad/
• adcs-esc8-kerb-relay.md · reference/scenarios/ad/
• adfs-golden-saml.md · reference/scenarios/ad/
• as-rep-roast.md · reference/scenarios/ad/
• badsuccessor-dmsa.md · reference/scenarios/ad/
• certipy-ldap-shell-fallback.md · reference/scenarios/ad/
• constrained-delegation.md · reference/scenarios/ad/
• cross-forest-trust.md · reference/scenarios/ad/
• cross-session-ntlm-relay.md · reference/scenarios/ad/
• dcsync.md · reference/scenarios/ad/
• dns-record-poisoning.md · reference/scenarios/ad/
• gmsa.md · reference/scenarios/ad/
• golden-ticket.md · reference/scenarios/ad/
• kerberoast.md · reference/scenarios/ad/
• kerberos-only-domain.md · reference/scenarios/ad/
• kpasswd-expired-password-reset.md · reference/scenarios/ad/
• lansweeper-cred-mapping-honeypot.md · reference/scenarios/ad/
• laps-readers.md · reference/scenarios/ad/
• ldap-simple-bind-capture.md · reference/scenarios/ad/
• ldap-via-gc-when-389-filtered.md · reference/scenarios/ad/
• ntlm-relay.md · reference/scenarios/ad/
• openssh-key-drop-via-smb-home.md · reference/scenarios/ad/
• pass-the-hash.md · reference/scenarios/ad/
• pass-the-ticket-impacket.md · reference/scenarios/ad/
• pkinit.md · reference/scenarios/ad/
• pre-windows-2000-access.md · reference/scenarios/ad/
• protected-users-bypass.md · reference/scenarios/ad/
• rbcd.md · reference/scenarios/ad/
• rodc-exploitation.md · reference/scenarios/ad/
• shadow-credentials.md · reference/scenarios/ad/
• silver-ticket.md · reference/scenarios/ad/
• spn-less-rbcd-nthash-trick.md · reference/scenarios/ad/
• unconstrained-delegation.md · reference/scenarios/ad/
• wim-image-credential-extraction.md · reference/scenarios/ad/
• wsus-mitm.md · reference/scenarios/ad/
• dtv-poisoning-via-worker-uaf.md · reference/scenarios/
• foothold-access-db-vba.md · reference/scenarios/
• fsop-house-of-apple-2-vfprintf-flag-mods.md · reference/scenarios/
• glibc-tcache-info-leak-via-small-chunk-overlap.md · reference/scenarios/
• house-of-botcake-glibc-237-safe-linking-bypass.md · reference/scenarios/
• apparmor-hat-bypass.md · reference/scenarios/linux-privesc/
• asterisk-runuser-respawn-root.md · reference/scenarios/linux-privesc/
• baron-samedit.md · reference/scenarios/linux-privesc/
• binfmt-misc-suid-laundering.md · reference/scenarios/linux-privesc/
• buffer-overflow.md · reference/scenarios/linux-privesc/
• cap-dac-override.md · reference/scenarios/linux-privesc/
• clamav-debug-xxe.md · reference/scenarios/linux-privesc/
• credential-files-hunt.md · reference/scenarios/linux-privesc/
• …and 56 more

SKILL.md (first lines)

# System

Test system-level security including Active Directory, privilege escalation, and exploit development.

## Techniques

| Type | Key Vectors |
|------|-------------|
| **Active Directory** | Kerberoasting, AS-REP roasting, DCSync, PtH, Golden/RODC Ticket, RBCD, ACL abuse, KeyList, Shadow Credentials, ADCS (ESC1-9/16) |
| **Privilege Escalation** | SUID/sudo abuse, kernel exploits, service misconfig, token manipulation |
| **Exploit Development** | Buffer overflow, format string, ROP chains, shellcode, heap exploitation |

## Workflow

1. Enumerate system and domain information
2. Identify escalation paths and misconfigurations
3. Exploit with appropriate techniques
4. Demonstrate impact (domain admin, root access)
5. Document attack chain with evidence

## Reference

- `reference/INDEX.md` - Router for AD attacks, privilege escalation, and exploit-dev scenarios (see `reference/scenarios/`)
- `reference/format-string-exploitation.md` - Format string read/write primitives, architecture differences, mitigation bypass
- `reference/heap-exploitation.md` - Modern glibc heap techniques (tcache poison, unsorted bin leak, environ stack leak, ROP)

From transilienceai/communitytools, MIT.

More from transilienceai/communitytools