[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FHZX0CEJQYFDNPPFPDQST":3,"skill-same:01M71FHZX0CEJQYFDNPPFPDQST":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":6,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M71FHZX0CEJQYFDNPPFPDQST","assessment-netpentest-exploit",null,"Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fassessment\u002Fnetpentest\u002Fexploit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"exploit","assessment netpentest exploit","assessment","infrastructure","environments","sonnet","security","pentest","network","reporting","read","scanning","de","port","vulnerability","Bash","security assessment","cybersecurity","host","testing","2026-11-10 10:12:30",false,"---\nname: assessment-netpentest-exploit\ndescription: Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- network-pentest\n- Nmap\n- Metasploit\n- vulnerability-exploitation\n- infrastructure-security\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1046\n- T1082\n- T1562.004\ncve:\n- CVE-2019-0232\ncapec: []\n---\n\n# Conducting Network Penetration Test\n\n## When to Use\n\n- Assessing the security posture of internal or external network infrastructure before or after deployment\n- Validating firewall rules, network segmentation, and access controls under realistic attack conditions\n- Identifying exploitable vulnerabilities in network services, protocols, and configurations\n- Meeting compliance requirements for PCI-DSS, HIPAA, SOC 2, or ISO 27001 that mandate periodic penetration testing\n- Evaluating the effectiveness of IDS\u002FIPS, SIEM, and SOC detection capabilities against real attack traffic\n\n**Do not use** for testing networks without explicit written authorization from the asset owner, against production systems without a pre-approved change window and rollback plan, or for denial-of-service testing unless explicitly scoped and authorized.\n\n## Prerequisites\n\n- Signed Rules of Engagement (RoE) document specifying target IP ranges, excluded hosts, testing hours, and emergency contacts\n- Written authorization letter (get-out-of-jail letter) from the network owner\n- Dedicated testing laptop with Kali Linux or equivalent distribution with up-to-date tools\n- VPN or direct network access to the target scope as defined in the RoE\n- Out-of-band communication channel with the client's incident response team\n- Scope document listing in-scope IP ranges, domains, and any explicitly excluded systems (medical devices, SCADA, critical infrastructure)\n\n## Workflow\n\n### Step 1: Pre-Engagement and Scope Validation\n\nValidate the scope by confirming IP ranges with the client. Verify that all IP addresses in scope are owned by the client using ARIN\u002FRIPE WHOIS lookups. Confirm testing windows, escalation procedures, and any sensitivity constraints. Set up the testing environment with a dedicated VM, VPN connection, and logging enabled on all tools. Create a timestamped activity log that records every command executed, every scan launched, and every exploit attempted throughout the engagement.\n\n### Step 2: Host Discovery and Network Mapping\n\nIdentify live hosts within the authorized scope using layered discovery techniques:\n\n- **ICMP sweep**: `nmap -sn -PE -PP -PM 10.10.0.0\u002F16 -oA discovery_icmp` to find hosts responding to ping\n- **ARP scan** (internal networks): `nmap -sn -PR 10.10.0.0\u002F24 -oA discovery_arp` or `arp-scan -l` for local subnet enumeration\n- **TCP SYN discovery**: `nmap -sn -PS21,22,25,80,443,445,3389,8080 10.10.0.0\u002F16 -oA discovery_tcp` to find hosts with ICMP blocked\n- **UDP discovery**: `nmap -sn -PU53,161,500 10.10.0.0\u002F16 -oA discovery_udp` for hosts only responding on UDP\n\nConsolidate live hosts into a target list. Map the network topology by identifying gateways, VLAN boundaries, and trust relationships using traceroute and SNMP community string guessing where authorized.\n\n### Step 3: Port Scanning and Service Enumeration\n\nPerform detailed port scanning on discovered hosts:\n\n- **Full TCP scan**: `nmap -sS -p- --min-rate 1000 -T4 -oA full_tcp \u003Ctarget>` to identify all open TCP ports\n- **Top UDP ports**: `nmap -sU --top-ports 200 -T4 -oA top_udp \u003Ctarget>` for commonly exploitable UDP services\n- **Service version detection**: `nmap -sV -sC -p \u003Copen_ports> -oA service_enum \u003Ctarget>` to fingerprint service versions and run default NSE scripts\n- **OS fingerprinting**: `nmap -O --osscan-guess -oA os_detection \u003Ctarget>` to identify operating systems\n\nEnumerate discovered services in depth using protocol-specific tools:\n- SMB: `enum4linux -a \u003Ctarget>`, `crackmapexec smb \u003Ctarget> --shares`\n- SNMP: `snmpwalk -v2c -c public \u003Ctarget>`\n- DNS: `dig axfr @\u003Cdns_server> \u003Cdomain>` for zone transfer attempts\n- LDAP: `ldapsearch -x -H ldap:\u002F\u002F\u003Ctarget> -b \"dc=example,dc=com\"`\n\n### Step 4: Vulnerability Identification\n\nCorrelate discovered service versions against known vulnerability databases:\n\n- Run `nmap --script vuln -p \u003Cports> \u003Ctarget>` for NSE vulnerability scripts\n- Use `searchsploit \u003Cservice> \u003Cversion>` to query the Exploit-DB offline database\n- Cross-reference with NVD (National Vulnerability Database) and CVE records for confirmed vulnerabilities\n- Check for default credentials on management interfaces (Tomcat Manager, Jenkins, phpMyAdmin, database consoles)\n- Test for common misconfigurations: anonymous FTP, open SMTP relays, unrestricted SNMP communities, NFS exports without authentication\n\nPrioritize vulnerabilities by CVSS score, exploitability, and business impact. Document each finding with CVE identifier, affected host, service, and version.\n\n### Step 5: Exploitation\n\nAttempt controlled exploitation of validated vulnerabilities using the principle of minimum necessary access:\n\n- **Metasploit Framework**: `msfconsole` with appropriate exploit modules matched to confirmed vulnerabilities. Set RHOSTS, RPORT, and payload options. Prefer bind\u002Freverse TCP Meterpreter for post-exploitation flexibility.\n- **Manual exploitation**: Use public proof-of-concept exploits from Exploit-DB after code review. Compile and modify as needed for the target environment.\n- **Credential attacks**: Use `hydra` or `crackmapexec` for password spraying against discovered services (SSH, RDP, SMB, HTTP basic auth) using common credential lists. Respect lockout policies.\n- **Pass-the-hash \u002F relay**: If NTLM hashes are obtained, attempt pass-the-hash with `impacket-psexec` or relay attacks with `impacket-ntlmrelayx` where SMB signing is disabled.\n\nDocument every exploitation attempt including failures. Capture screenshots of successful compromises showing hostname, IP, current user, and privilege level.\n\n### Step 6: Post-Exploitation and Pivoting\n\nAfter gaining access to a host, demonstrate business impact:\n\n- **Privilege escalation**: Check for local privilege escalation paths using `linpeas.sh` (Linux) or `winPEAS.exe` (Windows). Look for misconfigured services, SUID binaries, unquoted service paths, or kernel exploits.\n- **Credential harvesting**: Extract stored credentials from memory (`mimikatz`), files (config files, browser stores), or cached hashes (`hashdump`).\n- **Lateral movement**: Use obtained credentials to pivot to additional systems. Test network segmentation by attempting to reach out-of-scope networks from compromised hosts.\n- **Data access demonstration**: Identify sensitive data accessible from compromised systems (PII databases, file shares, backup files) and document access without exfiltrating actual data.\n\nMaintain detailed notes on every pivot point, credential obtained, and system accessed to build the attack chain narrative.\n\n### Step 7: Cleanup and Reporting\n\nRemove all testing artifacts from compromised systems:\n\n- Delete uploaded tools, shells, and temporary files\n- Remove any accounts created during testing\n- Revert configuration changes made during exploitation\n- Verify cleanup by re-scanning affected hosts\n\nPrepare the penetration test report with executive summary, methodology description, finding details with CVSS scores, proof-of-concept evidence, and prioritized remediation recommendations.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rules of Engagement (RoE)** | Formal document defining the scope, boundaries, testing hours, authorized actions, and escalation procedures for a penetration test |\n| **Pivot** | Using a compromised host as a relay point to access additional network segments not directly reachable from the tester's position |\n| **Service Enumeration** | The process of identifying running services, their versions, and configurations on discovered hosts to map the attack surface |\n| **Credential Spraying** | Testing a small number of commonly used passwords against many accounts simultaneously to avoid account lockout thresholds |\n| **CVSS** | Common Vulnerability Scoring System; an industry-standard framework for rating the severity of vulnerabilities on a 0-10 scale |\n| **Lateral Movement** | Techniques used to move from one compromised system to another within a network, expanding the scope of access |\n| **Post-Exploitation** | Activities performed after initial compromise including privilege escalation, persistence, credential harvesting, and data access |\n\n## Tools & Systems\n\n- **Nmap**: Network discovery, port scanning, service enumeration, and vulnerability detection via the Nmap Scripting Engine (NSE)\n- **Metasploit Framework**: Exploitation framework providing exploit modules, payloads, encoders, and post-exploitation tools for validated vulnerability exploitation\n- **CrackMapExec**: Swiss-army knife for Windows\u002FActive Directory environments supporting SMB, WinRM, LDAP, and MSSQL enumeration and exploitation\n- **Impacket**: Python library providing low-level programmatic access to network protocols (SMB, MSRPC, Kerberos) used for relay attacks and remote execution\n- **Burp Suite**: Web application proxy used when network services expose HTTP-based management interfaces\n\n## Common Scenarios\n\n### Scenario: Internal Network Penetration Test for a Financial Institution\n\n**Context**: The client is a mid-size bank requiring PCI-DSS compliance. Scope includes the internal corporate network (10.10.0.0\u002F16), excluding payment processing systems in a separate VLAN. Testing window is Monday-Friday 20:00-06:00 to minimize impact on operations.\n\n**Approach**:\n1. Perform ARP-based host discovery on accessible subnets and TCP SYN discovery for hosts with ICMP disabled\n2. Conduct full port scans on all discovered hosts, prioritizing Windows servers and domain controllers\n3. Enumerate SMB shares, SNMP communities, and web management interfaces for quick wins\n4. Identify and exploit an unpatched Apache Tomcat instance with default credentials to gain initial foothold\n5. Escalate privileges via a local Windows kernel vulnerability, then extract cached domain credentials with Mimikatz\n6. Demonstrate lateral movement to the database server containing customer records, proving inadequate network segmentation\n7. Document the complete attack path from initial access to sensitive data, with remediation steps for each vulnerability\n\n**Pitfalls**:\n- Scanning too aggressively during business hours and triggering IDS alerts or service disruptions\n- Failing to verify that all target IPs are actually owned by the client before scanning\n- Not documenting exploitation attempts that failed, missing the opportunity to report on effective controls\n- Forgetting to clean up Meterpreter sessions and uploaded tools after testing\n\n## Output Format\n\n```\n## Finding: Unpatched Apache Tomcat with Default Credentials\n\n**ID**: NET-001\n**Severity**: Critical (CVSS 9.8)\n**Affected Host**: 10.10.5.23 (tomcat-prod.internal.corp)\n**Service**: Apache Tomcat 8.5.31 on port 8080\n**CVE**: CVE-2019-0232\n\n**Description**:\nThe Apache Tomcat instance on 10.10.5.23:8080 is running version 8.5.31, which is\nvulnerable to CVE-2019-0232 (remote code execution via CGI Servlet). Additionally,\nthe Tomcat Manager interface is accessible with default credentials (tomcat:tomcat),\nallowing deployment of arbitrary WAR files.\n\n**Proof of Concept**:\n1. Accessed http:\u002F\u002F10.10.5.23:8080\u002Fmanager\u002Fhtml with credentials tomcat:tomcat\n2. Deployed malicious WAR file containing a reverse shell payload\n3. Obtained command execution as NT AUTHORITY\\SYSTEM\n\n**Impact**:\nFull system compromise of the Tomcat server. From this host, the tester\npivoted to 3 additional systems on the same subnet using harvested credentials,\nultimately accessing the customer database containing 50,000+ records.\n\n**Remediation**:\n1. Immediately change default Tomcat Manager credentials\n2. Upgrade Apache Tomcat to the latest stable release (currently 10.1.x)\n3. Restrict access to the Tomcat Manager interface to authorized management IPs only\n4. Implement network segmentation between web servers and database tier\n```\n","# Conducting Network Penetration Test\n\n## When to Use\n\n- Assessing the security posture of internal or external network infrastructure before or after deployment\n- Validating firewall rules, network segmentation, and access controls under realistic attack conditions\n- Identifying exploitable vulnerabilities in network services, protocols, and configurations\n- Meeting compliance requirements for PCI-DSS, HIPAA, SOC 2, or ISO 27001 that mandate periodic penetration testing\n- Evaluating the effectiveness of IDS\u002FIPS, SIEM, and SOC detection capabilities against real attack traffic\n\n**Do not use** for testing networks without explicit written authorization from the asset owner, against production systems without a pre-approved change window and rollback plan, or for denial-of-service testing unless explicitly scoped and authorized.\n\n## Prerequisites\n\n- Signed Rules of Engagement (RoE) document specifying target IP ranges, excluded hosts, testing hours, and emergency contacts\n- Written authorization letter (get-out-of-jail letter) from the network owner\n- Dedicated testing laptop with Kali Linux or equivalent distribution with up-to-date tools\n- VPN or direct network access to the target scope as defined in the RoE\n- Out-of-band communication channel with the client's incident response team\n- Scope document listing in-scope IP ranges, domains, and any explicitly excluded systems (medical devices, SCADA, critical infrastructure)\n\n## Workflow\n\n### Step 1: Pre-Engagement and Scope Validation\n\nValidate the scope by confirming IP ranges with the client. Verify that all IP addresses in scope are owned by the client using ARIN\u002FRIPE WHOIS lookups. Confirm testing windows, escalation procedures, and any sensitivity constraints. Set up the testing environment with a dedicated VM, VPN connection, and logging enabled on all tools. Create a timestamped activity log that records every command executed, every scan launched, and every exploit attempted throughout the engagement.\n\n### Step 2: Host Discovery and Network Mapping\n\nIdentify live hosts within the authorized scope using layered discovery techniques:\n\n- **ICMP sweep**: `nmap -sn -PE -PP -PM 10.10.0.0\u002F16 -oA discovery_icmp` to find hosts responding to ping\n- **ARP scan** (internal networks): `nmap -sn -PR 10.10.0.0\u002F24 -oA discovery_arp` or `arp-scan -l` for local subnet enumeration\n- **TCP SYN discovery**: `nmap -sn -PS21,22,25,80,443,445,3389,8080 10.10.0.0\u002F16 -oA discovery_tcp` to find hosts with ICMP blocked\n- **UDP discovery**: `nmap -sn -PU53,161,500 10.10.0.0\u002F16 -oA discovery_udp` for hosts only responding on UDP\n\nConsolidate live hosts into a target list. Map the network topology by identifying gateways, VLAN boundaries, and trust relationships using traceroute and SNMP community string guessing where authorized.\n\n### Step 3: Port Scanning and Service Enumeration\n\nPerform detailed port scanning on discovered hosts:\n\n- **Full TCP scan**: `nmap -sS -p- --min-rate 1000 -T4 -oA full_tcp \u003Ctarget>` to identify all open TCP ports\n- **Top UDP ports**: `nmap -sU --top-ports 200 -T4 -oA top_udp \u003Ctarget>` for commonly exploitable UDP services\n- **Service version detection**: `nmap -sV -sC -p \u003Copen_ports> -oA service_enum \u003Ctarget>` to fingerprint service versions and run default NSE scripts\n- **OS fingerprinting**: `nmap -O --osscan-guess -oA os_detection \u003Ctarget>` to identify operating systems\n\nEnumerate discovered services in depth using protocol-specific tools:\n- SMB: `enum4linux -a \u003Ctarget>`, `crackmapexec smb \u003Ctarget> --shares`\n- SNMP: `snmpwalk -v2c -c public \u003Ctarget>`\n- DNS: `dig axfr @\u003Cdns_server> \u003Cdomain>` for zone transfer attempts\n- LDAP: `ldapsearch -x -H ldap:\u002F\u002F\u003Ctarget> -b \"dc=example,dc=com\"`\n\n### Step 4: Vulnerability Identification\n\nCorrelate discovered service versions against known vulnerability databases:\n\n- Run `nmap --script vuln -p \u003Cports> \u003Ctarget>` for NSE vulnerability scripts\n- Use `searchsploit \u003Cservice> \u003Cversion>` to query the Exploit-DB offline database\n- Cross-reference with NVD (National Vulnerability Database) and CVE records for confirmed vulnerabilities\n- Check for default credentials on management interfaces (Tomcat Manager, Jenkins, phpMyAdmin, database consoles)\n- Test for common misconfigurations: anonymous FTP, open SMTP relays, unrestricted SNMP communities, NFS exports without authentication\n\nPrioritize vulnerabilities by CVSS score, exploitability, and business impact. Document each finding with CVE identifier, affected host, service, and version.\n\n### Step 5: Exploitation\n\nAttempt controlled exploitation of validated vulnerabilities using the principle of minimum necessary access:\n\n- **Metasploit Framework**: `msfconsole` with appropriate exploit modules matched to confirmed vulnerabilities. Set RHOSTS, RPORT, and payload options. Prefer bind\u002Freverse TCP Meterpreter for post-exploitation flexibility.\n- **Manual exploitation**: Use public proof-of-concept exploits from Exploit-DB after code review. Compile and modify as needed for the target environment.\n- **Credential attacks**: Use `hydra` or `crackmapexec` for password spraying against discovered services (SSH, RDP, SMB, HTTP basic auth) using common credential lists. Respect lockout policies.\n- **Pass-the-hash \u002F relay**: If NTLM hashes are obtained, attempt pass-the-hash with `impacket-psexec` or relay attacks with `impacket-ntlmrelayx` where SMB signing is disabled.\n\nDocument every exploitation attempt including failures. Capture screenshots of successful compromises showing hostname, IP, current user, and privilege level.\n\n### Step 6: Post-Exploitation and Pivoting\n\nAfter gaining access to a host, demonstrate business impact:\n\n- **Privilege escalation**: Check for local privilege escalation paths using `linpeas.sh` (Linux) or `winPEAS.exe` (Windows). Look for misconfigured services, SUID binaries, unquoted service paths, or kernel exploits.\n- **Credential harvesting**: Extract stored credentials from memory (`mimikatz`), files (config files, browser stores), or cached hashes (`hashdump`).\n- **Lateral movement**: Use obtained credentials to pivot to additional systems. Test network segmentation by attempting to reach out-of-scope networks from compromised hosts.\n- **Data access demonstration**: Identify sensitive data accessible from compromised systems (PII databases, file shares, backup files) and document access without exfiltrating actual data.\n\nMaintain detailed notes on every pivot point, credential obtained, and system accessed to build the attack chain narrative.\n\n### Step 7: Cleanup and Reporting\n\nRemove all testing artifacts from compromised systems:\n\n- Delete uploaded tools, shells, and temporary files\n- Remove any accounts created during testing\n- Revert configuration changes made during exploitation\n- Verify cleanup by re-scanning affected hosts\n\nPrepare the penetration test report with executive summary, methodology description, finding details with CVSS scores, proof-of-concept evidence, and prioritized remediation recommendations.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rules of Engagement (RoE)** | Formal document defining the scope, boundaries, testing hours, authorized actions, and escalation procedures for a penetration test |\n| **Pivot** | Using a compromised host as a relay point to access additional network segments not directly reachable from the tester's position |\n| **Service Enumeration** | The process of identifying running services, their versions, and configurations on discovered hosts to map the attack surface |\n| **Credential Spraying** | Testing a small number of commonly used passwords against many accounts simultaneously to avoid account lockout thresholds |\n| **CVSS** | Common Vulnerability Scoring System; an industry-standard framework for rating the severity of vulnerabilities on a 0-10 scale |\n| **Lateral Movement** | Techniques used to move from one compromised system to another within a network, expanding the scope of access |\n| **Post-Exploitation** | Activities performed after initial compromise including privilege escalation, persistence, credential harvesting, and data access |\n\n## Tools & Systems\n\n- **Nmap**: Network discovery, port scanning, service enumeration, and vulnerability detection via the Nmap Scripting Engine (NSE)\n- **Metasploit Framework**: Exploitation framework providing exploit modules, payloads, encoders, and post-exploitation tools for validated vulnerability exploitation\n- **CrackMapExec**: Swiss-army knife for Windows\u002FActive Directory environments supporting SMB, WinRM, LDAP, and MSSQL enumeration and exploitation\n- **Impacket**: Python library providing low-level programmatic access to network protocols (SMB, MSRPC, Kerberos) used for relay attacks and remote execution\n- **Burp Suite**: Web application proxy used when network services expose HTTP-based management interfaces\n\n## Common Scenarios\n\n### Scenario: Internal Network Penetration Test for a Financial Institution\n\n**Context**: The client is a mid-size bank requiring PCI-DSS compliance. Scope includes the internal corporate network (10.10.0.0\u002F16), excluding payment processing systems in a separate VLAN. Testing window is Monday-Friday 20:00-06:00 to minimize impact on operations.\n\n**Approach**:\n1. Perform ARP-based host discovery on accessible subnets and TCP SYN discovery for hosts with ICMP disabled\n2. Conduct full port scans on all discovered hosts, prioritizing Windows servers and domain controllers\n3. Enumerate SMB shares, SNMP communities, and web management interfaces for quick wins\n4. Identify and exploit an unpatched Apache Tomcat instance with default credentials to gain initial foothold\n5. Escalate privileges via a local Windows kernel vulnerability, then extract cached domain credentials with Mimikatz\n6. Demonstrate lateral movement to the database server containing customer records, proving inadequate network segmentation\n7. Document the complete attack path from initial access to sensitive data, with remediation steps for each vulnerability\n\n**Pitfalls**:\n- Scanning too aggressively during business hours and triggering IDS alerts or service disruptions\n- Failing to verify that all target IPs are actually owned by the client before scanning\n- Not documenting exploitation attempts that failed, missing the opportunity to report on effective controls\n- Forgetting to clean up Meterpreter sessions and uploaded tools after testing\n\n## Output Format\n\n```\n## Finding: Unpatched Apache Tomcat with Default Credentials\n\n**ID**: NET-001\n**Severity**: Critical (CVSS 9.8)\n**Affected Host**: 10.10.5.23 (tomcat-prod.internal.corp)\n**Service**: Apache Tomcat 8.5.31 on port 8080\n**CVE**: CVE-2019-0232\n\n**Description**:\nThe Apache Tomcat instance on 10.10.5.23:8080 is running version 8.5.31, which is\nvulnerable to CVE-2019-0232 (remote code execution via CGI Servlet). Additionally,\nthe Tomcat Manager interface is accessible with default credentials (tomcat:tomcat),\nallowing deployment of arbitrary WAR files.\n\n**Proof of Concept**:\n1. Accessed http:\u002F\u002F10.10.5.23:8080\u002Fmanager\u002Fhtml with credentials tomcat:tomcat\n2. Deployed malicious WAR file containing a reverse shell payload\n3. Obtained command execution as NT AUTHORITY\\SYSTEM\n\n**Impact**:\nFull system compromise of the Tomcat server. From this host, the tester\npivoted to 3 additional systems on the same subnet using harvested credentials,\nultimately accessing the customer database containing 50,000+ records.\n\n**Remediation**:\n1. Immediately change default Tomcat Manager credentials\n2. Upgrade Apache Tomcat to the latest stable release (currently 10.1.x)\n3. Restrict access to the Tomcat Manager interface to authorized management IPs only\n4. Implement network segmentation between web servers and database tier\n```\n",{"cve":49,"name":5,"tags":51,"capec":57,"model":29,"tools":58,"domain":41,"maxTurns":62,"nist_csf":63,"subdomain":68,"description":7,"mitre_attack":69},[50],"CVE-2019-0232",[52,53,54,55,56],"network-pentest","Nmap","Metasploit","vulnerability-exploitation","infrastructure-security",[],[59,39,60,61],"Read","Glob","Grep",20,[64,65,66,67],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[70,71,72],"T1046","T1082","T1562.004","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnetwork\u002Fassessment\u002Fnetpentest\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill assessment-netpentest-exploit",{"tool":86,"command":87},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill assessment-netpentest-exploit",{"tool":89,"command":90},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill assessment-netpentest-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fassessment\u002Fnetpentest\u002Fexploit\u002FSKILL.md",true,[94],{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"index.json","REFERENCE","参考文档",702,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnetwork\u002Fassessment\u002Fnetpentest\u002Fexploit\u002Findex.json",[101,125,145,166,188,204],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[108,109,110,111,112,36,113,114,115,116,117,118,119,120,121,122,123,41,124],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[24,108,132,111,133,134,135,41,39,136,137,138,139,140,36,141,142,34,143,144],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[152,153,154,155,156,157,41,39,158,136,159,160,36,34,161,162,163,164,165,29],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[109,173,174,175,176,177,178,113,179,41,124,180,181,182,183,184,185,186,187,36],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[195,196,109,197,175,177,198,113,199,179,41,124,136,200,201,202,203,187,36,114],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[211,109,175,212,198,113,213,214,41,124,215,216,217,218,219,220,36,114,221,222],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]