The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Instructions for extracting sensitive authentication material from the system.
Targets security-critical files including the SAM and SYSTEM registry hives for hash extraction.
Searches the Windows Registry and file system for cleartext passwords in configuration files and scripts.
Provides commands to extract cleartext WiFi passwords using netsh wlan show profile.
Accesses PowerShell history files which may contain sensitive commands or hardcoded credentials.
[COMMAND_EXECUTION]: Use of high-privilege commands to modify system services and escalate permissions.
Detailed instructions for hijacking service binary paths using sc config to execute arbitrary commands as SYSTEM.
Execution of malicious MSI packages with elevated privileges via msiexec.
Guidance on utilizing token impersonation tools like JuicyPotato and PrintSpoofer to gain Administrator access.
[REMOTE_CODE_EXECUTION]: Procedures for establishing unauthorized remote control of the target host.
Provides specific payload generation commands for reverse TCP shells using MSFVenom.
Includes Netcat command patterns to establish persistent remote access to an external IP address.
[DATA_EXFILTRATION]: Facilitates the removal of sensitive information from the target environment.
Combines credential harvesting techniques with reverse shell payloads, enabling the extraction of passwords and system data to external attacker-controlled infrastructure.
[EXTERNAL_DOWNLOADS]: Mentions the requirement to transfer and execute external auditing and exploitation binaries.
References a wide range of third-party tools such as WinPEAS, Seatbelt, Watson, and accesschk.exe for identifying and exploiting system weaknesses.

Windows Privilege Escalation