AgentSecOps / AgentSecOps/SecOpsAgentKit

[FEATURE] expert(s) - eg. linux/privesc/mitigations/remediations

Aberta
#5 0 comentários 0 reações 0 responsáveis Ver no GitHub
enhancement
Linguagem predominante
Python
Estrelas
209
Forks
39
Métricas de merge de PRs
Nenhum PR com merge em 30d

Descrição

Should probably add "expert" related skills that utilize tools. they should have domain specific knowledge
The following is an example linux privesc / exploitation SKILL.md skill request
## Feature Type
- [x] New skill request

## Description

A Linux system exploitation and privilege escalation skill that provides automated enumeration, vulnerability identification, and exploitation guidance for offensive security operations on Linux systems.

## Use Case

**Problem it solves:**
Automates Linux post-exploitation enumeration, identifies privilege escalation vectors, and suggests exploitation techniques for penetration testing and red team operations.

**Target users:**
Penetration testers, red team operators, security researchers, CTF players

**Security context:**
Post-exploitation phase of penetration tests

## For New Skill Requests

**Proposed Tool:** LinPEAS (Linux Privilege Escalation Awesome Script) + Manual enumeration commands

**Tool Repository/Documentation:**
- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation

**Category:** `offsec` (offensive security)

**Security Frameworks:** MITRE ATT&CK (TA0004 - Privilege Escalation, TA0007 - Discovery)

**Key Capabilities:**
- System enumeration (kernel, OS, architecture)
- SUID/SGID binary identification
- Sudo misconfigurations detection
- Capabilities abuse vectors
- Cron job exploitation paths
- Writable service files discovery
- Password hunting (history, configs, logs)
- Network configuration analysis
- Container breakout detection

## Expected Workflow

1. **Initial access gained** → Agent executes enumeration
2. **LinPEAS scan** → Identifies privilege escalation vectors
3. **Risk prioritization** → Ranks findings by exploitability
4. **Exploitation guidance** → Provides specific commands/techniques
5. **Verification** → Tests privilege escalation success

**Example Commands:**
```bash
# Automated scan
linpeas.sh -a > linpeas_report.txt

# Manual checks
find / -perm -4000 -type f 2>/dev/null # SUID binaries
sudo -l # Sudo permissions
getcap -r / 2>/dev/null # Capabilities
```

## Alternatives Considered

1. **LinEnum** - Older, less maintained
2. **Linux Smart Enumeration (LSE)** - Good but less comprehensive
3. **Unix-privesc-check** - Outdated
4. **Manual enumeration scripts** - Time-consuming, inconsistent

**Why LinPEAS:**
- ✅ Most comprehensive (checks 200+ vectors)
- ✅ Actively maintained
- ✅ Color-coded severity ratings
- ✅ GTFOBins integration
- ✅ Container-aware

## Additional Context

**Critical skill components:**
- Kernel exploit detection (CVE mapping)
- Service misconfigurations (MySQL, Docker, systemd)
- NFS shares with no_root_squash
- Wildcard injection opportunities
- LD_PRELOAD/LD_LIBRARY_PATH hijacking
- PATH manipulation vectors

**Safety considerations:**
- Non-destructive enumeration only
- Logging of all actions

**Output formats:**
- Parseable JSON for tool integration
- Human-readable reports
- MITRE ATT&CK technique mapping
- able to be ingested into different skills/tools

## Willingness to Contribute
- [x] I am willing to submit a PR for this feature
- [x] I can help test this feature
- [x] I can provide domain expertise/guidance

Guia de contribuição

Nenhum guia de contribuição indexado para este repositório

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.