AgentSecOps / AgentSecOps/SecOpsAgentKit

[FEATURE] expert(s) - eg. linux/privesc/mitigations/remediations

未关闭
#5 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
enhancement
主要语言
Python
星标
209
派生
39
PR 合并指标
30 天内没有已合并 PR

描述

Should probably add "expert" related skills that utilize tools. they should have domain specific knowledge
The following is an example linux privesc / exploitation SKILL.md skill request
## Feature Type
- [x] New skill request

## Description

A Linux system exploitation and privilege escalation skill that provides automated enumeration, vulnerability identification, and exploitation guidance for offensive security operations on Linux systems.

## Use Case

**Problem it solves:**
Automates Linux post-exploitation enumeration, identifies privilege escalation vectors, and suggests exploitation techniques for penetration testing and red team operations.

**Target users:**
Penetration testers, red team operators, security researchers, CTF players

**Security context:**
Post-exploitation phase of penetration tests

## For New Skill Requests

**Proposed Tool:** LinPEAS (Linux Privilege Escalation Awesome Script) + Manual enumeration commands

**Tool Repository/Documentation:**
- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
- https://book.hacktricks.xyz/linux-hardening/privilege-escalation

**Category:** `offsec` (offensive security)

**Security Frameworks:** MITRE ATT&CK (TA0004 - Privilege Escalation, TA0007 - Discovery)

**Key Capabilities:**
- System enumeration (kernel, OS, architecture)
- SUID/SGID binary identification
- Sudo misconfigurations detection
- Capabilities abuse vectors
- Cron job exploitation paths
- Writable service files discovery
- Password hunting (history, configs, logs)
- Network configuration analysis
- Container breakout detection

## Expected Workflow

1. **Initial access gained** → Agent executes enumeration
2. **LinPEAS scan** → Identifies privilege escalation vectors
3. **Risk prioritization** → Ranks findings by exploitability
4. **Exploitation guidance** → Provides specific commands/techniques
5. **Verification** → Tests privilege escalation success

**Example Commands:**
```bash
# Automated scan
linpeas.sh -a > linpeas_report.txt

# Manual checks
find / -perm -4000 -type f 2>/dev/null # SUID binaries
sudo -l # Sudo permissions
getcap -r / 2>/dev/null # Capabilities
```

## Alternatives Considered

1. **LinEnum** - Older, less maintained
2. **Linux Smart Enumeration (LSE)** - Good but less comprehensive
3. **Unix-privesc-check** - Outdated
4. **Manual enumeration scripts** - Time-consuming, inconsistent

**Why LinPEAS:**
- ✅ Most comprehensive (checks 200+ vectors)
- ✅ Actively maintained
- ✅ Color-coded severity ratings
- ✅ GTFOBins integration
- ✅ Container-aware

## Additional Context

**Critical skill components:**
- Kernel exploit detection (CVE mapping)
- Service misconfigurations (MySQL, Docker, systemd)
- NFS shares with no_root_squash
- Wildcard injection opportunities
- LD_PRELOAD/LD_LIBRARY_PATH hijacking
- PATH manipulation vectors

**Safety considerations:**
- Non-destructive enumeration only
- Logging of all actions

**Output formats:**
- Parseable JSON for tool integration
- Human-readable reports
- MITRE ATT&CK technique mapping
- able to be ingested into different skills/tools

## Willingness to Contribute
- [x] I am willing to submit a PR for this feature
- [x] I can help test this feature
- [x] I can provide domain expertise/guidance

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。